Recently on a fairly regular basis we have been interacting with developers of WordPress plugins that seem to believe that they have a better understanding of security than they actually do, which has lead to them either not fixing vulnerabilities or not making security improvements to their plugins that they really should be. What makes dealing with that more irritating is when we see developers making changes to fix vulnerabilities that don’t actually exist in their plugins. So real vulnerabilities are not getting fixed, while non vulnerabilities are getting “fixed”. Usually that “fix” involves the developer duplicating security protection already being handled in the plugin or by WordPress. Other than causing the plugin to use slightly more resources than needed, this isn’t usually detrimental. If there is someone to fault for that, it is those making false claims about vulnerabilities in plugins, which occurs all too often.

As an example of an unneeded fix, let’s take a look at version 5.2.13 of bbPress. The release announcement states that the version: [Read more]