Update the CMS or application to a patched release
Why it matters
Published security advisories cover the version of your CMS or application that the page shows, so it may be missing fixes. Hosts often back-port fixes without changing the version number, so treat this as a lead to check, not proof of a hole.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Confirm which version you really run, since the number on the page can be stale or cached. Check the admin dashboard, the package manager or the host's panel. If the real version is newer than the one shown, the finding is a false lead.
- Read the advisories named in the finding on the vendor's site and see whether your release is affected. If your host manages the software, ask whether the fixes are back-ported to your release without a version change.
- Take a backup and update on a staging copy first. Update the core, then the themes, plugins or modules that came with it, using your CMS's update tool or package manager, and test the main paths of the site.
- Deploy the update, rescan and clear caches. Turn on automatic security updates if the software offers them. Hiding the version number can be an extra step but does not fix anything.
Related
Scan your domain to see whether this applies to you.