Vulnerability found in 2.2.7 - Bug Reports - wpForo 2.0

RE: Vulnerability found in 2.2.7

Jasper — Wed, 06 Dec 2023 17:26:51 +0000

@robert

Thanks.

I'll hit 'ignore' on the next scan.

RE: Vulnerability found in 2.2.7

Robert — Wed, 06 Dec 2023 17:20:13 +0000

@jasper,

This is a false positive report. This issue has been fixed in 2.2.3 version, however the problem report don't response to our emails and don't remove it. So this is a outdated wrong information.

RE: Vulnerability found in 2.2.7

Jasper — Wed, 06 Dec 2023 15:56:08 +0000

@dimalifragis

I have server-side WAF as well as the Defender Pro firewall.

I think another might be overkill!

RE: Vulnerability found in 2.2.7

dimalifragis — Wed, 06 Dec 2023 15:51:18 +0000

Real issue or not, if you have

Ninja Fireall for Wordpress, correctly configured

https://wordpress.org/plugins/ninjafirewall/

there is nothing to worry about. BE PROACTIVE.

Vulnerability found in 2.2.7

Jasper — Wed, 06 Dec 2023 15:26:01 +0000

Defender Pro security plugin is continually picking this up over the last few updates:

#WordPress wpForo plugin <= 2.2.7 - Cross Site Request Forgery (CSRF) on Sign-out vulnerability
-Vulnerability type: Cross Site Request Forgery (CSRF)

Anything to worry about?