WordPress accounts for 90% of compromised CMS sites
Approximately 90% of all Content Management Systems (CMS) that Sucuri studied and helped fix in 2018 were WordPress sites..
In second, third and fourth place with a large gap are Magento (4.6 percent), Joomla (4.3 percent) and Drupal (3.7 percent); this is the relationship published by the company.
Sucuri experts identified that most of the hacks were related to vulnerabilities in plugins and templates, misconfiguration issues, and lack of maintenance by webmasters, who often forgot to update CMS, themes, and plugins.
Experts said that Only 56% of the sites examined were using an up-to-date CMS when he was called to deal with an attack.
E-COMMERCE SITES ARE OFTEN NOT UPDATED
But while 90 percent of all compromised sites were built on the WordPress platform, most of them were running updated versions. Sucuri said that only 36 percent of the compromised WordPress sites the company investigated were running an outdated version. So Sucuri is implying that WordPress's "weaknesses" do not stem exclusively from an update problem.
On the other hand, CMS such as PrestaShop, OpenCart, Joomla, and Magento were almost always running on an outdated version at the time the hack was discovered. 
"This tendency to update outdated versions less frequently suggests that e-commerce sites tend to update less frequently to avoid creating functionality issues and thus not making money," Sucuri said.
Attackers have a strong interest in compromising e-commerce sites because they contain valuable customer data (e.g., credit card and user information). It's crucial that website owners update their software to ensure their sites have the latest security updates and vulnerability patches.
However, despite some sites having outdated CMS versions, "the primary cause of infections was component vulnerabilities," Sucuri said.
SEO SPAM IS ON THE INCREASE
Sucuri confirms that 68% of all compromised sites it investigated had at least one backdoor.
The Sucuri team says that hackers used approximately 56% of the compromised sites to host various malware (for other operations) and placed SEO spam pages on 51% of the compromised sites, a number that has increased over the past year, from 44% in 2017.
SEO spam is one of the fastest growing families in recent years,” Sucuri said.They are difficult to detect and have a significant economic impact on impression marketing.
Most often, as a result of Search Engine Poisoning (SEP) attacks, perpetrators attempt to capitalize on site rankings and rankings to monetize through affiliate marketing or other blackhat tactics. SEO spam is typically achieved through PHP code attacks, database injections (SQL injections), or .htaccess redirects.
Websites affected by SEO attacks are often infected with spam content or redirect visitors to specific spam pages. The unwanted content appears in the form of pharmaceutical advertisements, but can also include injected content related to other industries such as fashion, telecoms, or entertainment (e.g., materials, non-fiction, fashion brands, loans, and online gambling).
Source: zdnet.com
