Login

Tag Archives: Matt Mullenweg

3 Jun 2019

Privilege Escalation Vulnerability Only Partially Fixed in WordPress Plugin Ultimate Member Due to Use of is_admin()

We can’t emphasize enough that you should not use the plugin Ultimate Member as the plugin has been riddled with security vulnerabilities including one that was widely exploited last year and was slow to be fixed, due to what appears to be a lack of interest by the developer in getting it secure. That lack of interest is particularly problematic due to the fact that the plugin has 100,000+ active installations according to wordpress.org. The latest vulnerability found in it is yet another reminder of that, as the developer attempted to fix a serious vulnerability, but used the wrong code, so there is still a vulnerability, though less easily exploited. The continuation of the vulnerability also involves a security failure in WordPress that was warned about back in February of 2011, but still hasn’t been resolved despite being continually being implicated in widely exploited vulnerabilities.

The situation is also is yet another reminder why actually checking out and testing out claimed fixed vulnerabilities is important, so you don’t incorrectly believe that an unfixed vulnerability that is more widely known about, since it has been noted to have been fixed, has been fixed. That is something we do, but clearly other data sources on WordPress plugin vulnerabilities competing with our service don’t do. [Read more]

19 Oct 2018

The Lack of People Not Tied To Matt Mullenweg in Control of WordPress Is a Negative for the Community

Last week we mentioned another area beyond security where the WordPress community is getting harmed by the people in charge, accessibility when it comes to new Gutenberg content editor. In the wake of the resignation of the head WordPress Accessibility Team, who had pointed to problems caused by Matt Mullenweg in their resignation post, it had been proposed by an employee of Matt Mullenweg’s company Automattic to have independent audit of Gutenberg’s accessibility. To us it sounded like it might be done in way that would be skewed, considering part of the proposal stated:

Feature-for-feature, compared to a classic editor with similar capabilities (eg a bunch of plugins installed), I’d bet* Gutenberg is more accessible. [Read more]

12 Oct 2018

Security Isn’t The Only Place Where the WordPress Community Is Being Harmed By those in Control

Among the many of issues that come together to create the rather poor state of security these days, there is the poor state of security journalism, which isn’t so much journalism, but stenography, with the journalist simply repeating claims made by security companies. Many of those claims are in fact false, which seems like what journalist should be covering especially when you have millions, if not billions of dollars being spent on security products and services marketed with similar lies as well. That spending on products and services that don’t provide the security promised is having international repercussions, making the lack of good journalism so tragic. What seems like it explains some, if not a lot, of that lack of critical coverage is that you have security journalism outlets that are owned by security companies, even while being promoted as being “independent“. Journalists at those outlets are unlikely to be critical of security companies, since that would likely bring attention to the ownership situation and raise concerns about the reason for the critical coverage (even when it would likely be very warranted). It wouldn’t seem hard to believe that other journalist likely would do the same since their next paycheck might be coming from a security company.

WordPress faces a similar situation. One of the few outlets included on the “WordPress Events and News” portion of the WordPress admin dashboard is the WordPress Tavern, which is owned by Matt Mullenweg. That is disclosed on the About page of the website, but doesn’t look to be generally mentioned when something else connected to him is being covered. That connection seems like it might be of concern when it comes to what was mentioned in a recent post on the website, which is headlined WordPress Accessibility Team Lead Resigns, Cites Political Complications Related to Gutenberg. [Read more]

2 Oct 2018

WordPress Makes It Even Harder To Be Protected Against Vulnerabilities in WordPress Plugins

In dealing with issues surrounding vulnerabilities in WordPress plugins for too many years what we have come to find is that the people on the WordPress side of things seem to be less interested in actually protecting against them and more interested in covering up the problems, leaving to websites unnecessarily being hacked.

This appears, whether intentional or not, to start at the top. Here was Matt Mullenweg wrote in February of last year on what are the “biggest issues” when it comes to WordPress security: [Read more]

26 Sep 2018

WordPress Lets Two More Plugins With Easy to Spot Exploitable Vulnerability in to the Plugin Directory

For the second day of our full disclosures of WordPress plugin vulnerabilities due to the continuing inappropriate handling of the moderation of the WordPress Support Forum we are focusing on something that relates to the larger problem when it comes to handling security by the WordPress team. Part of what makes the inappropriate moderation of the Support Forum so harmful, whether intended or not, is that it acts as an active cover up problems, which could be fixed quite easily if the people on the WordPress side of things were interested in fixing them. When they can largely cover up those problems, though, it allows those problems to instead fester since pressure doesn’t build for change since many in the WordPress community are not aware of them.

When a new plugin is submitted to the WordPress Plugin Directory a manual review of the plugin is supposed to be done: [Read more]

3 Nov 2017

A Third of The WordPress Plugin Directory Team Works for Matt Mullenweg, Which is a Big Problem

Last week we ran across information we had been wondering about for some time for one specific reason, but found the information important for other reasons. We had wondered for some time who were the people doing the security reviews of WordPress plugins before they returned to Plugin Directory after being pulled for security issues. As we have mentioned in the past, the reviews have not been very good, the most glaring issue being a failure to make sure that vulnerabilities that had lead to plugins being removed had been fixed when they likely already being exploited.

When we found the list of the people on the team we weren’t all that surprised that there were problems with the security reviews based on the makeup of the team. What was the most striking thing was that there are only six people on the Plugin Directory team. That is six people managing a directory of over 52,000 plugins. That obviously isn’t enough and it isn’t surprising things are not being properly handled. [Read more]