4 ms·
Is WordPress's record really that bad? Most of the vulns I hear about come from shoddy plugins, not WP itself.
by sarciszewski 12y ago
Is WordPress's record really that bad? Most of the vulns I hear about come from shoddy plugins, not WP itself.
- debacle 12y agoWordPress core for a long time was very vulnerable, probably still has vulnerabilities, and if you're running even a slightly out of date version of the software (which might be a requirement if you've made a lot of customizations or are using a plugin that is no longer supported), you are likely vulnerable and it is almost trivial to identify that you're running WordPress and your WordPress version. Experience has taught me that no one is going to make a distinction between WP core and a third party plugin when they could instead shit on PHP and PHP programmers.
- sarciszewski 12y agoHeh. Well, I'm going to be contributing to the WP core soon (making their auto-updater use openssl_verify), I'll fix anything I find there. The worst thing I spotted when I was looking through it in June was a lack of a CS in their PRNG. I don't consider md5(uniqid(mt_rand())) adequate; urandom or bust :)