When we began our service, our data set of vulnerabilities in WordPress plugin consisted of vulnerabilities that had been publicly disclosed. That allowed us to warn our customers if they were using plugins known to be vulnerable.
As we started the service we started monitoring for the exploitation of previously undisclosed zero-day vulnerabilities, which are vulnerabilities being exploited before the developer is made aware of them. This has allowed us to help our customers protect themselves from vulnerabilities that they otherwise would not have known about despite hackers being aware of them. Much to our surprise this is something that other security providers have not been doing, even one that promotes that they were (security companies it turns out, are not all that honest).
We then introduced the ability for our customers to suggest/vote for plugins to receive security reviews from us.
As of June of this year we have now added an additional layer of monitoring to help protect our customers against vulnerabilities in WordPress plugins. We are now checking for indications that new versions of plugins include security vulnerabilities. We first use pattern matching to identify code in new versions that has the potential to be exploited. We then manually review the code to see if there is in fact an exploitable vulnerability. Through this we have already found quite a few vulnerabilities.
Far too many of those vulnerabilities have not been fixed, so even if you are keeping your plugins up to date you could be vulnerable. By using our service not only do you get warned if you are using those vulnerable plugins (many of which no other service that provides similar data will warn you about), but we are there to help you to make the best decision on how to deal with the situation.
Currently we are limited in how many types of vulnerabilities we can monitor for because of the time it takes to handle each possible vulnerability. If we had more customers we could increase the number of types of vulnerabilities and help to make WordPress plugins more secure.
Some of the Vulnerabilities Found Through This
- PHP Object Injection Vulnerability in Leaky Paywall
- Arbitrary File Viewing Vulnerability in WP Post Popup
- Authenticated PHP Object Injection Vulnerability in Business Directory Plugin
- PHP Object Injection Vulnerability in Product Reviews
- Persistent Cross-Site Scripting (XSS) Vulnerability in Post Custom Templates Lite
- Cross-Site Request Forgery (CSRF)/Arbitrary File Upload Vulnerability in Newsletters
- Information Disclosure Vulnerability in UpiCRM
- Cross-Site Request Forgery (CSRF)/Settings Change Vulnerability in Salon booking system