search

lbell / pretty-google-calendar

Simple WordPress plugin to embed Google Calendars in way that doesn't suck.
12 stars 7 forks source link

Plugin self-deactivates? #47

Closed hmijail closed 5 months ago

hmijail commented 5 months ago

For the last couple of days, PGC seems to deactivate by itself every few hours.

I enabled WP_DEBUG to try to find whether there's any error message, but there's nothing specific to PGC or to the time the deactivation seemed to happen. So nothing looks suspicious to me.

I am relatively new to WP and to web development in general, so I'm at a loss about what else to try in order to debug this. So... any idea about what to do, where to look?

For a bit of context, I have 25 plugins activated, but this only is happening with PGC. PGC had been working correctly for weeks if not months until a couple of days ago (Wednesday). At that point I didn't think much of it, just re-activated it and revamped a bit its configuration, and again it seemed to be working correctly. After a few hours, again it appeared deactivated. That's when I enabled logging with Debug Log Manager, activated PGC again, and set a periodic check on the page to detect any changes. And a few minutes ago again it appeared deactivated.

lbell commented 5 months ago

Interesting... Nothing has changed in the plugin.

Oooh, are you using a security monitor like "Wordfence" or "Patchstack"?

There was a very unlikely to be exploited potential vulnerability flagged, and maybe a security plugin is being overly ambitious and deactivating PGC?

hmijail commented 5 months ago

Bingo. My provider does include WP Tookit, which includes some kind of vulnerability checking, which shows PGC as vulnerable (CVSS 6.5) with "source: patchstack wordfence". And the logs show that it deactivated the plugin a number of times.

(Interesting too that it doesn't seem to be very consistent about deactivating it...)

lbell commented 5 months ago

Copy. Any way to bypass that? We'll work on a fix, but it'll be a few days at best.

As mentioned in the bug linked above, the only way to exploit the vulnerability is as a logged-in users, in which case, if an attacker has that level of access, you've got bigger problems to worry about.

hmijail commented 5 months ago

Looks like I can only apply blanket solutions, like fully disabling the deactivation of plugins with vulnerabilities.

I changed the warning threshold, it's not clear if that will also apply to the deactivation functionality. I'll let you know.

lbell commented 5 months ago

Fixed with v2.0: lbell/pretty-google-calendar/issues/49

hmijail commented 5 months ago

Thank you. FWIW, when I raised the warning threshold in WP Toolkit, it stopped deactivating PGC.