Login

Tag Archives: Wordfence Intelligence Community Edition

21 Dec 2022

Wordfence Intelligence Community Edition Data Continues to Be a Mess

If data providers for WordPress plugin vulnerability information want to keep up with vulnerabilities, one important place to monitor is the WordPress Support Forum. Today, doing that allowed us to warn our customers of a plugin with 8,000+ installs that contains malicious code in the current version of the plugin, which is still available in the directory. What that also shows is that other data providers are not providing accurate information to their customers, causing problems for them and plugin developers.

Recently we have noted many problems with the new Wordfence Intelligence Community Edition data on plugin vulnerabilities and we keep running into more examples. [Read more]

15 Dec 2022

WPScan and Wordfence Intelligence Community Edition Providing Misleading Data on When Information Was Published

Trust is an important part of security, so it probably isn’t surprising that security is in such bad shape and that at the same time, security companies are so obviously dishonest so often. That is something we frequently run across in the WordPress security space, involving even the big name players. A couple of instances of that just came up involving vulnerability data provider presenting it as if they added information on vulnerabilities in a more timely manner than they really do.

WPScan

Automattic’s WPScan is claiming there is a known vulnerability in the latest version of WordPress. Though this would probably be better classified as a security issue. WPScan’s data says that the issue was “publicly published” and “added” two days ago: [Read more]

15 Dec 2022

Wordfence Intelligence Community Edition Fails to Warn About Serious Vulnerability Because It Copies Inaccurate Data From WPScan

Yesterday, we highlighted some of the problems we found when looking at the data on plugin vulnerabilities coming from Wordfence’s new Wordfence Intelligence Community Edition. That is data they were previously trying to sell access to as part of something called Wordfence Intelligence and now are providing for free. We thought to check on another recent situation and found yet another serious problem, but not an all that surprising one, considering the generally poor quality of data on WordPress plugin vulnerabilities.

On October 21, the developer of the plugin Image Hover Effects introduced a change to a plugin with the commit message “fixed Vulnerability issue”. As at least one of our customers used that plugin, we checked over that and found that the plugin contained a serious vulnerability related to the change made, which hadn’t been fixed. That vulnerability would allow anyone logged in to WordPress to cause malicious JavaScript code to run on the website. We warned our customers and contacted the developer of the plugin about that the next day. The developer responded at the end of the month, saying that they were working to address that, but it still hasn’t been addressed. [Read more]

14 Dec 2022

Wordfence Intelligence Community Edition Data Falsely Claims That Unfixed Plugin Vulnerability Was Fixed Twice

In what appears to be a significant setback for Wordfence, but promoted as “a gift to the community”, they announced they are now giving away data on vulnerabilities in WordPress plugins they have been trying to sell access to since August, as part of Wordfence Intelligence (which we previously discussed, wasn’t delivering on its promises). They are now branding this data as Wordfence Intelligence Community Edition.

Before the data was publicly available, we had been running across indications it was of rather poor quality, including falsely claiming a plugin contained a “critical” vulnerability because they confused it with another plugin, claiming another plugin contained “critical” vulnerability despite having no idea if that was true, and other apparent instances of false claims of vulnerabilities. Now that their data set is out in the open, we can get a better look at it and the first things we went to check on showed that the quality is indeed rather poor. Which makes providing it for free make more sense, but it joins a crowded field of at least partially free options with quality issues of their own. [Read more]