Teemu  Koskinen,  Petri  Ihantola,  and  Ville  Karavirta  Aalto  University,  Finland  

Quality  Of  WordPress  Plug-­‐Ins:    An  Overview  of  Security  and  User  Ra>ngs  

The  Problem  Do  plugin  ra>ngs  predict  the  amount  of  implementa>on  related  vulnerabili>es  in  WordPress  plugins?  

Data collection and analysis 1.  Download a set of random plug-ins. 2.  Collect their download statistics

and ratings from wordpress.org. 3.  Use the RIPS vulnerability scanner

to detect potential vulnerabilities 4.  Compare the the number of

potential vulnerabilities and vulnerability densities to the star ratings

We also reviewed some potential vulnerabilities to find out if those are real

Preliminary  Results  

Sample  of  322  plugins  •  total  of  3,792,711  downloads  •  total  of  2,783  user  ra>ngs  •  179,393  lines  of  PHP  code  860  poten>al  security  bugs  were  discovered  from  127  plugins.    

Preliminary  Results  

60.6%  of  the  plug-­‐ins  were  “clean”  and  most  of  the  others  had  only  few  vulnerabili>es  

Preliminary  Results  

3,792,711  downloads  and  2,783  ra>ngs  Only  7  ra>ngs/reviews  for  every  100  downloads  

Preliminary  Results  

Ra>ngs  are  not  good  at  explaining  the  amount  or  density  of  the  vulnerabili>es,  

although  there  is  a  weak  nega>ve  correla>on.  

Preliminary  Results  

Light  manual  review  revealed  real  problems  from    a  popular  (>4k  downloads)  plugin  

Conclusions    

"Based  on  our  findings,  we  are  confident  that  there  are  real  risks  involved  when  using  third-­‐party  plug-­‐ins  on  a  WordPress  site.  Many  plug-­‐ins  appeared  not  to  be  vulnerable,  but  as  the  user  ra6ngs  and  download  counts  do  not  assist  in  finding  secure  plug-­‐ins,  proper  inspec6on  should  be  done  by  sta6c  analysis  or  manual  review  before  using  any  plug-­‐in  on  a  WordPress  site.  The  cost  of  soGware  development  and  fast  schedules  in  the  industry  make  installing  plug-­‐ins  an  aHracIve  soluIon,  but  we  hope  our  findings  encourage  developers  to  take  the  6me  to  inspect  the  code  before  using  it."  

  h]p://www.flickr.com/photos/simonehudson/6101238497    h]p://www.flickr.com/photos/stria>c/229531275/  

  h]p://www.flickr.com/photos/23950335@N07/6032357954    h]p://www.flickr.com/photos/kareneliot/2710464400    h]p://www.flickr.com/photos/21572939@N03/2090542246/  

  Ladybug  photo  ©Kimmo  Roimela  used  with  a  permission  

Thank  you!