When we discover a vulnerability in a plugin we can help protect the customers of our service by alerting them to the issue and they can then take the action they feel appropriate (we can also assist them in determining what is the appropriate action to take). For plugins that we seeing exploitation attempts against them, we also include the data on the vulnerabilities in the companion Plugin Vulnerabilities plugin, so even those who haven’t signed up the service get notified. But the best thing that can happens is that  the developer of the plugin fixes the vulnerability to insure that everyone can get protected without having to do anything more than update the plugin.

After discovering a vulnerability we notify the developer of the plugin about the vulnerability and offer to help them fix it, but often we don’t even hear anything back from them and the vulnerability isn’t fixed. When that happens the last thing we can do is notify the Plugin Directory about the issue. For most vulnerabilities they will then pull the plugin from the Plugin Directory pending it being fixed. [Read more]