Find answers, ask questions, and connect with our
community around the world.

Forums Forums Web Design WordPress Claimed security reviews of new WordPress plugins are not happening or missing things they should spot

  • Claimed security reviews of new WordPress plugins are not happening or missing things they should spot

    updated 2 years, 4 months ago 0 Member · 1 Post
  • Deborah

    Member
    September 11, 2019 at 3:04 pm

    Brand new WordPress plugins are supposed to go through a security review before being allowed in the Plugin Directory. Either those reviews are not happening or they are failing to catch things that should have been caught. Through our proactive monitoring of changes made to plugins in the Plugin Directory to try to catch serious vulnerabilities we just ran across a brand new plugin with an arbitrary file upload vulnerability, a type highly likely to be exploited. Through that we also just ran across a cross-site request forgery (CSRF)/arbitrary file deletion vulnerability in another brand new plugin. We have long offered to provide the team running the Plugin Directory help to have a capability similar to that monitoring. Running the plugin through another tool we have would have warned about those issues as well and we have also long offered the team running the Plugin Directory free access to the advanced mode of that tool for free. We haven’t heard any interest from that team to either of those offers. It is hard to understand why they seem to be unwilling to work with others to try to improve the security of plugins. – by hq overview PluginVulns – –

Viewing 1 of 1 replies
Reply to: Deborah
Your information:

Cancel
Original Post
0 of 0 posts June 2018
Now