5 ms·

Kind of makes me glad the Wordpress has finally become mature enough to have to be exploited in such a convoluted way. Hope they fix the issue soon and show mat

by tonmoy 9y ago

Kind of makes me glad the Wordpress has finally become mature enough to have to be exploited in such a convoluted way. Hope they fix the issue soon and show maturity

blowski 9y ago
My experience of WordPress is that the core is now very secure. These days, it's easier to find exploits in the plugins and templates.
- goatherders 9y ago
  Agreed. I tell people often that properly applying updates and using plugins and themes from trusted developers in conjunction with a service like Sucuri or WP Extra Care makes your site as close to impenetrable as is realistically possible.
- pbhjpbhj 9y ago
  Or on shared hosts via a genuine account on the same server?
- dangerboysteve 9y ago
  Very true! if you every look at http error logs on a WP site it's full of bots trying plugin paths.
- stephenr 9y ago
  > the core is now very secure I wouldn't call inventing their own user-land parameterised queries "secure": https://github.com/WordPress/wordpress-develop/blob/master/src/wp-includes/wp-db.php#L1291 https://github.com/WordPress/wordpress-develop/blob/master/s...
  - blowski 9y ago
    Despite it sounding like a terrible idea, I haven't heard of any exploits.
    - h1d 9y ago
      Until you do. That's why we still see security fixes to this day.
h1d 9y ago
Funny you praise it instead of trying to dismiss Wordpress as any reliable software. global $current_user; This is Wordpress, making it nearly impossible to clearly grasp what's going on leading to unknown amount of vulnerability at any given moment. It's probably the dumbest code used by the mass.
- claudiulodro 9y ago
  You should never directly work with the WordPress global variables, and it's bad practice to do so. Use wp_get_current_user: https://codex.wordpress.org/Function_Reference/wp_get_current_user https://codex.wordpress.org/Function_Reference/wp_get_curren... The largest attack surface for WP is poorly developed plugins and themes, not WordPress core.
  - stephenr 9y ago
    > You should never directly work with the WordPress global variables, and it's bad practice to do so. It's bad practice to use global variables, but you somehow blame the person who highlights this use, as opposed to the project that is littered with their use.
    - nikcub 9y ago
      the reason why so many plugins and templates are insecure is precisely because they have access to that global scope and misuse it
      - stephenr 9y ago
        You're missing the point. You're criticising 'plugins and templates' that make use of the global scope, while giving the WordPress core a free-ride for not just using global scope, but placing objects there that can be exploited.
        nikcub 9y ago
        That's exactly my point - the core is at fault for handing over global exec to the plugins and templates. It's a horrible design, and it appears there is little motivation to fix it but rather pass blame onto plugins.

by tonmoy 9y ago

Kind of makes me glad the Wordpress has finally become mature enough to have to be exploited in such a convoluted way. Hope they fix the issue soon and show maturity

blowski 9y ago

My experience of WordPress is that the core is now very secure. These days, it's easier to find exploits in the plugins and templates.

goatherders 9y ago
Agreed. I tell people often that properly applying updates and using plugins and themes from trusted developers in conjunction with a service like Sucuri or WP Extra Care makes your site as close to impenetrable as is realistically possible.
pbhjpbhj 9y ago
Or on shared hosts via a genuine account on the same server?
dangerboysteve 9y ago
Very true! if you every look at http error logs on a WP site it's full of bots trying plugin paths.
stephenr 9y ago
> the core is now very secure I wouldn't call inventing their own user-land parameterised queries "secure": https://github.com/WordPress/wordpress-develop/blob/master/src/wp-includes/wp-db.php#L1291 https://github.com/WordPress/wordpress-develop/blob/master/s...
- blowski 9y ago
  Despite it sounding like a terrible idea, I haven't heard of any exploits.
  - h1d 9y ago
    Until you do. That's why we still see security fixes to this day.

h1d 9y ago

Funny you praise it instead of trying to dismiss Wordpress as any reliable software. global $current_user; This is Wordpress, making it nearly impossible to clearly grasp what's going on leading to unknown amount of vulnerability at any given moment. It's probably the dumbest code used by the mass.

claudiulodro 9y ago
You should never directly work with the WordPress global variables, and it's bad practice to do so. Use wp_get_current_user: https://codex.wordpress.org/Function_Reference/wp_get_current_user https://codex.wordpress.org/Function_Reference/wp_get_curren... The largest attack surface for WP is poorly developed plugins and themes, not WordPress core.
- stephenr 9y ago
  > You should never directly work with the WordPress global variables, and it's bad practice to do so. It's bad practice to use global variables, but you somehow blame the person who highlights this use, as opposed to the project that is littered with their use.
  - nikcub 9y ago
    the reason why so many plugins and templates are insecure is precisely because they have access to that global scope and misuse it
    - stephenr 9y ago
      You're missing the point. You're criticising 'plugins and templates' that make use of the global scope, while giving the WordPress core a free-ride for not just using global scope, but placing objects there that can be exploited.
      - nikcub 9y ago
        That's exactly my point - the core is at fault for handing over global exec to the plugins and templates. It's a horrible design, and it appears there is little motivation to fix it but rather pass blame onto plugins.