Login
1 Oct 2024

Plugin Security Scorecard September Results

September was the second full month our Plugin Security Scorecard was available. A fair amount of plugins were checked. A total of 135 plugins were checked last month. With 13 of those plugins being security plugins.

As can be seen below, the results for security plugins were not good. With all but one of those plugins getting a D+ or below. That comes from a combination of different issues. Some of those plugins have security issues. Some come from developers that have had repeated issues with vulnerabilities and are not addressing the underlying problems. Most security plugins are failing to implement best practices for security. Then there is the issue of the plugin developers making security claims that are at least not supported with evidence (and often couldn’t be supported with evidence, since they are not true).

The overall results were better than those for just security plugins, but not great. No plugins got an A+ A, B+ this month. Those grades require the developer is taking proactive measures with security. 37 of the plugins did get a B, which requires that they are avoiding unnecessary security issues.

During September, we made improvements to the tool related to libraries included in plugins. We have continued to expand the libraries cataloged and information shown about them when plugins include them. We now indicate when libraries with GitHub repositories are lacking a security policy. We have also are adding more data on vulnerabilities in those libraries. That could be help plugin developers to update or remove known vulnerable versions of libraries. We say it could, because none of the plugins we found contained versions of a library recently disclosed to be vulnerable have fixed their plugin in the nearly month since we contacted them about that.

Last month we also had interactions with a couple of plugin developers that went very differently.

One of the developers had plugin that got a failing grade because of an advisory warning about the developer. It wasn’t that developer that we warning about. They had forgotten to update the contributors for one of two plugins when they took them over. Once we notified them of that, they corrected the situation, which is benefit beyond a higher score.

Another developer was claiming that we providing misinformation about their plugin. But oddly, in both cases the information they provided us to show our information was wrong actually confirmed that our information was correct. In one case, upon explaining why a situation was problematic, their response was not to dispute that, but say they wanted to continue doing it. That situation is something that the CEO of another party to the problem has said is not ethical, but they are doing anyway.

September Security Scorecard Grades for  Security Plugins

September Security Scorecard Grades for Other Plugins

Related posts:

  1. 600,000+ Install WordPress Plugin MetaSlider Still Using Vulnerable Version of Library 17 Months Later
  2. Spokesperson for WordPress.org Claims It is Committed to “Continued” Transparency and Increasing Security Expectations

Leave a Reply

Your email address will not be published.