#WordPress wpForo plugin - Bug Reports - wpForo 2.0

RE: #WordPress wpForo plugin

dimalifragis — Wed, 29 Nov 2023 14:05:14 +0000

@blackraz IF we all use really some GOOD firewall (in PREPEND/ADVANCED mode), even IF issues exists, they are blocked. In ALL plugins, not just wpForo.

Use Ninja Firewall, and sleep at night.

https://wordpress.org/plugins/ninjafirewall/

RE: #WordPress wpForo plugin

BlackRaz — Wed, 29 Nov 2023 13:38:55 +0000

@chris-vaz

@realact

No real major issues were found. We have specifically released wpForo version 2.2.6, and we hope that the individuals who reported the vulnerabilities will confirm on their end that the status has been fixed.

RE: #WordPress wpForo plugin

RealAct — Wed, 29 Nov 2023 01:55:08 +0000

Well, according to the change log for version 2.2.5, this vulnerability was fixed. So either the fix was ineffective, and they have discovered that it can still be exploited even after the fix, or they have not reviewed the new version enough to notice it was fixed.

So yeah, we must wait for the Developers to respond. Furthermore, I don't believe this is a severe vulnerability, as all they can do is log out a user from the site IF they get that user to click on a specifically crafted link. Correct me if I'm wrong, but I think that's all there is to it.

#WordPress wpForo plugin

chris.vaz — Tue, 28 Nov 2023 22:36:25 +0000

Hi,

My security plugin tells me this

#WordPress wpForo plugin <= 2.2.5 - Cross Site Request Forgery (CSRF) on Sign-out vulnerability
-Vulnerability type: Cross Site Request Forgery (CSRF)
-No Update Available

I see in the previous updates it says it fixes it, but looks like its persistent.

What can we the users of the plugin do to avoid attacks?

Same with XXS?