30
votes
Accepted
WordPress 4.7.1 REST API still exposing users
This code snippet will hide the users, posts, and comments endpoint results and give 404 as the result, while the rest of the API calls keep running as they were.
::UPDATE::
add_filter('rest_endpoints'...
- 1,188
13
votes
Accepted
Does WordPress sanitize arguments to WP_Query?
It's actually a good question. Of course user input cannot be trusted, but also sanitizing the same value twice "just in case" isn't the best solution for a problem.
The only real answer to ...
- 1,090
12
votes
Verify nonce in REST API?
You should pass the special wp_rest nonce as part of the request. Without it, the global $current_user object will not be available in your REST class. You can pass this from several ways, from $_GET ...
- 2,318
11
votes
Accepted
esc_attr() right way and use
No you don't need esc_attr() function to print out fixed static text.
You only need it to print out dynamic or generated text, so that if the attributes have any special characters that may break ...
- 8,987
11
votes
Accepted
Which WP functions do you need to use esc_html() or esc_url() on?
Any that return data.
If a function outputs internally, then it's taken responsibility for escaping
if a function returns the data for use, it will be unescaped to avoid double escaping, it's your ...
- 60.6k
11
votes
Accepted
Is there a security vulnerability in Advanced Custom Fields related to the SCF fork?
It's probably the issue mentioned in the changelog for 6.3.8 here. The developers were unable to release the patch on dot org themselves because Mullenweg had unilaterally revoked their access to the ...
- 43.9k
10
votes
Accepted
Why "Contact Form 7" doesn't update PHPmailer library?
PHPMailer is not part of the plugin, it is shipped with WordPress. So it is up to WordPress to keep it up to date. There is a patch already in ticket #37210.
In the mean time, you can create a mu-...
- 107k
10
votes
Accepted
What is the difference between esc_html filter vs attribute_escape filter?
It would appear that out of the box, there isn't a difference
function esc_html( $text ) {
$safe_text = wp_check_invalid_utf8( $text );
$safe_text = _wp_specialchars( $safe_text, ENT_QUOTES );...
- 60.6k
10
votes
Accepted
Why escape if the_content isnt?
If I were a hacker with access to the database, wouldn't I just add my
code to a post's content?
If you've got access to the database, chances are that you've got enough access that escaping isn't ...
- 43.9k
9
votes
Best way to eliminate xmlrpc.php?
When you have the ability to block it via your web server's configuration, @Charles' suggestions are good.
If you can only disable it using php, the xmlrpc_enabled filter is not the right way.
Like ...
- 191
9
votes
Can someone explain the use cases of esc_html?
esc_html__( string $text, string $domain = 'default' )
Retrieve the translation of $text and escapes it for safe use in HTML output.
so esc_html__() use to make internationalize as well as security ...
- 591
9
votes
WordPress 4.7.1 REST API still exposing users
/**
* Wrap an existing default callback passed in parameter and create
* a new permission callback introducing preliminary checks and
* falling-back on the default callback in case of success.
*/
...
- 191
9
votes
Accepted
Are there procedures to prevent malicious plugin updates?
TLDR: No. It's all about trust.
So there are some very basic checks on wp.org but generally this can happen (and probably also does happen from time to time). Of course if something like this happens ...
- 5,628
9
votes
Does this .htaccess security setting really work?
It appears to prevent any POST requests to wp-login.php that aren't made from a page on my-domain.com.
When the browser sends a POST request, say after submitting a form, it will include a HTTP ...
- 43.9k
9
votes
Why escape if the_content isnt?
I'm actually an engineer at VIP who does a lot of code review :) I flag a lot of missing escaping.
but does not escape output
Not quite, it doesn't escape on output, which is surprising to most ...
- 60.6k
8
votes
wp_verify_nonce vs check_admin_referer
NO! BEWARE !!!
Don't count on check_admin_referer() without correct parameters! Because, in some cases it may not die() (as opposed to your expectations), instead it will just return the false ...
- 5,850
8
votes
How does admin-ajax.php work?
For unauthenticated and untrusted users, you'll want to make two specific exceptions to your VPN / Firewall / Apache .htaccess, which are:
example.com/wp-admin/admin-post.php
example.com/wp-admin/...
- 651
8
votes
Accepted
How do I technically prove that WordPress is secure?
Tell your client to read up on cybersecurity, because his premise is nonsense. Security through obscurity has been discredited since 1851 (yes, that's one and a half century ago). The opposite is also ...
- 15k
8
votes
Accepted
Where i should not use if (!defined('ABSPATH')) { exit; }?
The point of that code is to prevent any PHP inside the file from being executed if the file is accessed directly outside a WordPress context. ABSPATH is defined by WordPress, so if it's missing when ...
- 43.9k
8
votes
Accepted
Sanitize get_query_var() url parameters
There's a slight disconnect between your question title and the actual question.
It sounds like you're using a plugin (or developing a plugin?) that allows for some front-end sorting. If it's a ...
- 5,071
7
votes
Accepted
Understanding SVG vulnerabilities in Wordpress related to a specific fix
This article has a bunch of great answers to your questions. I highly recommend checking it out to learn more about the scale of this issue, but I can give a quick rundown.
SVG, since it's XML based,...
- 1,952
7
votes
Is it good to rename theme folder downloaded from WordPress.org?
Renaming the theme is unlikely to do any good. The theme might break and you may miss out on (security) updates. And it most likely won't help you really obscure the theme, because often enough the ...
- 15k
7
votes
Accepted
Protecting direct access to PDF and ZIP unless user logged in (without plugin)
RewriteCond %{REQUEST_FILENAME} -s
RewriteRule ^wp-content/uploads/([^/]*\.(pdf|zip))$ filecheck.php?file=$1 [QSA,L]
This actually looks OK, except if you have additional subdirectories within the /...
- 3,881
7
votes
Does this .htaccess security setting really work?
What this doesn't prevent: Brute Force
all it does is prevent automatic brute force attacks?
No. This does not prevent brute force attacks.
In a brute force attack, an attacker has control over ...
- 243
6
votes
Accepted
Can someone explain the use cases of esc_html?
esc_html() does two things:
Checks for invalid UTF8 in a string.
Converts a number of special characters into their HTML entities, specifically deals with: &, <, >, “, and ‘.
Using it instead ...
- 2,716
6
votes
Accepted
Should `get_template_directory_uri()` be escaped?
In that function we find a hook:
return apply_filters(
'template_directory_uri',
$template_dir_uri,
$template,
$theme_root_uri
);
So, yes, the URI can be changed by plugins, and ...
- 107k
6
votes
Accepted
Disable comment windows for all existing posts (pages/blogposts)
Here is an untested suggestion for wp-cli approach:
We can list post IDs of published posts with open comment status with:
wp post list --post-status=publish --post_type=post comment_status=open --...
- 67.8k
6
votes
Accepted
How do WordPress Nonces Work?
If you read Wordpress Nonces in Codex, they have explained it pretty fairly. some of the key points are:
always assume Nonces can be compromised.
Nonces are a hash made up of numbers and letters.
...
- 159
6
votes
Accepted
How to handle security on a wordpress site?
You cannot be 100% sure you are safe.
Check this Security reading from WordPress.
That been said, there are some things you can do.
Keeping WordPress Updated
Keeping theme and plugins Updated
Use ...
- 2,194
6
votes
Accepted
rms_unique_wp_mu_pl_fl_nm.php
I just encountered the same issue. After quick analysis I found that this file is allowing remote access of your website to a third party which is pretty much dangerous. This is found in wordpress ...
Only top scored, non community-wiki answers of a minimum length are eligible