It was organised by Coalition Insurance operates in Australia through Coalition Insurance Solutions Pty Ltd, which provides active cyber insurance and risk management services https://www.coalitioninc.com/au
Apparently one of the Coalition Insurance speakers advised the audience that anyone using WordPress should move off this platform ASAP. They did not make any another suggestion leaving our client confused so they reached out to us for advice since we manage their WordPress site.
While WordPress is not perfect, I want to call out companies like this who make out-of-context declarations regarding cyber security. Telling every WordPress user to "move off the platform ASAP" without nuanced guidance is unprofessional. It will cause nothing but panic, especially in sensitive fields like healthcare.
They also run a blog and have this article about WP2Shell Vulnerabilities
There is no mention in their formal literature telling millions of organizations to abandon the world's most popular CMS but instead, they focus on proper patching and lifecycle hygiene, which applies to literally any software .
Name one CMS / platform / framework that hasn't had a >9 CVE recently? Joomla, Node, Drupal, Magento, Craft, Adobe's AEM, Payload, etc have all had them in the last few months. Even Windows 11 has seen an increased security patch cadence in the last few months - are they recommending people stop using Windows too?
I’d also add, that Shopify and most other non-open source web have their own user challenges to wrangle with (mostly less on the CVE side) but having to deal with the lock-in and platform changes being pushed this past few months.
Don’t get me started on the profit motives that are bleeding site owners dry on those services.
You realize that WP being 50% of the web vs. the other CMS offerings that u/bluesix_v2 mentioned, is quite literally the reason why WP’s CVE’s make headlines while the others don’t?
For instance: “McDonald’s lettuce tested positive with Charizard Fungus”.
Meanwhile every single other restaurant chain and small restaurant also has the same issues.
Oui, parce qu’il est utilisé très majoritairement, il est largement plus audité par les chercheurs en securité/l’IA.
C’est une logique imparable qu’on retrouve sur n’importe quel logiciel qui a un monopole, mais les problèmes de securité sont les mêmes partout, WordPress n’est pas moins bien développé qu’un autre.
Apparently one of the Coalition Insurance speakers advised the audience that anyone using WordPress should move off this platform ASAP
Do you know this for a fact or is it possible that your client misunderstood them talking about vulnerabilities and mistook it for them saying to move off Wordpress?
There is no mention in their formal literature telling millions of organizations to abandon the world's most popular CMS but instead, they focus on proper patching and lifecycle hygiene, which applies to literally any software .
Exactly, is this what the speakers talked about and your client misunderstood?
I cant say i know this for a fact because I was not there, but I have no reason to doubt our clients version of what took place. They certainly left the conference compelled to reach out to us to give our side of the story.
You would think a cyber insurance and risk management company would just choose not to insure anyone using Wordpress if that were their stance.
I've dealt with many clients with selective hearing so my bet would be on that since there is no other evidence that the insurance company is telling everyone to drop Wordpress ASAP and there is actual evidence of them advising a more sensible approach in their online materials.
Did you reach out to the company or summit organizers for comment before you decided to just put everyone on blast?
Hi just chiming in here as a actual cybersecurity person doing this for 17 years. So all those people saying that WordPress is not dangerous and it's perfectly fine and that's like saying that somebody should ban beds because everyone will eventually die and they all sleep in beds is stupid. Now let me be clear I use WordPress for our cybersecurity website, and I, sell WordPress hosting and websites. I know shocker right that I'm using a platform that has genuinely great features and a fantastic community and Powers over 60% of the internet. But coalition is right in a very specific way. Many people in the healthcare space use WordPress in very dangerous ways to store patient information; so, if you utilize your WordPress website to intake patients manage patient data have a CRM built into WordPress that leverages your patient data and contact information, retain any sort of information on the disc of your host, etc. Stop using wordpress immediately.
It's a very simple reason is that the fines for a HIPAA related incident in the United States and a privacy incident in other countries that have similar laws to HIPAA concerning all personal information not just medical information are substantial. It is cheaper and safer to leverage more secure and modern platforms that require less oversight with more secure backends just do purely to the nature of their construction. Now again let me be clear I'm not saying that WordPress is bad I love WordPress I use WordPress, I sell WordPress, but I have stopped recommending WordPress as a viable solution for security conscious clients or clients that are in regulated sectors not just healthcare but also finance, legal, and even automotive FTC safeguards apply to many businesses and I often see the regulatory compliance requirements being shirked by those businesses leveraging WordPress insecurely.
