What does vulnerability mean?#
A vulnerability is a weak point, not the attack itself. It is like a broken lock on a building's entrance: nothing happens until someone uses it, but the danger is there. The weakness might be a programming bug, a misconfiguration, a default password, or an insecure design.
Where does it come from?#
- A mistake in the code of software or a plugin.
- Insecure default settings, such as a simple router password.
- Old software that no longer receives updates.
- Permissions beyond what is needed.
The typical cycle#
A researcher finds the weakness and reports it to the vendor; the vendor releases a patch; users must update. The risk peaks when the weakness has become public but users haven't updated yet. That window is when attackers become active.
A WordPress example#
A plugin that hasn't been updated for a long time may have a known weakness. A site owner who delays updates keeps the site exposed. A cracked version usually has no safe updates at all.
What should we do?#
- Keep the operating system, browser, apps, theme, and plugins updated.
- Remove anything unused.
- Change the default passwords on devices.
- Limit access to the minimum necessary.
- Back up important data.
Understanding that all software has weaknesses is the right attitude; the goal is not eliminating them entirely but reducing risk quickly.