WordPress Risk Assessment & Management 4 — Questions and Answers
Question 1: What is the risk of using nulled (pirated) WordPress themes or plugins?
- Slower theme loading speeds
- High probability of embedded malware and backdoors (Correct answer)
- Incompatibility with block editor only
- Loss of theme customization options
Correct answer: High probability of embedded malware and backdoors
Nulled software is commonly modified to include malicious code such as backdoors, redirects, or spam injectors.
Question 2: Which approach is most effective for managing the risk of SQL injection in custom WordPress code?
- Using WordPress nonces for all forms
- Using $wpdb->prepare() to parameterize all database queries (Correct answer)
- Disabling database error logging
- Limiting post content length
Correct answer: Using $wpdb->prepare() to parameterize all database queries
$wpdb->prepare() uses parameterized queries that separate SQL logic from data, preventing injection attacks.
Question 3: A WordPress site has been defaced. After restoring from backup, what is the FIRST risk management step?
- Purchase a new domain name
- Identify and remediate the root cause vulnerability before going live again (Correct answer)
- Change the site's color scheme
- Disable all comments permanently
Correct answer: Identify and remediate the root cause vulnerability before going live again
Restoring without fixing the vulnerability means the attacker can compromise the site again immediately.
Question 4: What does the CVSS score of a WordPress plugin vulnerability primarily communicate?
- How many users have downloaded the plugin
- The severity and exploitability of the vulnerability on a standardized scale (Correct answer)
- The plugin's compatibility with the current WordPress version
- The estimated cost to patch the vulnerability
Correct answer: The severity and exploitability of the vulnerability on a standardized scale
CVSS (Common Vulnerability Scoring System) provides a numerical score from 0–10 reflecting how severe and exploitable a flaw is.
Question 5: Which WordPress security measure specifically addresses cross-site request forgery (CSRF) risk?
- SSL/TLS encryption
- WordPress nonces in forms and URLs (Correct answer)
- File permission hardening
- Database table prefix changes
Correct answer: WordPress nonces in forms and URLs
WordPress nonces are one-time tokens that verify requests originate from legitimate authenticated users, blocking CSRF attacks.
Question 6: A WordPress site handles medical appointment data. Which additional compliance risk framework becomes relevant?
- SOC 2
- HIPAA (Health Insurance Portability and Accountability Act) (Correct answer)
- ISO 9001
- GDPR only
Correct answer: HIPAA (Health Insurance Portability and Accountability Act)
Medical and health-related data in the US is governed by HIPAA, which imposes strict security and privacy requirements.
Question 7: What is the purpose of monitoring WordPress file integrity?
- To optimize image compression ratios
- To detect unauthorized modifications to core, plugin, or theme files (Correct answer)
- To track user login frequency
- To measure page load performance
Correct answer: To detect unauthorized modifications to core, plugin, or theme files
File integrity monitoring compares current files against known-good baselines to flag malicious changes or injections.
WordPress Risk Assessment & Management 4
What is the risk of using nulled (pirated) WordPress themes or plugins?