Login

Tag Archives: W3 Total Cache

13 May 2019

WPScan Vulnerability Database Spreads Easily Checkable False Claims of Vulnerabilities in W3 Total Cache

W3 Total Cache is one of the most popular plugins in the WordPress’ Plugin Directory, with 1+ million active installations according to wordpress.org. Last week a new version was released where one of the changelog entries is “Improved security on calls to opcache flush”. Notable it didn’t claim that any vulnerabilities were fixed in that, but if you were relying on other data sources on vulnerabilities in WordPress plugins you were told that there were two ones fixed related to that change, which clearly shows that these other data sources don’t actually confirm or validate claimed vulnerabilities before adding to their data set.

The main culprit for that situation was the WPScan Vulnerability Database which was the source others like WPCampus and ThreatPress then copied their data from. [Read more]

19 Jan 2017

Vulnerability Details: Information Disclosure Vulnerability in W3 Total Cache

From time to time vulnerabilities are fixed in plugin without someone putting out a report on the vulnerability and we will put out a post detailing the vulnerability. While putting out the details of the vulnerability increases the chances of it being exploited, it also can help to identify vulnerabilities that haven’t been fully fixed (in some cases not fixed at all) and help to identify additional vulnerabilities in the plugin.

…

[Read more]

27 Sep 2016

Another Good Example of Why Releasing Security Updates Separate From Major Plugin Changes Is a Good Idea

WordPress gets a lot of criticism when it comes to security, with most of it being unwarranted (possibly making it harder the people behind it to realize when the criticism is warranted and a change really is needed). In reality they do a lot of things of good things and have for a long time. One element they have long done is to not push out security updates as part of major releases. In the past they often would put out new minor releases with security updates ahead of a major release and more recently they have been continuing to put out security updates for older versions going back to WordPress 3.7 (that version introduced automatic background updates). Not everybody else does that and it can lead to bad situations like the current with the W3 Total Cache plugin.

Last week a reflected cross-site scripting (XSS) vulnerability was disclosed in the plugin. Contrary to how the developer of a competing plugin tried to portray it, the vulnerability was not a “high risk”. [Read more]

23 Sep 2016

SecuPress Falsely Claims Unfixed Reflected Cross-Site Scripting (XSS) Vulnerability in W3 Total Cache is High Risk

On Monday we introduced a new feature to the service that lets you know how likely is that a WordPress plugin vulnerability is to be exploited. In explaining why we thought the new feature would be useful we wrote in part:

Something we often see is that really minor vulnerabilities, ones that have almost no chance of someone trying to exploit on a website, are instead presented by security companies and the press as being major concerns. [Read more]