Security Vulnerability Affecting WordPress Plugins and Themes

Envato Announcements
21
KrownThemes said

Come on Stephen, please educate your reviewers about this issue. They rejected our theme again for using the TGM 2.4.1 class :expressionless:

Hey Ruben,

Which theme? I canā€™t see it. Feel free to send me a message about it and Iā€™ll investigate.

Were you using the 2.4.1 hotfix version with the security fix, or the develop version with the 2.4.1 hotfix and the bulk install fix?

Cheers,
Stephen

22
StephenCronin said
KrownThemes said

Come on Stephen, please educate your reviewers about this issue. They rejected our theme again for using the TGM 2.4.1 class :expressionless:

Hey Ruben,

Which theme? I canā€™t see it. Feel free to send me a message about it and Iā€™ll investigate.

Were you using the 2.4.1 hotfix version with the security fix, or the develop version with the 2.4.1 hotfix and the bulk install fix?

Cheers,
Stephen

Itā€™s not on my account, itā€™s on this one: http://themeforest.net/item/lobo-portfolio-for-freelancers-agencies/7762848

We were using the 2.4.0 version which was available yesterday evening when we did the update. 2.4.1 only appeared this morningā€¦

23
meanthemes said
webcreations907 said

@meanthemes

Itā€™s in the hotfix branch.
https://github.com/thomasgriffin/TGM-Plugin-Activation/tree/hotfix/2.4.1

:slight_smile:

Lovely, so the answer wasā€¦ yes I was missing something :slight_smile:

Thanks by the way :slight_smile:

Thanks for the link, I didnā€™t see it at first. Iā€™m just wondering whether the hotfix branch is ā€˜stableā€™ enough to be applied to themes? There was bulk installation error but it seems to be fixed in the latest update (5 hours ago). Any other issues in this hotfix?

Thanks.

24
KrownThemes said

Come on Stephen, please educate your reviewers about this issue. They rejected our theme again for using the TGM 2.4.1 class :expressionless:

Sorry for the confusion, can you please resubmit the updates? We will proceed asap.

25
billyf said
meanthemes said
webcreations907 said

@meanthemes

Itā€™s in the hotfix branch.
https://github.com/thomasgriffin/TGM-Plugin-Activation/tree/hotfix/2.4.1

:slight_smile:

Lovely, so the answer wasā€¦ yes I was missing something :slight_smile:

Thanks by the way :slight_smile:

Thanks for the link, I didnā€™t see it at first. Iā€™m just wondering whether the hotfix branch is ā€˜stableā€™ enough to be applied to themes? There was bulk installation error but it seems to be fixed in the latest update (5 hours ago). Any other issues in this hotfix?

Thanks.

Right now the develop branch seems to be the best choice - it has the security patch and the bulk install fix. As they make more changes to this branch it may not be the best choice, but right now, today, it looks like it.

26

Thanks for the info!

27
webcreations907 said

@meanthemes

Itā€™s in the hotfix branch.
https://github.com/thomasgriffin/TGM-Plugin-Activation/tree/hotfix/2.4.1

:slight_smile:

There is still an error on this version;

EDIT:

Sorry, that error has been fixed but Iā€™m still getting the following error;

ā€œFatal error: Class ā€˜TGM_Bulk_Installerā€™ not found in ā€¦/includes/class-tgm-plugin-activation.php on line 1586ā€

Has anyone tried this version?

28

Noted.

29
egemenerd said
webcreations907 said

@meanthemes

Itā€™s in the hotfix branch.
https://github.com/thomasgriffin/TGM-Plugin-Activation/tree/hotfix/2.4.1

:slight_smile:

There is still an error on this version;

EDIT:

Sorry, that error has been fixed but Iā€™m still getting the following error;

ā€œFatal error: Class ā€˜TGM_Bulk_Installerā€™ not found in ā€¦/includes/class-tgm-plugin-activation.php on line 1586ā€

Has anyone tried this version?

Think that was fixed in the Develop branch(link below) as StephenCronin said, which includes the bulk fix from the hotfix/2.4.1.

I just tested and didnā€™t notice the fatal error you had got.

