The answer, as mentioned in a comment by @JacobPeattie, was to add the domains to my .htaccess file where I am setting the CSP Headers, (turns out most plugins’ “View Details” link loads images from ps.w.org, which I just learned). A few other plugins loaded images from other domains, so I also added each of … Read more
This is a bug in the POST SMTP plugin. It has been reported here, and also the plugin support forum is full of reports of the same issue. The issue has been fixed in version 2.8.8 of POST SMTP.
When WordPress enabled the REST API in Core in version 4.7 it enabled the endpoint /wp-json/wp/v2/users/ to list all users that have posted something to the site. Therefore that endpoint can be used by an attacker to find some or all of the administrator account usernames to target for password cracking which is a potential … Read more
The first thing is to inline the nonce so that you can use it in the script that calls the ajax action. // plugin or theme php file wp_enqueue_script( ‘your-script-handle’, ‘url/to/your/script.js’, array( ‘jquery’ ), null, true ); wp_add_inline_script( ‘your-script-handle’, ‘const YourAjaxConfig = ‘ . json_encode( array( ‘ajax’ => array( ‘url’ => admin_url( ‘admin-ajax.php’ ), ‘action’ … Read more
If you downloaded the latest version then your download URL would have been: https://wordpress.org/wordpress-6.5.3.zip You can find the md5 hash for this file by adding .md5 to the end of that URL, like this: https://wordpress.org/wordpress-6.5.3.zip.md5 The md5 hash for this file is: ad3b0a21dec368341d64906e86db49f7 So, theoretically, you should be able to get the md5 hash of … Read more
How to address security vulnerabilities: LUCKY13, BEAST, and BREACH
Instead of looping through the array, use this: map_deep( $form_data, ‘sanitize_text_field’ ); (see the User Notes in the function doc: https://developer.wordpress.org/reference/functions/sanitize_text_field/ ) The docs state that Checks for invalid UTF-8, Converts single < characters to entities Strips all tags Removes line breaks, tabs, and extra whitespace Strips percent-encoded characters So you could also use the … Read more
WordPress – tracking options
See the answer here https://wordpress.stackexchange.com/a/356727/29416 , which states Currently it’s not possible to change the strength requirements of the password. You can only deactivate it the functionality completely by dequeueing the password script: add_action( ‘wp_print_scripts’, ‘DisableStrongPW’, 100 ); function DisableStrongPW() { if ( wp_script_is( ‘user-profile’, ‘enqueued’ ) ) { wp_dequeue_script( ‘user-profile’ ); } } For … Read more
In wp-includes/default-filters.php we can find a callback registration: // WP Cron if ( !defined( ‘DOING_CRON’ ) ) add_action( ‘init’, ‘wp_cron’ ); If we go the function wp_cron() now, we see this: $schedules = wp_get_schedules(); foreach ( $crons as $timestamp => $cronhooks ) { if ( $timestamp > $gmt_time ) break; foreach ( (array) $cronhooks as … Read more