Login

Tag Archives: Paid Memberships Pro

Plugin Security Scorecard Grade for Paid Memberships Pro

Checked on July 17, 2024
C+

See issues causing the plugin to get less than A+ grade

22 Oct 2024

What WordPress Plugins Are No Longer Receiving Updates Through the WordPress Plugin Directory?

As part of the mess going on with WordPress, plugin developers are choosing or being forced to provide updates for their plugins outside of the WordPress Plugin Directory. This creates a big security headache. To help address this, we are compiling information on impacted plugins. You can help by letting us know of additional plugins that are impacted, by either leaving a comment below or contacting us.

The information is also available in a machine-readable format to allow for software to automate checking for impacted plugins. We currently have it available in the JSON format. If there are other formats needed, we can format it for those as well. [Read more]

30 May 2019

Authenticated Open Redirect Vulnerability in Paid Memberships Pro

One ongoing indication of the poor security of WordPress plugins is how often our Plugin Security Checker, which is an automated tool for identifying some possible security issues with plugins, is picking up vulnerabilities in fairly popular plugins. We would not describe the tool as being advanced by any means, so that being true is not a great indication of the handling of plugins’ security. In looking over some of the recent results for plugins in the Plugin Directory that were checked through that to see if could further improve its results we found that the plugin Paid Memberships Pro, which has 80,000+ active installations according to wordpress.org, contains an authenticated open redirect vulnerability.

That is a type of vulnerability that isn’t really a concern in terms of being exploited on the average website, but it is something that looks like it could have easily been avoided. You can check the plugins you use to see if they are possibly impacted by a similar issue or a number of other issues through the tool for free. [Read more]

7 Dec 2018

Not Really a WordPress Plugin Vulnerability, Week of December 7

In reviewing reports of vulnerabilities in WordPress plugins we often find that there are reports for things that don’t appear to be vulnerabilities. For more problematic reports we release posts detailing why the vulnerability reports are false, but there have been a lot of that we haven’t felt rose to that level. In particular are items that are not outright false, just the issue is probably more accurately described as a bug. For those that don’t rise to level of getting their own post we now place them in a weekly post when we come across them.

Database Disclosure Vulnerabilities in ARI Adminer, BackWPup, Batch-Move Posts wp plugin, Caldera Forms, Cart66 Lite, Contact Us Page Builder, Events Made Easy, Exports and Reports, L4 Shopping Cart, Orbis, Paid Memberships Pro, Search Engine, Shopp, WP EasyCart, and WP Editor

Related reports of claimed database disclosure vulnerabilities were released for ARI Adminer, BackWPup, Batch-Move Posts wp plugin, Caldera Forms, Cart66 Lite, Contact Us Page Builder, Events Made Easy, Exports and Reports, L4 Shopping Cart, Orbis, Paid Memberships Pro, Search Engine, Shopp, WP EasyCart, and WP Editor. While the person behind these reports believes that the file they are listing for each of the plugins is a database backup, in reality they are files that came with the plugins. It hard to understand how they didn’t realize that as the contents are exactly the same for the same plugin file on every website they listed, but they apparently didn’t. [Read more]

1 Aug 2017

What Happened With WordPress Plugin Vulnerabilities in July 2017

If you want the best information and therefore best protection against vulnerabilities in WordPress plugins we provide you that through our service.

Here is what we did to keep those are already using our service secure from WordPress plugin vulnerabilities during July (and what you have been missing out on if you haven’t signed up yet): [Read more]