Skip to content

Prevent direct execution of library files (e.g. Wordpress plugins) #562

@PluginVulnerabilities

Description

@PluginVulnerabilities

We are a service that monitors for vulnerabilities in WordPress plugins and your library came on to our radar when a file from the library that was being removed from plugin that uses the library was flagged by our monitoring as possibly containing a serious security vulnerability. In looking into that we found that for 22 months having the file /tests/PHPCurlClass/server.php from the library included in that plugin had introduced an arbitrary file viewing vulnerability, arbitrary file deletion, and a restricted file upload vulnerability on to websites using this plugin. It would be a good idea to make sure the file is secured in such a way that if it is included production websites (as it was with that plugin) it can't be abused, because right now it isn't secure.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions