20 events
when toggle format what by license comment
Apr 24 '19 at 17:05 review Reopen votes
Apr 24 '19 at 18:08
Apr 24 '19 at 16:29 comment added Martijn Pieters Sorry, Stack Overflow is not suitable for help me find vulnerabilities in this random plugin questions. We can answer specific, focused questions with a limited scope.
Apr 24 '19 at 16:28 history closed Robert Columbia
Martijn Pieters
Needs more focus
Apr 24 '19 at 16:10 review Close votes
Apr 24 '19 at 16:30
Apr 24 '19 at 15:43 audit First posts
Apr 24 '19 at 15:43
Apr 17 '19 at 23:04 audit First posts
Apr 17 '19 at 23:18
Apr 17 '19 at 11:38 audit First posts
Apr 17 '19 at 12:07
Apr 12 '19 at 6:35 audit Close votes
Apr 12 '19 at 7:47
Apr 11 '19 at 20:03 history protected Community
Apr 10 '19 at 18:47 comment added Pat Mc it also appears this url will respond with the same payload regardless of the query string
Apr 10 '19 at 18:44 comment added Pat Mc looks like hellofromhony.org/scriptmyjs?t=1&/wp-includes/js/jquery/… is causing the issue on a site I just looked into with this issue. This link does not supply jquery.
Apr 10 '19 at 15:24 history edited fealXX CC BY-SA 4.0
edited title
Apr 10 '19 at 13:51 comment added fealXX @Hendrik yes, that is correct. Wordpress prefixes the options automatically with the plugin identifier, so with this simple attack only the plugin-owned Options can be modified
Apr 10 '19 at 13:36 comment added Stefan For reference, this is the payload served by the mentioned exploit, hosted on hellofromhony.org: gist.github.com/stefan2904/a31a676b6fc202d2c6428acd728ad791
Apr 10 '19 at 12:53 comment added Hendrik Am I correct to assume only the wp-options regarding the plugin itself can be manipulated? I'm trying to find the maximum reach of the vulnerability.
Apr 10 '19 at 11:37 comment added fealXX Nice, thanks, did not find that when googling for known vulnerabilitys. Added that to my answer below, so Google will relate it... :)
Apr 10 '19 at 11:29 comment added Hang Guan Someone has also written about this as early as March 30. pluginvulnerabilities.com/2019/03/30/…
Apr 10 '19 at 11:12 answer fealXX timeline score: 9
Apr 10 '19 at 10:44 comment added fealXX While investigating & writing this post, two threads have appeared on the wordpress.org board: wordpress.org/support/plugin/yuzo-related-post
Apr 10 '19 at 10:42 history asked fealXX CC BY-SA 4.0