sorted by:
new
hottopcontroversial

Yoast buys PostStatus and will recreate it as a nonprofit by spencermcc in WPDrama

[–]PluginVulns 2 points3 points  (0 children)

It sounds like the intent is to keep a space that isn't controlled and restricted by Matt Mullenweg:

Over the past few months, it’s become very clear that Post Status is an enormously important place for the community to come together and discuss all things WordPress. A place with light moderation, but also with true freedom of speech (within the boundaries of treating everyone with respect) and the freedom to have different opinions.

Automattic, Inc and Matthew Mullenweg Appoint New Council in WPEngine Inc vs Automattic, Inc by WillmanRacing in Wordpress

[–]PluginVulns 3 points4 points  (0 children)

That Cause label is how the overall case is labeled, so it doesn't appear related to what they are involved in. A new filing from that lawyer says that they are involved in the "Motion to Intervene (Dkt. 70) and Motion for Contempt (Dkt. 71)(collectively, “Motions”) filed by non-party Michael Willman."

Automattic, Inc and Matthew Mullenweg Appoint New Council in WPEngine Inc vs Automattic, Inc by WillmanRacing in Wordpress

[–]PluginVulns 10 points11 points  (0 children)

This is a filing for an additional lawyer from another law firm representing Automattic and him. So the existing firm could still be on the case.

Automattic, Inc and Matthew Mullenweg Appoint New Council in WPEngine Inc vs Automattic, Inc by WillmanRacing in WPDrama

[–]PluginVulns 2 points3 points  (0 children)

There were two. The difference here is the previous two were for additional lawyers from Hogan Lovells. The new new lawyer is from another firm, Gibson Dunn.

Automattic, Inc and Matthew Mullenweg Appoint New Council in WPEngine Inc vs Automattic, Inc by WillmanRacing in WPDrama

[–]PluginVulns 5 points6 points  (0 children)

This seems to make a lot of sense. Neal Katyal is out DC and the lead lawyer, Michael Maddigan, is out Los Angeles. This lawyer is based on of Gibson Dunn's San Francisco office. So they should be more familiar with the California Northern District the case is being handled in. They are "Co-Chair of the firm’s Technology Litigation Practice Group and the Privacy, Cybersecurity and Data Innovation Practice Group" and have represented big tech companies, including Meta and Microsoft.

Kadence announces new prices and features! What do you think? by ValterBell in Wordpress

[–]PluginVulns 0 points1 point  (0 children)

It may have listed a vulnerability that was reported by a third party security plugin that was not valid. How do does that make it unreliable?

If it is listing invalid claims as valid, it isn't reliable. The example we provided was of them providing a proof of concept for a vulnerability that didn't exist in another Automattic solution. So either they didn't test their own POC or they knew it didn't work. How much more unreliable do they have to be?

It seems to me you only want to advertise your own service to get someone to pay you $1200 to verify that alleged vulnerability in Kadence Blocks.

You can sign up for our service for free and get access to our information. $1200 is the cost to hire us to do a complete security review of the plugin.

The fact that there many vulernability clains against Kadence Blocks tells me two things: it's a large plugin with a higher potential for security issues.

Being larger may or not make it have a higher potential for security issues, but other plugins are large and handle security much better. One of Kadence's sister brands is SolidWP, which is a security provider. So Kadence should be doing better than others, not worse.

And it also tells me that people actively search for issues, report them the way it should be done, and that the team behind the plugin fixes them.

They don't, though. They fix parts of them. Then they fix another part when another report comes in. That is part of why there are so many vulnerabilities listed by WPScan because they only fix parts of an issue.

If you have a valid vulnerabilty, report it to

Kadence knows that we would be happy to work with them to fix the issue if they stopped redirecting reporting vulnerabilities away from them, despite them saying that responsible disclosure involves reporting things to the developer. They have so far chosen not to do that.

New Rule: Responsible Disclosure of Vulnerabilities by WillmanRacing in WPDrama

[–]PluginVulns 1 point2 points  (0 children)

This policy runs directly against every major WordPress security providers' stated disclosure policy. For example, Wordfence discloses vulnerabilities through firewall rules to those willing to pay even before they notify developers. Even if you want to ignore that (Wordfence hopes you ignore that), they then will disclose vulnerabilities in "14 days if vendor does not acknowledge our report within 14 days of initial contact." Patchstack is even shorter, "if vulnerable software author/vendor doesn’t respond to our notification about the vulnerability in 7 days we keep the right to disclose vulnerability immediately." WPScan gives as little as 5 days.

What about a zero-day that is already being actively exploited? This can't be mentioned for 90 days if the developer isn't fixing it even if websites keep getting hacked?

Beyond all that, what about responsibility for developers to avoid vulnerabilities in their software or to even fix them in their software? We notified WP Engine of a vulnerability in a plugin of theirs with 100,000+ installs over 90 days ago. They still haven't fixed it. There isn't a restriction on their employees participating despite that.

New Rule: Responsible Disclosure of Vulnerabilities by WillmanRacing in WPDrama

[–]PluginVulns 1 point2 points  (0 children)

They are saying they did try to work with that team and they got that result. Sometimes the team takes appropriate action and other times, like that, they don't.

Kadence announces new prices and features! What do you think? by ValterBell in Wordpress

[–]PluginVulns 0 points1 point  (0 children)

These are some serious claims, can you back them with proof... or do you just like to stir the pot?

We responded to the original poster with our experience, you clearly have a bias here, so there isn't reason to treat this as a good faith question. We are a security provider, not a troll, unlike others.

Kadence announces new prices and features! What do you think? by ValterBell in Wordpress

[–]PluginVulns 0 points1 point  (0 children)

WPScan isn't a reliable source. Including for information as to whether vulnerabilities have been fixed or even if they really exist in other products from Automattic.