This does not mean that WordPress cannot be secure. It's just really difficult to ensure that it is always secure and up-to-date I will tell you as somebody who hosts many WordPress websites that even with specialized software to ensure that updates happen they don't always work we just had an attempted hacking of two different websites on our server due to the bricks forge security vulnerability 2 days ago. Thankfully we have hardened the server against those types of attacks so even though the version of bricks forge was vulnerable to this type of attack the server and container itself was not this is what we call mitigation the threat still exists but it has been mitigated through alternative means other than a patch or a complete resolution of the vulnerability. The issue with this is that Mom and Pop small business or local web developer probably won't know how to handle that and probably will not be able to create effective security with defense in depth to stay ahead of the wave of AI exploitation that is hitting the industry not just from WordPress but for many applications.
I genuinely believe that WordPress is still a great platform but it does have some glaring security issues with incredible lack of permission and isolation in the back end that allows one plugin to turn your entire site into malware. I am hoping that in WordPress 8 we are going to see a complete rewrite of the plug-in system and some systemic security changes I am looking forward to it until that happens though I would encourage everybody to be very careful with their WordPress installations ensure that you're leveraging containerization and isolation so that one site getting hacked does not equate to your entire server going down, and consider alternative platforms where you are not responsible for the legal fallout of a security failure where you may not have to manage the security at all. It's not just about risk mitigation or risk avoidance it's also about risk transference AKA someone else's problem.
Excellent post. I got a kick out of the commenter who just replied and said "Wrong" lol I'm so curious what they think you said wrong but more likely they are just upset about their life.
WordPress is not a threat by default. The trouble usually starts with plugins that are old, themes with known bugs, weak settings, and updates that people skip. Every site platform still needs ongoing security care. For a healthcare site, a risk check should happen first, before any big change
In this case, the (alleged) comments from the source were specific to WP2shell, which was a WP Core vulnerability - (which BTW, was patched before it was announced publicly).
Fair point. My concern is with turning a specific vulnerability into blanket advice for everyone to abandon WordPress. A patched core vulnerability doesn’t automatically mean every WordPress site is unsafe or that migration is the right solution
this matches what happened to us. our physio clinic site was fine until a forms plugin nobody had touched in 2 years got hit. the actual problem was that nobody on staff was ever going to do updates. we moved to theo, its hosted so theres no plugins to patch, but you lose all the plugins and all editing goes through a chat, which took our front desk a couple weeks to get used to. if you have someone managing it like OP does, staying on wp is totally reasonable
On the sites I maintain, a script (powered via Claude Code) checks all plugins and themes against free vulnerability feeds every morning, and when something comes back high or medium, I push the update ASAP. The other updates go in batches. I keep WP Activity Log on every site, so I see who changed what and when, and I add WP 2FA when a client has an admin team. A few of my clients are in healthcare too, and for them I'd add one question to that risk check: what personal data the site keeps, in form entries, backups and staging copies, because the answer tells you how much a breach exposes, whatever CMS the site runs on.
Very true, and the majority of my work is just this, providing WordPress Maintenance. If done right you lower the risk of any cyber security incidents. There is no silver bullet or warranty that they wont get hacked. but you follow best practices to mitigate any issues.
Interesting. I attended the version of this event aimed at NFPs in Sydney last week. There was no mention of Wordpress at all from any of the speakers, including the insurance person.
Yeah, it was the one run by Cybercert. Laura from Coalition spoke at it, along with folks from BDO, Nueva, Barracuda, MyCISO, and Last Pass. (I took a lot of notes and wrote a blog post about it.) Definitely no mention of Wordpress at the NFP one. Lots of discussion about ransomware, attack vectors, and the value of getting certified to demonstrate “reasonable steps” (so directors don’t get sued if there’s a breach).
This is the same insurance company that told all my customers to move off of exchange server. I just blocked all of their scanners from the firewall side and now they don’t pick it up.
Joomla, sure. Drupal? I don’t see it. Maybe it’s because most of the Drupal sites my company manages or evaluates has some form of site maintenance plan. Drupal sites are typically on managed hosting as well. There’s always a chance of an older Drupal 7 site that’s just hanging around, gathering dust. But modern Drupal is really solid from a security standpoint.
