How can we deal with unmaintained plugins with vulnerabilities?

Question

I see that this is a big problem, not only related to the Wordpress but any other software where third-party add-ons, plugins are loosing support from original author.

But let's focus on Wordpress... According to WordFence there is:

17,383 of those plugins have not been updated in the past 2 years.

3,990 plugins have not been updated since 2010 which is over 7 years ago.

According to Isabel’s post there are several plugins that have a large install base that haven’t been updated for some time:

“Exec-PHP plugin by Sören Weber has over 100,000 active installs despite that it has not been updated since June of 2009. Category Order by Wessley Roche has over 90,000 active installs even though it was last updated in May of 2008. Ultimate Google Analytics by Wilfred van der Deijl has over 80,000 installs even though it was last updated more than nine years ago.”

Beside bad coding which many times lead to newly discovered vulnerabilities, and not only that, many authors are leaving their project without any support, some of them are responding, the other one are completely gone.

There was also a problem with expired domain, here is an article: Expired Domain Leads to WordPress Plugin Redirects

So what can users do in order to prevent this problem, is there any option which will alert users if add-on is vulnerable but there is no update for it?

Answer 1

One of the contributing factors to the use of old, outdated and broken plugins are the website owners. A lot of websites get abandoned, owners are not informed enough or interested enough to spend some time researching alternative plugin, or just keep the WordPress (or any other CMS) updated and secured. So, many websites are stuck in the loop: they use old WordPress because some plugin that is not updated for 5 or 6 years will not work with new WordPress. Using old WordPress and these unmaintained plugins are open doors to all sorts of attacks.

I know that replacing one plugin with another is not easy, but leaving the website vulnerable for 5 or 6 years (or 9, like with the Ultimate Google Analytics plugin) is a plainly irresponsible behaviour of the website owner, and in all that time I am sure there was enough time to do a bit of research to replace one plugin with another, and keep WordPress up to date, and secured.

1. WordPress.org should remove all plugins and themes that were not updated in over 5 years (or 3 or 6, whatever is agreed), and that are not tested with the last 7 or 8 major WordPress versions. There is no consensus currently on what to do with this problem, and we always hear how WordPress.org has 20.000 plugins (or whatever the number is right now), and no one is telling the truth, that only 10% of that is active plugins.

2. WordPress.org needs a dedicated area where the list of all plugin vulnerabilities is available so that website owners can search a single location to determine if the plugins he uses are vulnerable. It is not easy to maintain such list, but it has to be done to inform the users about the security problems from using old and outdated plugins.

3. Website owners need to be active in maintaining the websites. Every website requires a proactive approach to keep the website up to date, fast, and secure. A lot of website owners take all that for granted, and they later complain that they got hacked, and forgetting that they did nothing to prevent that.

4. Research is the key when picking the plugins, and for any task, there are hundreds of plugins, both free or commercial. In many cases, commercial plugins are a safer bet, because the plugin authors get paid, they have monetary incentive to keep updating plugins and keep them secure. I am not saying to always use commercial plugins, and that they are always better, they are not, but that is where the research comes into place. Make the list of features you need, and find free and commercial plugins, and compare the release cycles, features, support from authors. Do not use free or commercial plugins that are not supported by the authors, that are not regularly updated.

I can go on, but the gist of it is: do your research before using any plugin, prepare for the eventuality that you will need to switch from one plugin to another, and set aside time for that.

Answer 2

There's a counter-problem as well: how to deal with plug-ins that haven't been updated in a while, but are not vulnerable. A simple plug-in which provides only a shortcode to insert, say, a simple calculator into a page, isn't going to need much maintaining. The rules of arithmetic aren't going to change with WordPress 4.8.2. You may ask how many plug-ins of this kind exist, particularly compared with the large number of vulnerable ones, and I don't know, but they do exist and they should not fall under the undiscerning scythe of blind security.

This is not to say that your question is wrong, but I'm afraid it does mean that no single, simple solution exists and can exist. Date of last update is a good indicator of vulnerabilities, but not hard proof. WordPress itself - be it the package or wordpress.org - can't just kill any and all plug-ins older than a certain date, it wouldn't be fair. Then again, your problem is real.

So, my answer? Not an easy one, I fear: the security of a WordPress site, specifically, the monitoring of the plug-ins it uses for vulnerabilities, has to be the responsibility of the site's owner. WordPress is flexible, but with great power comes the ability to shot web, sorry, great responsibility. WordPress itself can at most give you the dates to work with, but it can't tell whether a plug-in needed to be maintained since then, only whether it was.