Login

Chrome Extension

11 Mar 2016

Get Alerted When WordPress Plugin Developers Are Not Taking Security Seriously

With our service you get alerted if any of the WordPress plugins you have installed have a vulnerability in the installed version. You can also see what vulnerabilities they have had in other versions, which is something you might use to determine if you should continue you using it. The problem with trying to do that is that isn’t always easy. If you are not dealing with this type of thing on a regular basis there is good chance you wouldn’t have the knowledge as to what security issues are of little concern and what ones are a major concern going forward. You also would have dig in to see if the developer has a pattern of not responding in a timely fashion when a vulnerability is discovered, which can have a significant impact on whether the vulnerability will get exploited. Since we already come in contact with that type of information, we thought it would be useful to start using the knowledge we are collecting to make it easier to find out if security practices of plugin developers are lacking by putting out advisories for developers that have serious issues.

The idea for this also came up because unfortunately we are seeing developers who are doing a really bad job at making sure their plugins are secure. The first advisories we released involves a company that has not been taking basic security measures, had a really serious vulnerability in one their plugins,  doesn’t respond in a timely manner when contacted about security issues, and takes weeks to fix them. The subject of the second one has repeatedly only fixed part of the security issues reported to them. [Read more]

23 Feb 2016

Our New Companion Chrome Extension

With our service you get an email alert if an installed plugin has a vulnerability in the version you are using (the alert is also shown on the Installed Plugin page). In cases where the vulnerability hasn’t been fixed in a newer version of the plugin by the time we become aware of it we take steps to rectify that, because alerting you of a vulnerability without a solution has limited usefulness. We first try to get in touch with the developer to make sure they have been made aware of the issue (often they haven’t) and offer to help them fix it. In cases where that isn’t possible or doesn’t work our next step is to notify the people running the WordPress Plugin Directory. At that point the plugin is usually removed from the directory pending a fix. While that will often get the developer to deal with the issue (and quickly), it doesn’t always.

As we first discussed almost four years ago WordPress admins are not being made aware that their websites are using plugins that have been removed from the Plugin Directory due to security issues (it has also been almost that long that the people running it have they said that they were working on a solution, but it still hasn’t happened). With our service you get notified for plugins you have installed, but what if you head over to the plugin’s page on the WordPress Plugin Directory? You will just get a page indicating that it can’t be found: [Read more]