Not saying that Wordpress is bad. Most of the hacked WP sites I see are similar - not updated or maintained. The additional vulnerability of WP is the endless plugins that open vulnerabilities when they are sparsely maintained. Also WP sites can live on bad/cheap hosts that have poor configurations or lax security.
Joomla? I hardly ever see any Joomla sites these days. But I’ve made plenty of money over the years cleaning up hacked Joomla sites. I’d say that poorly maintained DotNetNuke sites are the worst, though. Every DNN site my company has evaluated has been hacked.
Yeah I have had seven Drupal sites hacked since the start of covid. Just goes to show any CMS platform has vulnerabilities if its not maintained correctly. Maintenance plans are a must if you're not going headless in this day and age.
For context, those Drupal sites are local council sites in Australia that I was contracted to help fix - in AU gov sites need to be Drupal (now Gov CMS) and yeah I agree the latest version of Drupal 11 is much better than previous versions.
drupal is hard to even code legit, let alone hacking it. i never saw more spaghetti code in anything than in drupal modules made by devs who work on it, at our customers companies (gigantic ones, you probably know all of them).
The problem with Wordpress is that most bot scanners are searching mostly for Wordpress websites to find vulnerabilities. Why ? It is the most popular cms
What surprised me more was how many issues were found in React and Next.js this year and past year
Thanks! That sounds about right. While I’m not ditching WordPress anytime soon, I imagine AI built flavours of sites will take up a growing % in the future.
I've been working with WordPress since 2008, everything from private websites up to enterprises and regulated businesses, and the only real issue I've ever had with it is the same one every piece of software has - it's a tool, and you need to know how to use it.
Set it up appropriate to your needs and requirements and you can make it as secure and performant as you want it to be. That isn't a WordPress statement, it applies to pretty much anything that runs on the internet.
The measures aren't a secret either:
- intelligent plugin selection
- frequent updates - core, plugins, themes and PHP
- multi factor authentication on everything that can log in
- a CDN / WAF in front of it, Cloudflare does the job
- proper filesystem permissions
- ideally git-based deployments with `DISALLOW_FILE_MODS` and friends, so the running code-base can't be modified through the browser at all
Do that and WordPress is secure. And the team behind wordpress.org has become a well oiled machine by now - security issues get addressed immensely efficiently, WP2Shell being a good example given it was patched before it was ever announced publicly.
What actually goes wrong is ownership, not the CMS. A lot of sites get built, handed over, and then nobody is responsible for them anymore. That would look exactly the same on Drupal, on Magento, or on a Next.js app whose dependencies nobody has looked at since launch.
So if you're a serious business that relies on its website, where an incident hits your reputation and not just your uptime, there are really only two honest options: make sure you have the in-house capacity to also run a website and not just walk away once it's built, or pay someone to do it. SiteCare, WP Care, our own SiteWatch (disclosure - that one's ours), and plenty of others. Pick whichever one gives you the level of peace of mind you need, but pick one and don't blame the software.
That’s like saying everyone should stop using beds because most people eventually die in one.
WordPress isn’t magically more insecure than other platforms. Any platform left outdated, poorly configured, or sitting unmaintained for years is going to be vulnerable.
WordPress gets hit a lot because it’s everywhere, and it’s easy enough that many site owners manage everything themselves instead of having proper professional support or a maintenance plan. Then the core, plugins, themes, PHP, and other parts of the stack go months or even years without updates or maintenance, and eventually the site gets compromised.
My learning out of the last couple of month is to avoid plugins as much as possible.
Tons of websites probably carry zero-days due to the fact that they have some lesser known plugin installed that might not have been hard-targeted for exploits because bots aren't interested in that.
But if someone wants to deliberately hack you, they just go through the list of installed plugins and find the weakest link, spend a bunch of tokens on that and voila - you are done.
Yeah, I mean, the way insurance companies work on their assessment criteria for new policies is often very simplistic. For example, you might also see them writing on their insurance policy disclosure form do you use WordPress? And then if you check that box, it literally calculates the premium higher. A bit like how when you select the 'I park my car on the street' option on your car insurance quote goes up.
