Login

Tag Archives: Closed Plugins

7 Jun 2019

Closures of Very Popular WordPress Plugins, Week of June 7

While we already are far ahead of other companies in keeping up with vulnerabilities in WordPress plugins (amazingly that isn’t an exaggeration), in looking in to how we could get even better we noticed that in a recent instance were a vulnerability was exploited in a plugin, we probably could have warned our customers about the vulnerability even sooner if we had looked at the plugin when it was first closed on the Plugin Directory instead of when the vulnerability was fixed (though as far as we are aware the exploitation started after we had warned our customers of the fix). So we are now monitoring to see if any of the 1,000 most popular plugins are closed on the Plugin Directory and then seeing if it looks like that was due to a vulnerability.

This week one of those plugins was closed and it has been reopened. [Read more]

6 Jun 2019

Did WordPress Leave Users of the Plugin About Me Page in the Dark About Vulnerability Hackers May Now Be Targeting?

As part of making sure the customers of our service are getting the best information on vulnerabilities in WordPress plugins they may be using we monitor for hackers probing for usage of plugins on our website and then try to figure out what the hackers might be looking to exploit. For the second time today, that has led to us running across a plugin with an unfixed vulnerability that hackers could be interested in.

This time it involves the plugin About Me Page, which was closed on the Plugin Directory on May 9. No reason has been given for the closure, but one reason it could have been closed is for a security vulnerability like the authenticated persistent cross-site scripting (XSS) vulnerability we immediately ran across when we starting looking at the plugin. That is a type of vulnerability we have seen hackers targeting recently, though with only 1,000+ installs it would seem less likely to be a targeted considering the attacker would need a WordPress account, but it may be that hackers are casting a wider net or don’t know the limited usage of the plugin. [Read more]

5 Jun 2019

Vulnerability Details: Authenticated Arbitrary File Upload in Crelly Slider

One of the changelog entries for the latest version of Crelly Slider is “Security patch”, which might explain why it was closed on the Plugin Directory on May 31. Looking at changes made in that version we found that capabilities checks and nonce checks (to prevent cross-site request forgery (CSRF)) where added to a number of AJAX accessible functions. The most serious issue that the lack of those checks looks to have allowed is an authenticated arbitrary file upload vulnerability, which is also exploitable through CSRF. Considering that the plugin has 20,000+ installs that might be something that hackers start to try target on websites that allow user registration (if they haven’t already). Since the plugin is still closed, you can’t update the plugin normally, so any customers needing help with that feel to contact us to get assistance.

…

[Read more]

24 May 2019

Closures of Very Popular WordPress Plugins, Week of May 24

While we already are far ahead of other companies in keeping up with vulnerabilities in WordPress plugins (amazingly that isn’t an exaggeration), in looking in to how we could get even better we noticed that in a recent instance were a vulnerability was exploited in a plugin, we probably could have warned our customers about the vulnerability even sooner if we had looked at the plugin when it was first closed on the Plugin Directory instead of when the vulnerability was fixed (though as far as we are aware the exploitation started after we had warned our customers of the fix). So we are now monitoring to see if any of the 1,000 most popular plugins are closed on the Plugin Directory and then seeing if it looks like that was due to a vulnerability.

This week two of those plugins were closed and one is still closed. [Read more]

24 May 2019

Internet Explorer Reflected Cross-Site Scripting (XSS) Vulnerability in Analytics Code Integration (Analytics)

As part of our keeping track of the possible closure of popular WordPress plugins due to security vulnerabilities, so that we can warn customers of our service ahead of hacker exploiting vulnerabilities those closures might shine a light on, we were notified that the plugin Analytics Code Integration (Analytics), which has 30,000+ installs, was closed today. No reason has been given for the closure. There was a claim 8 months ago that there were security issues in the plugin and the plugin hasn’t been updated since that occurred. In quickly looking over the plugin we found a very minor vulnerability, what we refer to as an Internet Explorer reflected cross-site scripting (XSS) vulnerability.

In the files /notice_pro_get.php and /pro_get.php the following line of code exist in a couple of locations: [Read more]

20 May 2019

Vulnerability Details: Privilege Escalation in myStickymenu

On Friday the plugin myStickymenu was closed on the WordPress Plugin Directory. In a quick check over the plugin we found that it contained two minor vulnerabilities. The next day changes were made to address both of those vulnerabilities. The less serious of those is a privilege escalation vulnerability that allowed anyone to reset the plugin’s settings to their default settings.

…

[Read more]

20 May 2019

Vulnerability Details: Cross-Site Request Forgery (CSRF)/Cross-Site Scripting (XSS) in myStickymenu

On Friday the plugin myStickymenu was closed on the WordPress Plugin Directory. In a quick check over the plugin we found that it contained two minor vulnerabilities. The next day changes were made to address both of those vulnerabilities. The more serious of those is a cross-site request forgery (CSRF)/cross-site scripting (XSS) vulnerability that existed on the plugin’s settings page.

…

[Read more]

17 May 2019

Closures of Very Popular WordPress Plugins, Week of May 17

While we already are far ahead of other companies in keeping up with vulnerabilities in WordPress plugins (amazingly that isn’t an exaggeration), in looking in to how we could get even better we noticed that in a recent instance were a vulnerability was exploited in a plugin, we probably could have warned our customers about the vulnerability even sooner if we had looked at the plugin when it was first closed on the Plugin Directory instead of when the vulnerability was fixed (though as far as we are aware the exploitation started after we had warned our customers of the fix). So we are now monitoring to see if any of the 1,000 most popular plugins are closed on the Plugin Directory and then seeing if it looks like that was due to a vulnerability.

This week three of those plugins were closed and one is currently closed. [Read more]

10 May 2019

Closures of Very Popular WordPress Plugins, Week of May 10

While we already are far ahead of other companies in keeping up with vulnerabilities in WordPress plugins (amazingly that isn’t an exaggeration), in looking in to how we could get even better we noticed that in a recent instance were a vulnerability was exploited in a plugin, we probably could have warned our customers about the vulnerability even sooner if we had looked at the plugin when it was first closed on the Plugin Directory instead of when the vulnerability was fixed (though as far as we are aware the exploitation started after we had warned our customers of the fix). So we are now monitoring to see if any of the 1,000 most popular plugins are closed on the Plugin Directory and then seeing if it looks like that was due to a vulnerability.

This week two of those plugins was closed and they have yet to have been reopened. [Read more]

3 May 2019

Closures of Very Popular WordPress Plugins, Week of May 3

While we already are far ahead of other companies in keeping up with vulnerabilities in WordPress plugins (amazingly that isn’t an exaggeration), in looking in to how we could get even better we noticed that in a recent instance were a vulnerability was exploited in a plugin, we probably could have warned our customers about the vulnerability even sooner if we had looked at the plugin when it was first closed on the Plugin Directory instead of when the vulnerability was fixed (though as far as we are aware the exploitation started after we had warned our customers of the fix). So we are now monitoring to see if any of the 1,000 most popular plugins are closed on the Plugin Directory and then seeing if it looks like that was due to a vulnerability.

This week four of those plugins were closed and two have yet to have been reopened. [Read more]