Make sure to watch the master branch though :slight_smile:

30
webcreations907 said
egemenerd said
webcreations907 said

@meanthemes

Itā€™s in the hotfix branch.
https://github.com/thomasgriffin/TGM-Plugin-Activation/tree/hotfix/2.4.1

:slight_smile:

There is still an error on this version;

EDIT:

Sorry, that error has been fixed but Iā€™m still getting the following error;

ā€œFatal error: Class ā€˜TGM_Bulk_Installerā€™ not found in ā€¦/includes/class-tgm-plugin-activation.php on line 1586ā€

Has anyone tried this version?

Think that was fixed in the Develop branch(link below) as StephenCronin said, which includes the bulk fix from the hotfix/2.4.1.

I just tested and didnā€™t notice the fatal error you had got.

Make sure to watch the master branch though :slight_smile:

Thanks webcreations907. I just tested develop branch and youā€™re right, I didnā€™t get a fatal error at this time but there is another issue now;

Link is something like ā€œā€¦/wp-admin/?page=mytheme-install-required-pluginsā€ but it should be ā€œwp-admin/themes.php?page=mytheme-install-required-pluginsā€. It works if I edit the link manually. Did you notice any problem like that?

31

@StephenCronin since TGMPA was the preferred solution provided by Envato when we initially had the ā€œfunctionality in pluginsā€ debate a while ago, please donā€™t do the same as what happened with the Revslider issues a while ago and start disabling themes left right and center, give authors the time needed to make these updates.

Also, this needs announcing on the author dashboard, not many authors actually come though these forums.

32

Is anyone else getting the permissions error on a multisite setup when trying to install or activate a plugin using TGM? Iā€™ve seen the issue posted on the TGM Github a few times dating as far back as last March.

33
EugeneO said

Is anyone else getting the permissions error on a multisite setup when trying to install or activate a plugin using TGM? Iā€™ve seen the issue posted on the TGM Github a few times dating as far back as last March.

Yap, been getting this for a long while now.

34
EugeneO said

Is anyone else getting the permissions error on a multisite setup when trying to install or activate a plugin using TGM? Iā€™ve seen the issue posted on the TGM Github a few times dating as far back as last March.

Yeah, it doesnā€™t work on a multisite.

35
egemenerd said

Link is something like ā€œā€¦/wp-admin/?page=mytheme-install-required-pluginsā€ but it should be ā€œwp-admin/themes.php?page=mytheme-install-required-pluginsā€. It works if I edit the link manually. Did you notice any problem like that?

TGM v2.4.1 - Same error as in screenshot for bulk install.

36

@tansh and @egemenerd

I just submitted a PR for that issue on their repo :wink:

37

Hi All,

I just updated the original post with the following:

OptionTree
If you use OptionTree, then although this does use add_query_arg and remove_query_arg, we are confident that none of the instances can be exploited. There will be an update that escapes these functions in future that you should include in your item, but you should not delay updating your items waiting for this.
UPDATE: Version 2.5.4 of this plugin has been released and is now available from the WordPress plugin directory. This version escapes all instances of the functions and also fixes the term splitting issue for WordPress 4.2 (due to released very soon). Please update your items to use this version.
38

Now Iā€™m confused on which file should useā€¦

this one: https://github.com/thomasgriffin/TGM-Plugin-Activation/blob/hotfix/2.4.1/class-tgm-plugin-activation.php (with 2204 lines) updated 14 hours ago

or

this one: https://github.com/thomasgriffin/TGM-Plugin-Activation/blob/develop/class-tgm-plugin-activation.php (with 2310 lines) - updated 5 hours ago

both are v2.4.1

39

Hello,

Can anyone explain me why we should care XSS attacks? It is not persistent right?This will not give access to server to modify the website page for all users. It will only affect on the browser who visits the link with malicious script? This can be easily identified right?

Iā€™m not a WP Dev, I have read all XSS related stuff. But I donā€™t see a real life situation where this is harmful.

So, Is there any real world examples, an XSS attack can be harmful?

Any help would be appreciated.

40
surjithctly said

Hello,

Can anyone explain me why we should care XSS attacks? It is not persistent right?This will not give access to server to modify the website page for all users. It will only affect on the browser who visits the link with malicious script? This can be easily identified right?

Iā€™m not a WP Dev, I have read all XSS related stuff. But I donā€™t see a real life situation where this is harmful.

So, Is there any real world examples, an XSS attack can be harmful?

Any help would be appreciated.

How about redirecting your users to malicious websites using jsā€¦

Anyway, this TGM situation isnā€™t that bad because the attacker must be an admin or have similar privileges to do something bad to your website.