Closed jkclose closed 1 year ago
Hello @jkclose thanks for sharing this here with me. This has been reported to me already via this patchstack page.
As the plugin has only been transferred to me in full a few weeks ago, I haven't had time yet to investigate it properly.
So far, no one has reported that any sites have been hacked through the potential vulnerability reported in the Weather Station plugin. I'll take some time to investigate it further and it will eventually be fixed in the future.
If you have any suggestions regarding this issue, I'd like to hear from you.
Awesome. Glad to hear it is already a known issue. We hadn't opted to disable the plugin as it seemed secure so far, so I'll just keep an eye out for updates.
Thanks for adopting the plugin!
Quick follow-up, the WordPress.org plugin team temporarily suspended the plugin from being downloaded from the public repository. I'm in touch with them and Patchstack to resolve the situation. It seems that they have slightly overestimated the report on Patchstack.
The only effect is to be able to force an admin to change the display mode of Weather Station settings.
Patch is in the way.
I'm working on a PR to solve this problem. In short, nonces are needed for some parameters located settingsGeneral.php
and SystemPluginAdmin.php
files. The patch should be made available in the coming days.
(FYI I'm currently on holiday, I didn't plan to work on the plugin but will do the max to solve this asap.)
I marked this issue as "close" but it's still monitored on my side.
I'll push a new version of the plugin in a few minutes to SVN and email the plugin review team asking for them to review the plugin and relist it publicly on the WordPress.org repository.
Hi @jkclose and @Duhlin12 I just received confirmation that the plugin has been reactivated on https://wordpress.org/plugins/live-weather-station/
New version is now available: v3.8.13
Is this a known issue? I haven't seen any discussion about it on any of the support sites.
https://wpscan.com/vulnerability/821a350d-04c7-406a-9c6f-31659584699c