80.4% of Local Web Portals Expose Known Security Risks
A cybersecurity study of 102 publicly accessible sites operated by Singapore-based businesses found that 80.4% contained at least one identifiable security weakness, while one-third were classified as high or critical risk.
The study, released by Equinet Academy in partnership with Cutlazz Cyber Consulting, analyzed publicly visible WordPress installations between April and August 2026.
Researchers identified 1,853 confirmed vulnerabilities linked to documented CVEs, with an average risk score of 42.1 out of 100. Seven sites received a critical-risk rating.
Outdated Components Drive Most of the Exposure
Unpatched software was one of the clearest patterns in the research.
41 of the 102 sites were running outdated WordPress core versions, with some installations dating back to 2015. Every site classified as critical risk was using an outdated core version.
Plugins created another major exposure point. About 70.6% of sites had at least one plugin associated with a confirmed CVE, while 65.7% were running at least one outdated plugin. Researchers counted 199 outdated plugin installations across the sample.
Public-Facing Features Add More Attack Surface
The researchers also found several commonly exposed WordPress components:
- 56.9% had XML-RPC publicly accessible.
- 54.9% exposedwp-cron.
- 29.4% revealed their login path throughrobots.txt.
These findings point more toward routine maintenance and configuration problems than sophisticated exploitation techniques.
Researchers Did Not Exploit the Sites
The assessment was performed using passive, automated scanning. Researchers examined publicly visible WordPress versions, plugins, CVE associations, HTTP headers and exposed endpoints without attempting authenticated access, brute-force attacks or exploitation.
That distinction is important: finding a vulnerability does not mean that a site was compromised.
However, the same publicly visible weaknesses can also be discovered by attackers performing routine internet-wide reconnaissance.
Security Gaps Can Become a Compliance Problem
For organizations collecting personal information, unresolved weaknesses can create additional regulatory concerns under Singapore's Personal Data Protection Act (PDPA), which requires reasonable security safeguards.
The study recommends keeping WordPress core and plugins updated, using HTTPS, disabling unnecessary XML-RPC functionality, reviewing exposed login paths and restricting access to unnecessary files and endpoints.
Basic Maintenance Remains the First Defense
The study's broader message is straightforward: many publicly exposed risks can be reduced without advanced security tooling.
Keeping software patched, removing unnecessary components and regularly checking what a website exposes to the internet can eliminate a significant portion of avoidable attack surface.