{ "title": "Zero-day vulnerability", "seo_title": "Zero-day vulnerability: definition, examples and defense", "h1": "Zero-day vulnerability", "description": "Zero-day explained: what “day zero” means, how it differs from an n-day flaw, a real WordPress example and how to limit the damage without a patch.", "lead": "A zero-day vulnerability is a security flaw exploited by attackers before the software vendor has fixed it, and often before the vendor even knows it exists. No update can protect the site at that point: only other layers of defense reduce the risk.", "language": "en", "locale": "en-US", "type": "definition", "url": "https://www.wp-masquerade.com/glossary/zero-day/", "canonical": "https://www.wp-masquerade.com/glossary/zero-day/", "markdown": "https://www.wp-masquerade.com/glossary/zero-day/index.md", "json": "https://www.wp-masquerade.com/glossary/zero-day/index.json", "published": "2026-10-28T08:00:00+00:00", "modified": "2026-10-29T02:21:31+00:00", "site": { "name": "WP Masquerade", "url": "https://www.wp-masquerade.com/" }, "translations": [ { "language": "en", "hreflang": "en-US", "title": "Zero-day vulnerability", "url": "https://www.wp-masquerade.com/glossary/zero-day/", "markdown": "https://www.wp-masquerade.com/glossary/zero-day/index.md", "json": "https://www.wp-masquerade.com/glossary/zero-day/index.json" }, { "language": "fr", "hreflang": "fr-FR", "title": "Faille zero-day", "url": "https://www.wp-masquerade.com/fr/definitions/faille-zero-day/", "markdown": "https://www.wp-masquerade.com/fr/definitions/faille-zero-day/index.md", "json": "https://www.wp-masquerade.com/fr/definitions/faille-zero-day/index.json" }, { "language": "es", "hreflang": "es-ES", "title": "Vulnerabilidad zero-day (día cero)", "url": "https://www.wp-masquerade.com/es/glosario/vulnerabilidad-zero-day/", "markdown": "https://www.wp-masquerade.com/es/glosario/vulnerabilidad-zero-day/index.md", "json": "https://www.wp-masquerade.com/es/glosario/vulnerabilidad-zero-day/index.json" }, { "language": "de", "hreflang": "de-DE", "title": "Zero-Day-Lücke", "url": "https://www.wp-masquerade.com/de/glossar/zero-day-luecke/", "markdown": "https://www.wp-masquerade.com/de/glossar/zero-day-luecke/index.md", "json": "https://www.wp-masquerade.com/de/glossar/zero-day-luecke/index.json" }, { "language": "it", "hreflang": "it-IT", "title": "Vulnerabilità zero-day", "url": "https://www.wp-masquerade.com/it/glossario/vulnerabilita-zero-day/", "markdown": "https://www.wp-masquerade.com/it/glossario/vulnerabilita-zero-day/index.md", "json": "https://www.wp-masquerade.com/it/glossario/vulnerabilita-zero-day/index.json" }, { "language": "pt", "hreflang": "pt-BR", "title": "Vulnerabilidade zero-day", "url": "https://www.wp-masquerade.com/pt/glossario/vulnerabilidade-zero-day/", "markdown": "https://www.wp-masquerade.com/pt/glossario/vulnerabilidade-zero-day/index.md", "json": "https://www.wp-masquerade.com/pt/glossario/vulnerabilidade-zero-day/index.json" }, { "language": "nl", "hreflang": "nl-NL", "title": "Zero-day-kwetsbaarheid", "url": "https://www.wp-masquerade.com/nl/woordenlijst/zero-day/", "markdown": "https://www.wp-masquerade.com/nl/woordenlijst/zero-day/index.md", "json": "https://www.wp-masquerade.com/nl/woordenlijst/zero-day/index.json" } ], "headings": [ { "level": 1, "text": "Zero-day vulnerability" }, { "level": 2, "text": "Vulnerability, exploit, attack: three words to tell apart" }, { "level": 2, "text": "An example from the WordPress ecosystem" }, { "level": 2, "text": "How to limit the damage without a patch" }, { "level": 2, "text": "For WordPress: reacting the day the alert comes out" }, { "level": 2, "text": "Common mistakes" } ], "body": "The term originally refers to the number of days defenders have had to prepare: none. When a zero-day vulnerability is exploited, the vendor hasn't released a patch yet, often because it doesn't know about the problem itself. Updating your site does nothing at that stage: there is no safe version to install yet.\n\n## Vulnerability, exploit, attack: three words to tell apart\n\nPeople say “zero-day vulnerability,” “zero-day exploit” or “zero-day attack” interchangeably, yet they are three different things:\n\n- **the vulnerability** is the error in the code (a forgotten access check, unfiltered data);\n- **the exploit** is the program or request that takes advantage of that error;\n- **the attack** is the use of that exploit against real sites. NIST defines it as an attack that exploits a previously unknown hardware or software vulnerability.\n\nAs soon as the patch is released, the flaw is no longer a zero-day in the strict sense. Specialists then call it an “n-day” vulnerability: it is known, documented and often assigned a [CVE](https://www.wp-masquerade.com/glossary/cve/) ID, but still present on every site that hasn't updated. This second period causes most mass hacks, because a public exploit is far easier to industrialize than a discovery kept secret.\n\n![Five-step timeline of a zero-day vulnerability: the flaw exists in the code and nobody knows, an attacker discovers it and exploits it quietly before any patch, the vendor is alerted and develops a fix, the patch, CVE and advisories are released, then the n-day window opens during which sites that haven't updated are exploited at scale](https://www.wp-masquerade.com/media/2026/10/zero-day-chronologie-en.webp)\n\n*“Day zero” is only part of the problem: the time between the patch and your update matters just as much.