{"id":2387,"date":"2015-03-12T15:17:32","date_gmt":"2015-03-12T21:17:32","guid":{"rendered":"http:\/\/www.whitefirdesign.com\/blog\/?p=2387"},"modified":"2015-03-12T15:17:32","modified_gmt":"2015-03-12T21:17:32","slug":"auttomattic-sponsored-wordpress-plugin-pods-still-hasnt-fixed-publicly-known-security-vulnerability-after-two-months","status":"publish","type":"post","link":"https:\/\/www.whitefirdesign.com\/blog\/2015\/03\/12\/auttomattic-sponsored-wordpress-plugin-pods-still-hasnt-fixed-publicly-known-security-vulnerability-after-two-months\/","title":{"rendered":"Auttomattic Sponsored WordPress Plugin Pods Still Hasn’t Fixed Publicly Known Security Vulnerability After Two Months"},"content":{"rendered":"

In discussing how the security of WordPress plugins could be improved\u00a0we have put forward that Automattic,\u00a0the company closely connected with WordPress, should have some responsibility for that<\/a>.\u00a0With a valuation of over billion dollars<\/a> they certainly have the financial wherewithal to bear the burden of some responsibility. Shortly after putting forward that idea that we came across a security advisory for multiple vulnerabilities in Pods<\/a>, a plugin that Automattic\u00a0sponsors<\/a>.<\/p>\n

When we checked on the vulnerabilities to add them to Plugin Vulnerabilities plugin<\/a> we found that despite the advisory saying that they were fixed in version 2.5, that in fact two\u00a0reflective cross-site scripting (XSS) vulnerabilities listed still existed. Three days after the advisory was put out,\u00a0January 15, we notified the Pods developers that vulnerabilities still existed. We promptly received a reply from them, but it didn’t seem like they really understood the situation.<\/p>\n

A week later versions 2.5.1 and 2.5.1.1 were released, neither of which addressed the security vulnerabilities.<\/p>\n

On February 5 and 9 we received emails from the\u00a0developers\u00a0that the vulnerabilities would be fixed in version 2.5.2. That version has yet to be released and it has now been two months that they have knowingly left the vulnerabilities in the plugin. Maybe this will be a wake-up call to Automattic that plugin security needs to be taken more seriously and that they can start playing a constructive role by\u00a0improving the security of plugins they sponsor.<\/p>\n","protected":false},"excerpt":{"rendered":"

In discussing how the security of WordPress plugins could be improved\u00a0we have put forward that Automattic,\u00a0the company closely connected with WordPress, should have some responsibility for that.\u00a0With a valuation of over billion dollars they certainly have the financial wherewithal to bear the burden of some responsibility. Shortly after putting forward that idea that we came … Continue reading “Auttomattic Sponsored WordPress Plugin Pods Still Hasn’t Fixed Publicly Known Security Vulnerability After Two Months”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[25,32],"tags":[42,43],"class_list":["post-2387","post","type-post","status-publish","format-standard","hentry","category-bad-security","category-wordpress-plugins","tag-automattic","tag-pods"],"_links":{"self":[{"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/posts\/2387","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/comments?post=2387"}],"version-history":[{"count":3,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/posts\/2387\/revisions"}],"predecessor-version":[{"id":2390,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/posts\/2387\/revisions\/2390"}],"wp:attachment":[{"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/media?parent=2387"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/categories?post=2387"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/tags?post=2387"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}