If you follow our blog you might have seen our post on Friday that mentioned that a false report of a vulnerability in that plugin and quite a few others. We explained the reason they were false as follows:
While the person behind these reports believes that the file they are listing for each of the plugins is a database backup, in reality they are files that came with the plugins. It hard to understand how they didn’t realize that as the contents are exactly the same for the same plugin file on every website they listed, but they apparently didn’t.
In the case of this plugin it should be rather obvious as to what is going on as if you looked at the file, named uinstall.sql, it simply contained SQL code that would run when uninstalling the plugin. Here are the first few lines:
* Delete CJT Tables
DROP TABLE IF EXISTS #__cjtoolbox_authors;
DROP TABLE IF EXISTS #__cjtoolbox_backups;
DROP TABLE IF EXISTS #__cjtoolbox_blocks;
That wouldn’t do anything if you just directly requested file and isn’t a security issue as far we can think of.
Apparently the head of the Plugin Directory, Mika Epstein, couldn’t understand that as there is a topic on the forum for explaining why the plugin had been closed:
Mika Epstein from WordPress has emailed and alerted me to a medium-risk security vulnerability, which needs patching. We would like to thank Mika and the WordPress team for alerting us to this issue and hope to release a patch as soon as possible.
We apologise for any inconvenience.
Who should be apologizing are Mika Epstein and the Plugin Directory team for inappropriately handling this. No one can’t point that out though, since one the frequently problematic moderators of the WordPress Support Forum, Andrew Nevins, closed the topic with this message:
Thank you for your transparent post Damian. We’re going to use this as an announcement and close it to new replies.
It would be great if the WordPress folks actually allowed transparency instead of covering up problems they cause like this. That transparency would include not inappropriately closing topics and allowing for outside oversight of their closures of plugins, as the current process is ripe for abuse.
The change made that is somehow supposed to fix this is to change the extension of the file from .sql to .php, which doesn’t actually do anything security wise as far as we can think.