0

Given that some WordPress plugins contain considerable security vulnerabilities, we are currently considering blacklisting a few of the most dangerous plugins. We would like to do this on a server level (CentOS 6 x64, WHM). What would be an efficient way to identify blacklisted plugins? We do not like the idea of searching for plugin directory names as users could easily rename the plugin folders. Instead one possible way would be to go through each of the CentOS user directories, search for wp-config.php files, extract database login information, connect to the related mysql database and look into the option that contains all active plugins.

However, even as a CRON job, iterating through all directories searching for the wp-config.php files and then connecting to the MySQL databases sounds extremely resource intensive. We wonder if there is a more efficient way to simply block the installation of certain WordPress plugins for all cPanel/CentOS users?

1

Easy and only way, don't let users install their own plugins.

All software have security issues, therefor all plugins are insecure in one way or another, therefor it is pointless to talk about general "security", security should be discussed in context, and a plugin having a permission escalation bug is unsafe to use in multi user enviroment, but perfectly ok in a single user setting.

If you want to control the safety of plugins used by your users, the only way is to inspect them yourself (or pay some security service), set them as installed plugins for all sites and let the site owner just activate them while denying the ability to install new ones.

  • From a security perspective only, your solution makes sense, but from a user perspective it is not an option. One of the great things about WordPress are all the plugins. We have a list of plugins with unfixed security holes. Instead of telling our clients to not install them, it would be easier to block those plugins. I am not necessarily looking for the easiest solution.I am more asking for the best practice.Some managed WordPress hosting environments integrated a solution that disables caching plugins immediately after activation.That is why I assume there is a better way to handle this. – Jan Rohweder May 25 '17 at 8:52
  • Can agree or disagree with most of what you said, but the main problem is with the following claim "We have a list of plugins with unfixed security holes" which is unlikely to be true, at best you have a list of plugins with know security problems, but you do not know about the unknown ones. Let assume plugin P is not on your list and you let users use it. suddenly it is discovered that P has a security issue, what happens then? The problem with such list is that they are reactive and not proactive and it is always harder to recover from a hack than avoid it in the first place – Mark Kaplun May 25 '17 at 9:28
  • In the end if a user can install plugins, he can install his own code which might actually be more horrible than any security problem. You can look up at what WPengine does. They prevent plugins based on performance and compatibility with the platform, security each user has to handle by itself – Mark Kaplun May 25 '17 at 9:32
  • I think we are talking about two different things here. I completely agree that from security point of view, it would be better to disallow installation of all plugins. However, this is not an option, each of our clients have their own hosting account, most of them have WordPress installed. Many clients ask us to recommend plugins doing this or that, while there are good an bad choices, there also some not so secure choices. We then give this recommendation to our clients. However, it is never just one person handling a website hosted in one of the accounts on our server. – Jan Rohweder May 25 '17 at 9:54
  • The risk is high that our contact person understands the information and then does not communicate it to team. We are now being asked at multiple occasions, why we not just block plugins we cannot recommend. We are well aware that the list will not prevent the installation of plugins with yet unknown security holes, but we do not just see it as a security issue, but at the same time it is a user experience issue. We already tried to ask some of the Managed WordPress Hosts without luck. That is why we ask for the best practice here, so we can write our own script. – Jan Rohweder May 25 '17 at 9:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.