*\n\n## An example from the WordPress ecosystem\n\nIn June 2023, the Ultimate Member registration plugin allowed any visitor to create an account with arbitrary capabilities, and therefore an administrator account. The CVE-2023-3460 record, published by WPScan, states that the vulnerability was actively exploited. The first fixed releases were incomplete, and it took until version 2.6.7 to close it: [the timeline of this Ultimate Member vulnerability](https://www.wp-masquerade.com/ultimate-member-cve-2023-3460-administrators/) shows exactly what a zero-day looks like from a WordPress site.\n\nTo know whether a vulnerability is actually being exploited, not just theoretical, the US agency CISA maintains the KEV (Known Exploited Vulnerabilities) catalog. It only adds a vulnerability when three conditions are met: a CVE ID, reliable evidence of active exploitation and clear remediation guidance. In France, CERT-FR (France) publishes security alerts for immediate threats and security advisories for vulnerabilities and their fixes.\n\n*Video: “What is a Zero Day Threat?” (IBM Technology)*\n\n## How to limit the damage without a patch\n\nNo measure guarantees immunity against a flaw nobody knows about yet. The goal is to reduce the likelihood of being hit and to shorten your reaction time:\n\n- **Less code, fewer flaws.** Delete unused plugins and themes, even deactivated ones.\n- **Filter upstream.** A [web application firewall](https://www.wp-masquerade.com/glossary/waf/) blocks some families of attacks by their shape, even without knowing the exact flaw; once it is disclosed, a [virtual patch](https://www.wp-masquerade.com/glossary/virtual-patching/) can neutralize it before the update.\n- **Limit privileges.** Few administrator accounts, two-factor authentication and strict file permissions so that an intrusion stays contained.\n- **Detect quickly.** Watch for new accounts and modified files: the [WP Masquerade integrity check](https://www.wp-masquerade.com/features/wordpress-integrity-check/) compares core files against wordpress.org checksums every day, which reveals a compromise after the fact without blocking the attack itself.\n- **Be able to roll back.** Tested [backups following the 3-2-1 rule](https://www.wp-masquerade.com/glossary/3-2-1-backup-rule/) remain the last safety net.\n\n## For WordPress: reacting the day the alert comes out\n\nWhen an actively exploited vulnerability affects a plugin you use and no fixed version exists, the options are simple: deactivate or delete the plugin if the site can do without it, otherwise rely on a firewall rule and monitor closely. As soon as the patch is out, install it without waiting for your weekly update round. To be warned in time, you need a reliable source of alerts: our vulnerability monitoring method compares the available databases.\n\n## Common mistakes\n\n- Calling every critical vulnerability a “zero-day”: a flaw patched six months ago is no longer one, it is simply unpatched on your site.\n- Believing an up-to-date site is out of danger: updating is necessary, but a zero-day targets precisely the latest versions.\n- Thinking a small site doesn't interest anyone: exploits are launched automatically against every site running the targeted plugin.\n\n## Related terms\n\n- [CVE](https://www.wp-masquerade.com/glossary/cve/)\n- [CVSS score](https://www.wp-masquerade.com/glossary/cvss/)\n- [Virtual patching](https://www.wp-masquerade.com/glossary/virtual-patching/)\n- [WAF (web application firewall)](https://www.wp-masquerade.com/glossary/waf/)\n- [Malware](https://www.wp-masquerade.com/glossary/malware/)\n\n\n## Sources\n\n- [NIST CSRC Glossary: zero day attack](https://csrc.nist.gov/glossary/term/zero_day_attack)\n- [CISA: Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities)\n- [CVE Record: CVE-2023-3460](https://www.cve.org/CVERecord?id=CVE-2023-3460)\n- [CISA: Cybersecurity Alerts and Advisories](https://www.cisa.gov/news-events/cybersecurity-advisories)", "definition": "A zero-day vulnerability is a security flaw exploited by attackers before the software vendor has fixed it, and often before the vendor even knows it exists. No update can protect the site at that point: only other layers of defense reduce the risk.", "group": "Web security", "aka": [ "zero-day", "0-day", "zero-day exploit", "zero-day attack" ], "related": [ { "title": "CVE", "url": "https://www.wp-masquerade.com/glossary/cve/", "markdown": "https://www.wp-masquerade.com/glossary/cve/index.md" }, { "title": "CVSS score", "url": "https://www.wp-masquerade.com/glossary/cvss/", "markdown": "https://www.wp-masquerade.com/glossary/cvss/index.md" }, { "title": "Virtual patching", "url": "https://www.wp-masquerade.com/glossary/virtual-patching/", "markdown": "https://www.wp-masquerade.com/glossary/virtual-patching/index.md" }, { "title": "WAF (web application firewall)", "url": "https://www.wp-masquerade.com/glossary/waf/", "markdown": "https://www.wp-masquerade.com/glossary/waf/index.md" }, { "title": "Malware", "url": "https://www.wp-masquerade.com/glossary/malware/", "markdown": "https://www.wp-masquerade.com/glossary/malware/index.md" } ], "sources": [ { "title": "NIST CSRC Glossary: zero day attack", "url": "https://csrc.nist.gov/glossary/term/zero_day_attack" }, { "title": "CISA: Known Exploited Vulnerabilities Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities" }, { "title": "CVE Record: CVE-2023-3460", "url": "https://www.cve.org/CVERecord?id=CVE-2023-3460" }, { "title": "CISA: Cybersecurity Alerts and Advisories", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories" } ], "format": "application/json" }