I’d guess it’s not because of the inherent insecurity of WordPress, but the sheer size of the ecosystem and the fact that like 40% of the Internet is WordPress sites.
That’s the ecosystem. WordPress itself is pretty basic, these things attack plugins, and their often not-very-experienced creators and users. The thing with WordPress is that this kind of vulnerability comes with the problem space, not the particular solution. If there was a different product in the same space, it would not fare better by default.
Also, I’d bet that a ton of CVEs are filed for C++ libraries, yet nobody is harping on about how insecure C++ is.
Exactly. A plug-in architecture is a feature, and it’s really hard to secure. Instead of going that route, they should have instead solved specific problems. When you make it easy to add someone else’s code, you also make it easy to forget to remove it later, or to not stay updated on which plugins are deprecated/abandoned.
A plug-in system is insecure by design for a public-facing service. YAGNI, so pick a handful of stuff you actually need.
Drupal, but you are getting into a different type of complex symfony code built on years and years of drupalism’s. It’s powerful and pretty well maintained though.
If i were to take a shot every time vulnerabilities are found in the WordPress ecosystem i’d be comatose by now…
It’s not the product, it’s the cavalier consumption of unsigned add-ons despite knowing better.
I’d guess it’s not because of the inherent insecurity of WordPress, but the sheer size of the ecosystem and the fact that like 40% of the Internet is WordPress sites.
And inherent insecurity. It wasn’t designed to be secure, it was designed to be full-featured, so it has a pretty big attack surface.
That’s the ecosystem. WordPress itself is pretty basic, these things attack plugins, and their often not-very-experienced creators and users. The thing with WordPress is that this kind of vulnerability comes with the problem space, not the particular solution. If there was a different product in the same space, it would not fare better by default.
Also, I’d bet that a ton of CVEs are filed for C++ libraries, yet nobody is harping on about how insecure C++ is.
Exactly. A plug-in architecture is a feature, and it’s really hard to secure. Instead of going that route, they should have instead solved specific problems. When you make it easy to add someone else’s code, you also make it easy to forget to remove it later, or to not stay updated on which plugins are deprecated/abandoned.
A plug-in system is insecure by design for a public-facing service. YAGNI, so pick a handful of stuff you actually need.
What are alternatives of WordPress if I wanted to add something to my website?
Drupal, but you are getting into a different type of complex symfony code built on years and years of drupalism’s. It’s powerful and pretty well maintained though.