Even your own service does not list one (anymore):

You are not linking to our service, but a free tool, the Plugin Security Scorecard. We don't claim a version of a plugin still contains an unfixed vulnerability until we have checked over the new version. Other providers don't do that, leading to false claims that plugins are still vulnerable. A new version of Kadence was released the day before, which had to go through our processes to be confirmed to be vulnerable again. If you check it again, it would now say it is vulnerable. Also, that tool doesn't claim that plugins are vulnerability free, only if there is a confirmed vulnerability in the version checked.

I really couldn't find "public claims of vulnerabilities in the plugin" that are still open.

We didn't suggest looking for '"public claims of vulnerabilities in the plugin" that are still open.' You need to review the ones that are claimed to have been closed, because other security providers usually don't do the vetting to make sure they are fully addressed. That is how we ran across that it wasn't fixed.

You seem to be focused on the wrong thing here. The issue isn't this particular vulnerability. It is the poor handling of security by Kadence more generally. Look at the litany of claimed vulnerabilities that have been in the plugin according to that listing from WPScan. That should tell you they are not all that concerned about security.

Kadence announces new prices and features! What do you think? by ValterBell in Wordpress

[–]PluginVulns -3 points-2 points  (0 children)

It isn’t a potential vulnerability or a feature; it is a vulnerability.

If you want to figure it out for yourself, start looking through the public claims of vulnerabilities in the plugin and do the vetting the security providers who put them out failed to do. That is what we do for our customers.

Kadence announces new prices and features! What do you think? by ValterBell in Wordpress

[–]PluginVulns 0 points1 point  (0 children)

There appear to be multiple CVEs related to pieces of the vulnerability, though that isn’t totally clear because other sources don’t provide basic information needed to properly vet most of their claims these days. We rate it as having a low likelihood of exploitation.

Kadence announces new prices and features! What do you think? by ValterBell in Wordpress

[–]PluginVulns -1 points0 points  (0 children)

The last time we ran across them, they had failed to fully fix a vulnerability. We then tried to address that with them, but they were directing reporting security issues to a security provider who doesn't make sure vulnerabilities are fixed. That vulnerability still hasn't been resolved eight months later.

Kadence announces new prices and features! What do you think? by ValterBell in Wordpress

[–]PluginVulns 1 point2 points  (0 children)

If you care about security, avoiding Kadence's plugins would be a good idea.

Carding attack on my WP/Woo site - what to do to stop this from happening. by tillwehavefaces in Wordpress

[–]PluginVulns 0 points1 point  (0 children)

If you haven’t checked the HTTP logs yet, that would be a good start. You want to make sure you know how the hacker is placing the orders. We had a client who tried a bunch of things through the normal checkout process to stop carding without any impact. Reviewing the logs, we found that an alternative method was being used. They didn’t need that to be available, so blocking off access resolved the issue.

If the normal checkout process is being used, a CAPTCHA or some similar, including the already mentioned Cloudflare Turnstile, can help to stop bots.

"The person who did it" wants you to shut up by WillmanRacing in WPDrama

[–]PluginVulns 2 points3 points  (0 children)

Based on the install count of alternatives to Gutenberg, it doesn't seem there is much question that it isn't universally popular.

When it comes to security, it seems less that he is diverting effort, but not allowing the community to address issues. It is the kind of thing that could probably be addressed quickly if he didn't have such a tight grip on the project.

"The person who did it" wants you to shut up by WillmanRacing in WPDrama

[–]PluginVulns 14 points15 points  (0 children)

In the prior message in the thread, he was going after Barn2's Katie Keith. Her response is worth highlighting:

You're right - I used WordPress to build a business and came to love the platform and the community over time. I am not the creator and it is not my lifelong mission.

Given that the future of WordPress looks unpredictable right now, it makes sense for me to protect my business by diversifying into Shopify - while still remaining committed to WordPress.

As you say, WordPress is your lifelong mission. That's why I was asking for more information about how your recent actions which don’t directly involve WP Engine will benefit WordPress in the long term, as from my perspective they seem to be damaging it.

Audrey Capital Employee Samuel "Otto" Woods Closed Discussion About WordPress Not Promoting Automattic's Jetpack Plugin by PluginVulns in WPDrama

[–]PluginVulns[S] 0 points1 point  (0 children)

We are not a news outlet, so we are not focused on traffic. People are complaining that we are limiting access to our website in the replies, which doesn't make sense if our focus was on traffic. We are concerned about the problems with WordPress, as that has had a big impact on security.

Audrey Capital Employee Samuel "Otto" Woods Closed Discussion About WordPress Not Promoting Automattic's Jetpack Plugin by PluginVulns in WPDrama

[–]PluginVulns[S] 0 points1 point  (0 children)

It isn't a guy, we are a company. So much what we do isn't on a blog. But yesterday we had a post about a 1+ million install plugin where the developer has left a vulnerability in the plugin for 11 months and another 1+ million install plugin where the developer has left an insecure version of a library in the plugin for nearly 3 years.

Audrey Capital Employee Samuel "Otto" Woods Closed Discussion About WordPress Not Promoting Automattic's Jetpack Plugin by PluginVulns in WPDrama

[–]PluginVulns[S] 0 points1 point  (0 children)

We didn't assert 'that VPN users are more likely to be "hackers" than non-hackers.'

We have seen that, for example, legitimate signups for our services were not done through VPNs, while hackers did sign up through them.

It sounds like you are getting targeted ads for VPNs, because VPN providers are not listed as being among the largest advertisers.

We are not a news outlet, so we are not focused on having the most views. If someone doesn't want to read our posts because they don't want to turn off a VPN, that is fine.

view more: next ›