What an Outdated ExpressionEngine or Craft CMS Install Actually Exposes You To

An unpatched CMS install carries a list of known weaknesses that anyone can look up. Once a version stops receiving security updates, that list only gets longer.

This pattern shows up repeatedly in the security reviews we run on ExpressionEngine and Craft CMS sites. It's consistent enough to be worth explaining plainly.

What "end of life" actually means

Every piece of software eventually stops receiving security updates from its maker. For a CMS, that moment matters more than for most software, because the CMS controls your login system, your database, and often your customer data in one place.

Once a version reaches that point, every flaw discovered in it stays there permanently. There's no patch coming. And because the flaw gets publicly documented (that's how security researchers report these things), anyone can find out exactly what it is and how to use it. Finding this kind of exposure doesn't take a targeted attack. Automated tools scan the web for it all day, every day.

What this looks like in practice

A few examples, all real patterns we've found on live sites, not hypothetical:

• A flaw in how a CMS handles new member registration lets an attacker manipulate the database before they've even logged in.
• A flaw in an admin editing tool lets a logged-in account run code on the server it was never meant to run.
• An old server feature nobody uses anymore, still switched on by default, gives an attacker a route to execute commands directly.

Exploiting any of these takes nothing more than software old enough that the fix was never applied.

It's rarely just the software

The version number is the headline finding, but it's rarely the only one. The same review usually turns up smaller issues that have quietly accumulated over years: login credentials for the live database sitting in the code repository, upload folders that will run any file placed in them, cookies that don't force a secure connection.

Each of these looks minor in isolation. Together, they lower the bar for an attacker considerably. A stolen password or a single compromised account can go a lot further on a site with three or four of these gaps open than on one with none.

The part that catches people off guard

One finding almost always has the same shape. A decision made years ago, reasonable at the time, that nobody has looked at since. A document folder made publicly accessible because it was easier, a security control switched off during a migration and never switched back on, a rule that was fine when the site was smaller and matters more now that it isn't.

The person who inherits a site rarely knows these decisions were made. That's what makes a proper review worth doing even when nothing looks obviously wrong. It's usually several small gaps, each acceptable on its own at the time it was made, adding up quietly over years.

What it actually costs

A breach on a business-critical site costs more than downtime. Customer or member data can be exposed, investigating what happened takes real time and money, and in the UK there's a possible obligation to report it. None of that is quick to resolve, and all of it happens under pressure, usually while the site is also down.

The cost of fixing an outdated install ahead of time is a fraction of the cost of responding to an incident after the fact.

How to find out where you stand

A proper security review checks more than the CMS version number. It looks at what's actually configured: how passwords are stored, whether upload folders can execute files, whether credentials are exposed anywhere in the code, and what protection is actually active versus switched on but never configured.

If you don't know the answer to most of those questions, that's worth finding out before it's forced on you. We offer a security and technical audit that reviews exactly this, on both ExpressionEngine and Craft CMS. Get in touch and we'll tell you plainly what we find.