Login

Tag Archives: Ocean Extra

6 Jan 2023

Not Really a WordPress Plugin Vulnerability, Week of January 6

In reviewing reports of vulnerabilities in WordPress plugins to provide our customers with the best data on vulnerabilities in plugins they use, we often find that there are reports for things that don’t appear to be vulnerabilities. For more problematic reports, we release posts detailing why the vulnerability reports are false, but there have been a lot of that we haven’t felt rose to that level. In particular, are items that are not outright false, just the issue is probably more accurately described as a bug. For those that don’t rise to the level of getting their own post, we now place them in a weekly post when we come across them.

PHP Object Injection in White Label CMS

Automattic’s WPScan claimed there was a PHP object injection vulnerability in White Label CMS. They explained it this way: [Read more]

27 Sep 2021

Another One of the 100 Most Popular WordPress Plugins Has a Security Vulnerability Related to Usage of extract()

On Friday, we noted that five of the 100 most popular WordPress plugins were using the extract() function insecurely. While none of those plugins look to have an obvious vulnerability due directly to the usage of extract(), we mentioned in the previous post that we had confirmed that one of the plugins, with 1+ millions installs, had a vulnerability related to its usage. We have now confirmed that the same type of issue exists in another plugins, Ocean Extra. That plugin is a companion to the OceanWP theme and has 700,000+ installs according to WordPress’ stats.

We tested and confirmed that our upcoming firewall plugin for WordPress protects against the exploitation of this vulnerability. [Read more]

24 Sep 2021

Five of the 100 Most Popular WordPress Plugins Are Insecurely Using the extract() Function

Last week we noted that the most popular WordPress security plugin, Jetpack, was insecurely using PHP’s extract() function. It turns out that it isn’t alone among the most popular WordPress plugins, as running the 100 most popular plugins in the WordPress Plugin Directory through our Plugin Security Checker identified four more plugins that are similarly insecure. Jetpack is the most popular with 5+ million installs according to WordPress’ stats, but the others are also have large install counts:

As we noted in the previous post, the documentation for the extract() function has this warning: [Read more]