WordPress Risk Assessment & Management 4

Question 1

What is the risk of using nulled (pirated) WordPress themes or plugins?

Accepted Answer

High probability of embedded malware and backdoors

Answer

Nulled software is commonly modified to include malicious code such as backdoors, redirects, or spam injectors.

Question 2

Which approach is most effective for managing the risk of SQL injection in custom WordPress code?

Accepted Answer

Using $wpdb->prepare() to parameterize all database queries

Answer

$wpdb->prepare() uses parameterized queries that separate SQL logic from data, preventing injection attacks.

Question 3

A WordPress site has been defaced. After restoring from backup, what is the FIRST risk management step?

Accepted Answer

Identify and remediate the root cause vulnerability before going live again

Answer

Restoring without fixing the vulnerability means the attacker can compromise the site again immediately.

Question 4

What does the CVSS score of a WordPress plugin vulnerability primarily communicate?

Accepted Answer

The severity and exploitability of the vulnerability on a standardized scale

Answer

CVSS (Common Vulnerability Scoring System) provides a numerical score from 0–10 reflecting how severe and exploitable a flaw is.

Question 5

Which WordPress security measure specifically addresses cross-site request forgery (CSRF) risk?

Accepted Answer

WordPress nonces in forms and URLs

Answer

WordPress nonces are one-time tokens that verify requests originate from legitimate authenticated users, blocking CSRF attacks.

WordPress Practice Test