7

This is a random thought I've had today. Here's the scenario:

I've got a plugin on the WordPress store with 100+ active installs. I recently updated the plugin and pushed the changes to the WordPress SVN. Around 60% of users updated the plugin in the first couple of days - but what's not to say that I could have updated my own plugin with malicious code? For example, my plugin lets users create a phone number shortcode - but in the update, I could have changed the code to check if a plugin such as WooCommerce was installed and forward on their customer data to an external location. Are there procedures in place to prevent such things?

It worried me slightly because I have many plugins written by other developers on my website and I update them without checking what changes have been made all the time!

  • It's happened with Firefox addons: There was a nice one which displayed the site's IP address in the browser status bar. It was updated to start injecting ads into pages. Mozilla eventually killed it, I think. – TRiG Jul 3 '17 at 16:14
  • Note that this is the case with literally any piece of software that allows updates or changes to be installed over the Internet. It doesn't even have to be an update for a plugin or another 3rd party addon. If you recall the ransomware attack that infected large parts of Ukraine last week, a huge part of that appears to be that hackers managed to push a fake update for the accounting software that all Ukrainian companies are legally required to use. Hell, if someone manages to push an illicit update to Wordpress itself, it would be FAR more dangerous than anything a plugin could ever do. – Nzall Jul 3 '17 at 21:25
  • Relevant to comment by Nzall: wordfence.com/blog/2016/11/… and wptavern.com/… – kraftner Jul 4 '17 at 7:31
  • @kraftner Huh. I wasn't even aware of that particular vulnerability when I made the comment. It was more of a hypothetical "if you're unlucky, you don't even need to use plugins to be at risk". – Nzall Jul 4 '17 at 11:40
9

TLDR: No. It's all about trust.

So there are some very basic checks on wp.org but generally this can happen (and probably also does happen from time to time). Of course if something like this happens and people notice it wp.org can block updates or replace them with something safe.

Also have a look at the WordPress.org Theme and Plugin Repositories section.

What you can do is not really any different than what you'd do whenever you install software, things like:

  • look at the source code
  • research on the plugin and/or the developer to decide if they deserve your trust
  • talk to other people about the plugin
  • do not randomly install plugins you come along
  • hire someone to do audits
  • ...
  • That's interesting to hear. I guess your own website security can become reliant on the plugin authors security too then! – Liam McArthur Jul 3 '17 at 16:42
  • @LiamMcArthur of course it does! I saw an installation that was compromised by a plugin weakness myself. – Rad80 Jul 3 '17 at 18:19
  • 1
    Sure, but that is the same to some extent when you embed JS from some CDN, install software on your computer or even surf a random non-trustworthy website. It is always a balance between risk and benefit. But yeah, to stay within the context of WP plugins - choose wisely and maybe you don't even need a third party plugin at all. – kraftner Jul 4 '17 at 7:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.