It doesn’t seem like it is too much to expect that a WordPress security plugin would not make your website less secure. But that is exactly what the plugin Easy Hide Login, which has 40,000+ active installations according to wordpress.org, does. The plugin “hides” WordPress’ login page, which isn’t something that you actually need to security wise. Since this isn’t something that you need to do, it really shouldn’t be surprising that someone developing such a plugin wouldn’t have a great understanding of security and that is the case with this plugin (and others in the past, as well).

We came across this plugin while looking for code relevant to an improvement to our Plugin Security Checker tool’s ability to detect issues with SQL injection, which is insecure code related to making queries of a database. The plugin’s code that came across while doing that doesn’t really make sense, as the plugin escapes its setting using esc_sql(), which is for escaping a value being used in a SQL statement: [Read more]