Vulnerabilities that does not exist

[Redsector]

Server operating system version

Ubuntu 20.04.6

Plesk version and microupdate number

18.0.51

Hello there,
I suppose something is stuck either on my side or in the tool.
I have updated to WP 6.2 and the toolkit still report there is an issue "WordPress <= 6.1.1 - Unauth. Blind SSRF vulnerability", but 6.2 is clearly > 6.1.1

Plus I have installed "UpdraftPlus - Backup/Restore 1.23.3" and wp toolkit report to me there is a vulnerability on "WordPress UpdraftPlus PRO plugin 2.22.14-2.23.2" which I don't have. To be clear, the version 2.x is the pro paid version, the 1.xx is the free one. They are different stuff, and to be even more clear, according to the developer, the bug is fixed also in version 1.23.3. I Suggest you to either recognize 1.X and 2.X or to simply discard the first digit.

I hope this help removing this red ! that cannot alert me if new things are to be considered
Thanks

 

[olivier09]

Hello,
I have exactly the same two problems.
WP Toolkit ?
What to do ?
Thanks

 

[Aleksey Filatev]

Vulnerability WordPress <= 6.1.1 - Unauth. Blind SSRF vulnerability is not yet fixed, so any WordPress version is affected. But WP Toolkit provides two ways to mitigate it for your websites (see screenshot for the details).

 

[olivier09]

Hello,
I thought version WP6.2 was going to fix that.
I checked these options (xmlrpc and pinkback) for several years.
For the UpdraftPlus extension, there is indeed an issue with WP Toolkit not seeing the correct version installed.
Thanks,

 

[olivier09]

Hello,
UP
Thanks,

 

[olivier09]

Hello,
UP
Thanks,

 

[olivier09]

UP

 

[Netaction]

Plesk is wrong. The vulnerability is fixed in 5.9.3 according to the authors of the bug report. WordPress Core - Unauthenticated Blind SSRF | Sonar

I get the message for a not existing WordPress UpdraftPlus PRO, too.

 

[Peter Debik]

@Netaction Could you please quote the passage from the article where it says that the vulnerability is fixed?

 

[Netaction]

Sorry after reading again, I am not sure any more. They say: "as they need more time to work on backports." What I read was: The Wordpress Maintainers think the bug is fixed in Wordpress 6 but had to fix Wordpress 5, too.
I can't find an official statement from Wordpress or an independent proof the bug still exists.

 

[MarkM]

I can't find an official statement from Wordpress or an independent proof the bug still exists.

So... proof that it's been fixed?

This is a WordPress issue at the end of the day. Why make this a Plesk issue?

 

[Netaction]

#57363 (WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding) – WordPress Trac

core.trac.wordpress.org

Now I fond something. The Wordpress Dev says yeah the bug exists but simply use a trusted DNS, send some good hopes with your prayers and maybe nobody will be affected.
(Following this logic, no Wordpress page should use HTTPS as Wordpress' security relys on the network. Any DNS should be trusted to work as SSL Cert Autority)

OK then Plesk's mentioning of the security issue is correct. The message "WordPress <= 6.2" is at least misleading as 6.2.2 is affected too. The link to Patchstack is not the best choice, there are confirmations from the Wordpress team itself.

 

[olivier09]

Hello,
For the UpdraftPlus Plesk and WP Tolkit say :
WordPress UpdraftPlus PRO plugin 2.22.14-2.23.2 - Broken Access Control Vulnerability
But i have "UpdraftPlus - Backup/Restore 1.23.4".
WP Toolkit not seeing the correct version installed.
Thanks,

 

[Maarten]

Hello,
For the UpdraftPlus Plesk and WP Tolkit say :
WordPress UpdraftPlus PRO plugin 2.22.14-2.23.2 - Broken Access Control Vulnerability
But i have "UpdraftPlus - Backup/Restore 1.23.4".
WP Toolkit not seeing the correct version installed.
Thanks,

Important - PLEASE FOLLOW THIS INSTRUCTION IF YOU BELIEVE THAT FOUND A BUG!

Dear Pleskians, Please, click Submit Report button and use the template in this special forum subsection if you really believe you discovered a new bug and need to report it to the Plesk developers. It does allow us to handle and resolve your requests much more efficiently. Please be careful...

talk.plesk.com

 

[Netaction]

WordPress UpdraftPlus PRO plugin 2.22.14-2.23.2 - Broken Access Control Vulnerability
But i have "UpdraftPlus - Backup/Restore 1.23.4".

Exactly the same bug here.

Important - PLEASE FOLLOW THIS INSTRUCTION IF YOU BELIEVE THAT FOUND A BUG!

Dear Pleskians, Please, click Submit Report button and use the template in this special forum subsection if you really believe you discovered a new bug and need to report it to the Plesk developers. It does allow us to handle and resolve your requests much more efficiently. Please be careful...

talk.plesk.com

Lol no. We disclosed several bugs here the last days and only got shady excuses.

 

[Peter Debik]

Lol no. We disclosed several bugs here the last days and only got shady excuses.

Please provide a list of these bugs you disclosed and the shady excuses you got. As far as I remember you were simply wrong with your assumptions, but maybe I have missed something.

The "Updraft" issue was first reported in April and has already been fixed. It should not occur in WP Toolkit version 6.3.0-7223 or newer. Which WP Toolkit version are you using? Updates for the WP Toolkit extension are rolled out gradually, so it is possible that your installation does not have it yet. Same principle as explained before regarding Wordpress updates.

 

[Netaction]

I really like the quality and service of Plesk. They focus on useful tools. There are no functions just to be cool or just to have a buzzword in advertisement. The quality is fine so far. But telling it is on purpose to install an update a day later then everyone else really annoys me. It looks like a bug and bugs might happen, that's allright if you stand by it. Just please don't deny an issue if you see it by reflex.
After knowing this list of security issues might have some problems with Wordpress bugs, version numbers, Plugin bugs and Plugin names, I will take it with a grain of salt in the future, and this is fine for me. But calling those issues "resolved" doesn't make them disappear.

 

[Peter Debik]

The nightly maintenance concept is by design. Gradual roll-outs are also by design and serve several important purposes such as not overloading source servers. There are no plans to change either.

If the current Wordpress maintenance is not fast enough for your business case you can always and very easily update Wordpress from the Wordpress Dashboard.

 

[olivier09]

Hello,
Version WP Toolkit : 6.2.2-7222.
I still don't have the update available.
Is this normal?
Cordialy,

 

[MarkM]

That is the latest as far as I'm aware.