We often find that the various things that we do lead to improvements in other things we do. That just came up in something that we started looking into while working on a security review of a WordPress plugin chosen by our customers that has led to an improvement in our automated tool for detecting possible security issues in WordPress plugins, the Plugin Security Checker. While looking at code in the plugin we were checking over for one reason we noticed the possibility of an open redirect vulnerability might be in the code, because of the specifics of the code that seems unlikely to be exploited, but it doesn’t look like the code was actually being used (which has been a reoccurring thing we have noticed when looking at possible vulnerable code recently). An open redirect vulnerability allows a request to one page to be redirected to an arbitrary URL, which is something spammers have been known to abuse. After seeing that code we got the idea of possibly adding a check for code similar to our Plugin Security Checker.

In doing due diligence before adding that code we took a look over the 1,000 most popular plugins available in the Plugin Directory to see what the check might pick up. We found that over 10 plugins were flagged by that. In many case it looks like those plugins should actually being using a different function that would avoid the issue. Let’s look at an example where we confirmed that there is in fact a vulnerability, though only exploitable against anyone logged in to WordPress. That would limit its usefulness to spammer, but it could be used to disguise that a hacker is trying to get a logged in user to click a link that takes them to another website that in turns causes that logged in user to exploit another vulnerability without intending it. [Read more]