Exploiting vulnerability in logical operators “isset (…) && !Anything”

Look this code: if ( isset( $_POST[‘cartflows-action-nonce’] ) && ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST[‘cartflows-action-nonce’] ) ), ‘cartflows-action-nonce’ ) ) { return; } This code was taken from a WordPress plugin with more than 100,000 active downloads, Cartflows (https://wordpress.org/plugins/cartflows/). This condition is a security validation to block CSRF, it works to …

13 / 17 WordPress Plugins with over 150,000 / 270,000 active downloads with the same security issues.

Introduction: At the end of November I noticed a file-handling function in PHP that was going unnoticed by developers, perhaps because it seemed harmless. The function in question is unlink, which, for those who do not know, works to delete a file in the filesystem. It is common to worry …

Trabalhando em ambientes com domínios diferentes de forma fácil no WordPress – Mágicas no wp-config Parte I

Esse é o primeiro post da série, fazendo mágica no wp-config. Para quem não conhece ou não esta familiarizado com o WordPress, o wp-config.php é o arquivo de configuração de do cms, que contém diversos defines para configuração da aplicação. A ideia de escrever uma sequencia de artigos relacionado a …