Hot answers tagged security
You cannot export passwords as plaintext in WordPress, because they are not stored in plaintext. What you see here is obviously the result of a very bad plugin. Fields like Payment, Sex or Company are not even part of the regular WordPress tables. For the future: Do not install plugins without prior tests and reviews in a safe environment. Use a local ...
Pingbacks/Trackbacks: This is most likely a harmless case of link notifications to your blog (A) from the other blog (B), where: the comment_author_email field is usually empty, the comment_type field is either pingback or trackback, the comment_author field has the form: The title of the post that contains a link to a post of blog A | The site ...
It is a bug in wp-members plugin. Others have reported the same error. http://user-meta.com/forums/topic/able-to-save-plain-text-passwords-as-a-user-meta-value/ http://wordpress.org/support/topic/wp-member-passwords-are-stored-in-clear-text-in-database-highly-insecure
If you did want to lock things down.... a normal wordpress site will usually only require the database user to have SELECT, INSERT, UPDATE and DELETE. If you want to use the automatic update feature it will also require CREATE and ALTER. Some plugins may require other permissions but most won't.
sanitizing have nothing to do with escaping, and escaping is not a cure to everything. The role of escaping is to convert a string to a proper HTML. What is a proper HTML representation of a string might depend upon the context and that is the reason you have several escaping functions esc_htl,esc_url and esc_attr. Unlike escaping which have to preserve ...
Only top voted, non community-wiki answers of a minimum length are eligible