In reviewing reports of vulnerabilities in WordPress plugins to provide our customers with the best data on vulnerabilities in plugins they use, we often find that there are reports for things that don’t appear to be vulnerabilities. For more problematic reports, we release posts detailing why the vulnerability reports are false, but there have been a lot of that we haven’t felt rose to that level. In particular, are items that are not outright false, just the issue is probably more accurately described as a bug. For those that don’t rise to the level of getting their own post, we now place them in a weekly post when we come across them.

Information Disclosure in Tidio Chat

The changelog for version 5.3.0 of Tidio Chat is:

Security update (prevent printing the real path of webroot on misconfigured servers)

As at least one of our customers is using the plugin, we looked to see if a vulnerability was being fixed (and whether it was actually fixed). What we found was the developer was simply adding code to some files to prevent direct access to them. For example, in the file /config.php this code was added:

3
4
5

if (!defined('WPINC')) {
    die('File loaded directly. Exiting.');
}

That is a good idea from a security perspective, but the cited issue with not doing that, “prevent printing the real path of webroot on misconfigured servers”, isn’t really an issue. If it was WordPress websites have a much larger problem, as that issue occurs with core WordPress files.