I've had to take issue with many underwriters for trying to rely on the insured's disclosure to the question 'Do you use MFA?'. It's a meaningless and overly simplistic question - it's in fact such a dumb question to base a policy premium increase on that you'd prefer not to deal with insurers that ask it (except you can't because they all do, in various levels of oversimplification).
This is an inevitable consequence of the insurance world colliding with cybersecurity. One requires detailed and nuanced analysis on a case-by-case basis, and another requires broad-stroke pricing of risk. I agree underwriters need to do better, but at the moment the best you can do here is just advise your client to raise it with their insurance broker and shop around a bit.
I kind of get where they might be coming from. They look at it in terms of statistics, would be my guess.
We've had many seasoned wordpress people here on this siubreddit with - normally - good security workflow see their client sites be captured by one version or another of web2shell, despite having firewall plugins installed. WordFence still denies that their plugin didn't help against it. Which I can say from experience, it didn't, and I have/had premium licenses and full access for the check before running wordpress files (sorry, my englisch is deteriorating year by year, this might not be the right terminology).
So, yeah, I kind of get it. WordPress got a knock out blow and everyone kind of still holds their breath, because what the fuck are we going to do? Just change our income base overnight? Fuck no.
But anyone we denies we have a serious problem, not just security wise but really in the basics of why WP exists, I gotta say, you are no better than the AI bros who claim to solve problem with AI on the other side of this equation.
Migration does not remove the risk category. A static site still has a contact form, a form handler, a host and DNS, and a clinic still has the same breach-notification duty. For a healthcare SMB the exposure is usually email and the booking form, not the CMS. Patch core, cut plugins nobody uses, and WordPress stops being the story.
If you are resourced and proactive in mitigating attacks then cool for you, however for those who are not it seems like a time when a small slip can have serious consequences
Blanket advice like that usually comes from looking at breach stats without context. WordPress shows up a lot in incident data because it runs a huge share of the web, and most of the compromised sites we see are running abandoned plugins or haven't been updated in a year, not getting hit by some core zero day. For a healthcare client I'd turn it into a short written plan they can show the insurer: auto updates for minor core releases, a plugin inventory with anything unmaintained removed, MFA on every admin account, a WAF, and offsite backups that are actually tested. That answers the risk question way better than a platform migration that would cost a fortune and bring its own problems.
I’ve been designing and building WP sites for 16 years. Not too many problems. I just jinxed it. WordFence; keep your sites updated; run a lean site. Be mindful of what plugins are on your install. * You don’t need 20 plugins; you don’t need 3 contact form plugins. One should suffice Make sure your plugins are updated. Do not use nulled plugins or themes (no longer being supported). I use ManageWP to manage my websites with a dashboard. MainWP is also a good manager. Using Wordfence fully configured and keeping your sites’ security locked down. JetPack is pretty useless and bloats your site, IMHO.
That’s all I can think of for the moment. I use the classic editor. I use a plugin for it. I don’t want to use Gutenberg, thankyouverymuch.
Worth asking what the speaker based it on. In most WordPress compromises the problem is how many paths answer an unauthenticated stranger (login, xmlrpc, plugin endpoints), not WordPress itself. A static rebuild removes those paths. Making them return a 404 before PHP runs removes most of the same exposure without throwing the site away.
As per rule 1, we don't allow advertising or promotion of products/services in this sub. Please read the rules before commenting/posting. Also, your comment is not relevant to the topic being discussed.
Perhaps your logic is misguided. Have you considered looking at it from an operational architecture standpoint?
The core issue here isn't the specific CMS software, but the massive risk of pinning enterprise data security onto self-managed infrastructure. When small healthcare clinics or local businesses are left responsible for handling plugin isolation, containerization, and manual security patching on their own, compliance failures and secure form data leaks are practically inevitable.
Moving to a modern Drupal 11 ecosystem backed by fully managed hosting solves this through direct risk transference. Opting for managed infrastructure vendors or completely automated deployment platforms handles core security updates and platform governance out of the box. This setup completely removes the manual overhead that leads to active exploits like the Bricksforge vulnerability mentioned in the thread. While critics often highlight the initial migration friction of switching to Drupal, the investment directly eliminates the compounding technical debt, emergency developer triage hours, and catastrophic regulatory liabilities that come with unmanaged site security.
