# Abandoned modules and extensions: the real number one attack vector

> Before a weak password, before a badly configured server, the most common entry point remains a module or extension nobody updates any more, installed for a one-off feature and then forgotten.

- Source canonique : [https://allaux.fr/en/securite/modules-et-extensions-abandonnes](https://allaux.fr/en/securite/modules-et-extensions-abandonnes)
- Langue : EN
- Dernière mise à jour : 2026-09-30

## Direct answer

> List every installed module, including the disabled ones, and note for each the date of its vendor latest release. A module with nothing published for years whose feature you no longer use should be deleted from the server, not merely deactivated: its files stay reachable by the web server as long as they sit in the directory.

## What an abandoned module actually is

An abandoned module isn’t necessarily old or visibly broken. It’s a module installed one day for a specific need — a payment method, a promotional banner, a social media integration — then left in place without being actively used or watched. Its publisher may have stopped trading, stopped maintaining it, or simply stopped releasing patches for an old version still running on your store.

The CMS core, meanwhile, keeps evolving. New versions sometimes ship security fixes that indirectly affect modules, and new flaws are regularly discovered in code that hasn’t changed in years. An abandoned module doesn’t just become useless: it becomes a part of the site that drifts further and further from the security level of everything else.

| Valeur | Description |
|---|---|
| 39.1% | of compromised CMS applications were already outdated at the time of infection |
| 13.97% | of compromised sites had at least one vulnerable plugin or theme at the time of remediation |

Source : Sucuri 2023 Hacked Website & Malware Threat Report

## The Slider Revolution case: an extension you didn’t even know you had

In December 2014, the campaign known as "SoakSoak" compromised more than 100,000 WordPress sites through a flaw in the Slider Revolution extension, according to the count Sucuri published at the time. What made this case unusual: the extension was very often bundled directly inside premium themes, without the buyer even knowing it was there. Installed without their knowledge, it was, of course, never updated. Google blacklisted more than 11,000 domains during this campaign, per the analyses by Sucuri and by Graham Cluley. It’s the clearest example of an entry point a merchant simply can’t monitor if they don’t know it exists.

## Even a well-maintained extension can be temporarily vulnerable

> CVE-2023-28121, a critical flaw (CVSS score 9.8) in the WooCommerce Payments module, installed on more than 600,000 sites, triggered mass attacks from 14 July 2023, peaking at 1.3 million attempts against 157,000 sites on 16 July 2023. The fix shipped in version 5.6.2, released by an otherwise active and serious publisher. The real risk isn’t only outright abandonment: it’s the time gap between a patch being released and it actually being applied on your store.

## Why some patched flaws stay exploitable

The wishlist module blockwishlist for PrestaShop, in versions 2.0.0 to 2.1.0, contained the SQL injection referenced as CVE-2022-31101, fixed in 2.1.1. That was the link that made the core flaw CVE-2022-36408 (also referenced as CVE-2022-31181) exploitable, which affected versions 1.6.0.10 up to and including 1.7.8.6 and was fixed in 1.7.8.7. But on every store where that specific module was never updated or replaced, the entry point stayed open long after the patch was published: the flaw hadn’t disappeared, it had simply stopped being a problem for those who had actually acted.

## How to spot a risky module on your store

1. **Check the last update date** — In the back office, each module or extension usually shows its version and sometimes its release date. A module that hasn’t moved in years, while the CMS core has changed several times, deserves a closer look.
2. **Check it’s still officially available** — A module that has disappeared from the official repository or the publisher’s marketplace, while still active on your site, won’t receive any future patches.
3. **Check the stated compatibility** — A module announcing maximum compatibility well below your CMS’s current version is very likely no longer actively maintained by its publisher.
4. **List what’s genuinely still needed** — A module installed for a one-off test or a campaign that ended long ago, but still active, widens your exposure without providing any benefit.

## Related reading

- **SQL injections explained** — The technical mechanism behind several of the flaws mentioned on this page. ([/securite/injections-sql-expliquees](/securite/injections-sql-expliquees))
- **Tracking flaws that affect your store** — Where and how to follow flaw disclosures before an attacker exploits them. ([/securite/surveiller-les-failles-qui-concernent-ma-boutique](/securite/surveiller-les-failles-qui-concernent-ma-boutique))
- **PHP versions past end of life** — Another silent gap between what still runs and what’s still secure. ([/securite/versions-de-php-en-fin-de-vie](/securite/versions-de-php-en-fin-de-vie))

## FAQ

### How do I know if a module I use has already been hit by a published flaw?

I compare the list of installed modules and their versions against public vulnerability databases, and check the site logs for any exploitation that may already have taken place.

### Should I remove every module I no longer use?

Yes, in most cases. A deactivated module still sitting on the server is often still directly executable, which doesn’t make it any safer than an active one.

### Is a paid premium module safe from this risk?

No. CVE-2023-28121 affected WooCommerce Payments, an official, actively maintained module. Price or a publisher’s seriousness reduces the risk but never removes it entirely.

### How can I tell if an extension was bundled inside my theme without my knowledge?

This is often invisible from the standard back office. I check the theme’s files directly for embedded third-party libraries, as was the case for Slider Revolution in many premium themes.

### How often should I review my modules?

A check with every major CMS core update, plus a general review at least once a quarter, catches a stalled module before it becomes a problem.