When it comes to inappropriate behavior of the moderators of the WordPress Support forum that has lead to us full disclosing vulnerabilities in protest until WordPress gets that situation cleaned up, that inappropriate behavior often has the impact of covering up problems created by those on the WordPress side of things. Whether they are intending to do that to cover up things or not isn’t clear, but the person that appears to be in charge of the moderation, Samuel “Otto” Wood, wears a number of other hats when it comes to WordPress, so there are obvious potential conflict of interest issues. One of the hats he wears is being a member of the six member team running the Plugin Directory, which screwed up in fairly obvious way a few days ago involving plugin CSS & JavaScript Toolbox and then a moderator shut down the possibility of pointing that out.

If you follow our blog you might have seen our post on Friday that mentioned that a false report of a vulnerability in that plugin and quite a few others. We explained the reason they were false as follows:

While the person behind these reports believes that the file they are listing for each of the plugins is a database backup, in reality they are files that came with the plugins. It hard to understand how they didn’t realize that as the contents are exactly the same for the same plugin file on every website they listed, but they apparently didn’t.

In the case of this plugin it should be rather obvious as to what is going on as if you looked at the file, named uinstall.sql, it simply contained SQL code that would run when uninstalling the plugin. Here are the first few lines:

/*
* Delete CJT Tables
*/
DROP TABLE IF EXISTS #__cjtoolbox_authors;
DROP TABLE IF EXISTS #__cjtoolbox_backups;
DROP TABLE IF EXISTS #__cjtoolbox_blocks;

That wouldn’t do anything if you just directly requested file and isn’t a security issue as far we can think of.

Apparently the head of the Plugin Directory, Mika Epstein, couldn’t understand that as there is a topic on the forum for explaining why the plugin had been closed:

Mika Epstein from WordPress has emailed and alerted me to a medium-risk security vulnerability, which needs patching. We would like to thank Mika and the WordPress team for alerting us to this issue and hope to release a patch as soon as possible.

We apologise for any inconvenience.

Who should be apologizing are Mika Epstein and the Plugin Directory team for inappropriately handling this. No one can’t point that out though, since one the frequently problematic moderators of the WordPress Support Forum, Andrew Nevins, closed the topic with this message:

Thank you for your transparent post Damian. We’re going to use this as an announcement and close it to new replies.

It would be great if the WordPress folks actually allowed transparency instead of covering up problems they cause like this. That transparency would include not inappropriately closing topics and allowing for outside oversight of their closures of plugins, as the current process is ripe for abuse.

The change made that is somehow supposed to fix this is to change the extension of the file from .sql to .php, which doesn’t actually do anything security wise as far as we can think.