Login

Tag Archives: UpdraftPlus

17 May 2023

Latest Version of UpdraftPlus Fixes Cross-Site Request Forgery (CSRF) Vulnerability

The top listing in the changelog for the latest version of the 3+ million install WordPress plugin UpdraftPlus is about a security fix in the new version:

SECURITY: Fixed a missing nonce combined with a URL sanitisation failure, which could lead to a targetted XSS opportunity (if an attacker persuades a logged-in administrator to both re-authorise their connection to a remote storage (e.g. Dropbox) and then to follow a link personally crafted for their site before re-authorising whilst logged in, he can then store a fixed JavaScript payload in the WP admin area (they would need a further route to use that ability to cause any damage). Because of the need for the administrator to co-operate in multiple steps, this attack is very unlikely (but you should of course still update). [Read more]

7 Jan 2022

Not Really a WordPress Plugin Vulnerability, Week of January 7

In reviewing reports of vulnerabilities in WordPress plugins to provide our customers with the best data on vulnerabilities in plugins they use, we often find that there are reports for things that don’t appear to be vulnerabilities. For more problematic reports, we release posts detailing why the vulnerability reports are false, but there have been a lot of that we haven’t felt rose to that level. In particular, are items that are not outright false, just the issue is probably more accurately described as a bug. For those that don’t rise to the level of getting their own post, we now place them in a weekly post when we come across them.

Cross-Site Request Forgery (CSRF) in NotificationX

With a claimed cross-site request forgery (CSRF) vulnerability in the plugin NotificationX, the claimed discoverer NinTechNet, provides no explanation of why the functionality in question even needs protection against CSRF. [Read more]