Codestin Search App

Resolved Diktio
(@rwalle)

2 years, 10 months ago

Hi,

Wordfence reports a critical vulnerability in version 1.5.1:

https://www.wordfence.com/threat-intel/vulnerabilities/id/af59fcf6-4435-45f0-8904-ff520ea86157?source=plugin

Is there an update available?

Thanks

Kind Regards

Viewing 9 replies - 1 through 9 (of 9 total)

Plugin Author Dipak Gajjar
(@dipakcg)

2 years, 10 months ago

The link you shared above appears to be broken. Could you provide more info. please? I am happy to look into this quickly.

Thanks!

Starhorsepax2
(@starhorsepax2)

2 years, 10 months ago

Just for the record: I get the same error. The links to explain don’t work for me either.

Thread Starter Diktio
(@rwalle)

2 years, 10 months ago

Wordfence is reporting a security vulnerability but the link for explanation is broken. The advise from Wordfence is to deactivate and remove the plugin until there is an update. More information I don’t have.

Plugin Author Dipak Gajjar
(@dipakcg)

2 years, 10 months ago

@rwalle @starhorsepax2

I plan to run some security tests this weekend and share my thoughts here. If needed, I’ll apply the patch and release the update shortly.

Meanwhile, I don’t see any known vulnerabilities when I search this plugin under Wordfence Vulnerability Database.

Thread Starter Diktio
(@rwalle)

2 years, 10 months ago

On the WordPress forum:

https://wordpress.org/support/topic/critical-vulnerability-claimed-but-links-dont-work/

sergeyklochko
(@sergeyklochko)

2 years, 10 months ago

Wordfence point to

https://patchstack.com/database/vulnerability/wp-super-minify/wordpress-wp-super-minify-plugin-1-5-1-cross-site-request-forgery-csrf-vulnerability?_a_id=431

Plugin Author Dipak Gajjar
(@dipakcg)

2 years, 10 months ago

@rwalle @starhorsepax2 @sergeyklochko

I’m happy to inform you that I’ve released the updated version 1.6 of this plugin today which tightened the security, by checking CSRF when saving the plugin options/settings.

I appreciate you trying the latest version 1.6 of WP Super Minify and sharing your thoughts. I’m going to update Wordfence team and Patchstack team regarding the same now.

Thread Starter Diktio
(@rwalle)

2 years, 10 months ago

I have installed version 1.6 and Wordfence is not reporting the issue anymore.

Plugin Author Dipak Gajjar
(@dipakcg)

2 years, 10 months ago

Excellent! 👍

I appreciate it if you could take a few minutes to leave positive reviews on this plugin.

Viewing 9 replies - 1 through 9 (of 9 total)

The topic ‘Wordfence reports Critical vulnerability’ is closed to new replies.