WordPress Security
-
Solving WordPress’s Pathological Plaintext Problem: Introducing Fortress Vaults&Pillars
We solved WordPress’s Plaintext Problems. And you can get FREE access.
-
Malware Madness 1/2: Why everything you know about your WordPress Malware Scanner is wrong
Introduction Malware scanning and removal have traditionally been focal points in the WordPress security ecosystem. Users have placed their trust in Malware Scanning plugins to keep sites secure. Yet, this post challenges a crucial assumption: The conventional method of plugin-based malware scanning in WordPress is flawed and conceptually impossible. Our research doesn’t aim to critique…
-
The state of WordPress security plugins in 2022
On May 30, 2022, we disclosed two, in our opinion, pretty serious security vulnerabilities in two popular WordPress 2FA plugins through the WPScan platform. Our initial disclosure was very detailed, and WPScan promptly assigned it a provisional CVE. Fast forward three months, there were still no fixes on the horizon, and ultimately WPScan decided to…
-
How to safely get the IP address of the current user in a WordPress plugin
This article is based on outstanding research done in The perils of the “real” client IP. If you are creating a WordPress plugin that relies in any way or shape on getting the real IP of the current user visiting the site you need to be extremely careful. If you are getting this wrong (and…