How do hackers attack your website? [Lesson 3 in WordPress Security]

How do attackers gain access to your site?

Spoiler alert: There's very little typing to "crack the code." Instead, it's all about exploiting the logic errors and lack of security measures.

And in order to protect yourself efficiently (and we mean prevention, too), you need to know how it's done.

Welcome to WordPress Security Lesson #3. We've spoken to the ethical hackers that work on our database: here's how the attacks are usually done.

The easiest method: Exploiting vulnerabilities

With methods we'll mention later, attackers need to do a lot of work in order to gain access to websites.

But if they know of a plugin or theme vulnerability, they can easily manipulate that flaw in the plugin code to gain access.

For example, a SQL injection attack places SQL in a web form used to check the legitimacy of the authorization request. If the plugin code is flawed (as is the case with vulnerabilities), the request returns true, allowing the attacker to gain access without the username and the password.

In 2024, there were 7,966 new vulnerabilities found in the WordPress ecosystem (34% more than in 2023). High-risk vulnerabilities were also up 11% year on year.

- Patchstack's "State of WordPress Security in 2025" Report

However, Patchstack prevents these exploits. Instead of waiting for updates from developers, you get immediate protection that prevents attackers from exploiting vulnerabilities.

When the hacker tries to attack that vulnerability, they'll be blocked. Your website code won't be affected, and neither will your performance. However, you'll get more time to apply the developer's update.

Goal: Getting access to privileged accounts

In order to wreak havoc on your site, it's ideal for attackers to get access to compromised privileged accounts (e.g., Administrator accounts).

Once they have access, they can easily upload malware.

There are quite a few ways they can get this type of access:

a) Session hijacking

Whenever you log into your website, your browser saves a session cookie. Attackers love it because they don't have to worry about passwords to log in.

Typically, they need access to the device where your initial login happened. They'll cooperate with other cyber criminals to get it; for example, criminals who focus on infecting devices install info-stealing malware and resell the stolen data.

b) Brute force attacks

It’s safe to say that brute force attacks are being performed against every publicly available login page on the internet.

They're launched from large networks (botnets) of previously compromised sites.

The bots that have been set up to perform those attacks rely mostly on different word lists (millions of combinations of made up or leaked usernames and passwords).

c) Leaked credentials

As we like to say, you could do everything right and if Steve still chooses to make his password "pizza123," it's a moot point.

Unfortunately, most people still use the same email and password on different websites, many of which also store this information in plaintext. the Twitter leak or T-Mobile Austria below.)

As soon as one of those sites is compromised, attackers can test your credentials on your other accounts. These password "dumps" are bestsellers in different, illegitimate marketplaces.

How to check if your email or password were leaked

Use https://haveibeenpwned.com/

d) Phishing

Just like pickpockets, attackers sometimes use tricks and social engineering to make you feel safe while stealing your data.

They may set up an identical login page of your site, and then use social engineering to trick you or your team into logging in via this fake page.

Websites compromised by phishing are also often used to host other phishing pages. In targeted attacks, hackers will even register similar domains to make it harder for the targets to spot the URL difference.

For example, in December 2023, attackers were sending emails that pretended to be from the WordPress team, urging people to install security updates:

e) Nulled plugins and themes

Attackers get their hands on a premium plugin. Then, they remove the licensing check code and upload the plugin to websites and forums, so people can download it for free.

The underlying code also comes with backdoors and malware that gives the attacker complete control over the site.

f) Plugins with backdoors

If developers get tired of maintaining a plugin, they can decide to sell/give it over. Attackers look for opportunities like these. They can take over the plugin and release the backdoor with an official update.

We’ve also seen cases in the past where the developers had no malicious intent (there certainly are some with malicious intent), but built in a functional backdoor to provide support to the users.

Plugins expand functionality, but...

They're vulnerable. Even if you pay close attention to any overly official-looking emails and control what you install on your devices, plugins are indubitably the easiest entry points for attackersh.

And in the next lesson, we'll show you how to protect your WordPress site!

If you have any questions, just hit "Reply" and let us know.

See you tomorrow!

💚 from Patchstack