Over the past several months there has been an uptick in the number of web sites running Content Management Systems that have been compromised. Systems like WordPress, Joomla or Drupal have all been targeted. Site administrators struggle to keep their CMS’s patched and almost never remember to include all the plugins that are used. In many cases the plugin vulnerabilities can do just as much evil as the core CMS vulnerabilities. Due to the breadth and quality of maintenance and support for plugins vulnerabilities and updates are often not monitored or reported.

A couple of very popular plugins announced serious vulnerabilities recently that allow them to execute arbitary PHP on the server, WP Super Cache and W3 Total Cache. So take care of the plugins that you deploy and if you no longer need them then uninstall them.