18 Apr

Not All Vulnerabilities in WordPress Plugins Get Fixed in a Timely Manner

When it comes to cyber security there is a lot of bad information out there and when it comes to information about WordPress security, it is at least as bad, if not worse than average for cyber security. One piece of bad information we see when it comes to security of WordPress plugins is the assumption that vulnerabilities in WordPress plugins are promptly fixed, so as long as you keep your plugins up to date you are okay. The reality is that while many are fixed promptly, there are plenty more that don’t get fixed promptly or never get fixed.

To you give some idea of what that means in the real world we went back through the weekly posts we put out detailing what have been doing and adding to the service during each week and found all of the plugins with vulnerabilities that are still removed from the Plugin Directory due to the security vulnerabilities (plugins are removed from the Plugin Directory after the people running it are notified that a plugin has a security issue in the current version of it, with many of those notifications coming from us).

Below you can see all of those plugins and their vulnerabilities. What you can see is that not only are there quite a few, but also there are many vulnerabilities that are rather serious an many that involve plugins used by tens of thousands of websites (and in one case hundreds of thousands). We have excluded last week from the listing since there were many vulnerabilities that developer would not have even had a week to fix yet, due to the people running the Plugin Directory apparently dropping the ball in a major way.

Week of 3/4/2016

Week of 3/18/2016

Week of 3/25/2016

Week of 4/1/2016

Week of 4/8/2016

How We Help You Deal With Unfixed Vulnerabilities

For years we have been pushing for WordPress to start providing notification when vulnerable plugins that have been removed from the Plugin Directory are being used, but despite someone from the Plugin Directory saying that would be happening three years ago, it sill hasn’t. In the meantime we provide several things that help you to deal with this type of situation:

The first is our service (shameless plug), which will send an email alert if one of your installed plugins has a publicly disclosed vulnerability in the version in use (you can also see what vulnerabilities existed in other versions in WordPress). And probably more importantly if the vulnerability hasn’t been fixed yet, you can always get in touch with us to help you decide on what is the best way to handle this problem. In some cases a workaround can easily be crafted to hold you over until a fix comes out or you move to another plugin. In other cases the plugin may need to be removed, pending a fix.

The second is our plugin No Longer in Directory plugin, which as you might guess from the name will identity if any of your installed plugins have been removed from the Plugin Directory (whether for a security issue or some other reason). For some plugins that have been removed from the Plugin Directory for security issues, it will also provide a link to the details of that issue.

The third is our Chrome web browser extension, which adds a security notice to the URLs on the Plugin Directory where a plugin used to be, before it was removed for security issue, so that you know what happened to the plugin.