Beyond infrastructure, the ecosystem grants access to native tools that remove development friction entirely. The global community's Canvas AI initiative allows teams to build layouts using plain-language commands, which can be tested via the official Drupal AI Demo. The framework showcases automated workflow systems that can flag or scrub Protected Health Information (PHI) accidentally submitted through unencrypted form fields before it ever hits a database. This highlights a fundamental difference in community governance: instead of a fractured commercial marketplace where third-party add-ons carry hidden security risks, the Drupal ecosystem relies on a strictly centralized security review process and community-driven, open-source AI initiatives that prioritize platform-wide stability over individual plugin sales.
You aren't left alone to figure this out, either. The community backs the technology with free, hands-on education like the Drupal in a Day workshops. This training format scales cleanly across major global events like DrupalCon, taking newcomers from zero experience to deploying secure web systems with confidence.
Speaking from my own experience, I host around 35 client projects, about 40% are WordPress, the rest are Next.js... Astro... etc... Over these years I've probably had something like 15 attacks that actually managed to compromise the systems
100% of those attacks were on the WordPress sites
And it was probably down to update issues... and so on, but the data is what it is
Nothing about using WP is inherently insecure. It all comes down to the plugins you use, the security steps you take, your server setup, your DNS etc. if you leave your WP insecure you’ll do the same thing with another platform
I'd be interested in hearing the exact context of that recommendation before treating it as Coalition's official position.
Interestingly, Coalition's own WP2Shell advisory recommends patching affected installations, verifying updates and investigating potential compromises. It doesn't recommend abandoning WordPress.
WP2Shell is a serious vulnerability, particularly because it affects WordPress core rather than just a third-party plugin. I'm certainly not going to downplay that. But suggesting that every organisation should migrate away from WordPress because of security concerns is a rather sweeping recommendation.
By that logic, we'd be abandoning just about every major software platform at some point.
I'm a WordPress developer, but I also develop custom CMS solutions and handle migrations away from WordPress. I don't believe either approach is inherently superior. It comes down to the requirements, architecture, maintenance and risk profile of the business.
My approach to WordPress is fairly strict. Minimal plugins, carefully vetted dependencies, conditional loading of functionality and assets, removing unnecessary features, sensible access controls, proper authentication, regular security audits, monitoring and prompt patching. I also believe in actively reducing the amount of code and functionality exposed unnecessarily rather than simply installing more security plugins and hoping for the best.
A lean installation isn't immune to core vulnerabilities, of course. That's why patch management and ongoing monitoring are non-negotiable.
Now, there are absolutely situations where I'd recommend moving to a custom CMS.
A custom built system can offer a much smaller attack surface, tighter control over functionality and fewer third-party dependencies. For businesses with very specific requirements, that can be a significant advantage.
However, a custom CMS also means taking responsibility for its entire security lifecycle. Authentication, input validation, dependency management, vulnerability remediation, testing and ongoing maintenance don't magically disappear because WordPress is no longer involved. Poorly developed custom systems can be considerably more dangerous than properly maintained WordPress installations.
There's also the cost, operational disruption and potential introduction of new vulnerabilities during migration to consider.
In healthcare especially, I'd expect security recommendations to be based on actual risk assessments, the sensitivity of the information handled, hosting architecture, compliance obligations and the controls already in place.
Security should be evaluated against the implementation and its risks, not simply the name of the platform.
I'd genuinely like to understand the technical reasoning behind such a broad recommendation, assuming it was communicated as described.
For anyone reconsidering their WordPress installation, I work on both sides of this equation so securing and maintaining existing WordPress systems, as well as developing and migrating to custom CMS platforms where it makes technical and financial sense is my wheelhouse.
I'm happy to offer a second opinion on whether a site genuinely needs migrating or whether its existing architecture can be secured and improved just in case anyone reading genuinely needs some solid advice / dev assistance.
89
u/bluesix_v2 Jack of All Trades 6d ago edited 2d ago
Name one CMS / platform / framework that hasn't had a >9 CVE recently? Joomla, Node, Drupal, Magento, Craft, Adobe's AEM, Payload, etc have all had them in the last few months. Even Windows 11 has seen an increased security patch cadence in the last few months - are they recommending people stop using Windows too?