Common CMS vulnerabilities: what attackers look for and where they find it
By Kike Gandia · Co-Founder & CEO, OSCP
CMS platforms are the most attacked systems on the internet. Not because they are the least secure, but because they are the most widely used. Understanding which vulnerabilities attackers look for is the first step to prioritising an effective security strategy.
Third-party extensions and plugins: the dominant vector
Regardless of the CMS, the pattern is the same: the core has a reasonably mature security process; the third-party extension ecosystem does not. WordPress plugins, PrestaShop modules, Magento extensions and Joomla components are developed by third parties with widely varying levels of security maturity.
The most common vulnerabilities in extensions are: stored XSS in back-office functions, SQL injection in queries with unsanitised user input, file uploads without real type validation, API endpoints with no authentication check, and CSRF in administrative actions without a verification token.
Authentication and admin panels
CMS admin panels are constant targets of automated attacks. The most common vulnerabilities are not sophisticated: no login attempt rate limiting, no MFA for administrative accounts, unchanged default credentials, user enumeration through differences in error messages, and long-lived session tokens without rotation.
An attacker with access to a CMS admin panel has full control over the site: they can inject code, exfiltrate data, install backdoors and compromise external integrations.
Exposed APIs and endpoints
Modern CMS platforms expose full APIs: WordPress has a REST API and XML-RPC; Magento 2 has REST and GraphQL; Drupal has JSON:API; PrestaShop has its own web API. Without correct authentication and authorisation configuration, these endpoints expose user information, content and configuration to any attacker who enumerates them.
WordPress XML-RPC deserves a special mention: enabled by default, it allows remote authentication, and its multicall function lets an attacker brute-force credentials with a single request, multiplying the speed of the attack.
Misconfigured environment
Many CMS compromises do not exploit code vulnerabilities: they exploit misconfigurations of the server or the environment. The most common patterns: incorrect file permissions that allow writing to core or extension directories, configuration files accessible from the outside (wp-config.php.bak, configuration.php, .env), active directory listing in /wp-content/uploads/ or /var/files/, and missing HTTP security headers that facilitate XSS and clickjacking.
FAQ
How do I know if my CMS has any of these vulnerabilities active?
The most reliable approach is a technical penetration test that assesses the real installation. For an initial diagnosis, you can commission a vulnerability assessment (VA) that identifies outdated versions and known CVEs. Pentesting goes further and assesses real exploitability.
Do these vulnerabilities affect a small website the same as an enterprise one?
Yes, although the impact differs. A small website with vulnerabilities can be used as a platform to attack third parties, to host phishing or for SEO spam. An enterprise installation with the same flaws means exposure of customer data, PCI-DSS implications and a far greater reputational and regulatory risk.