• Introducing WebPros Cloud - a fully managed infrastructure platform purpose-built to simplify the deployment of WebPros products !  WebPros Cloud enables you to easily deliver WebPros solutions — without the complexity of managing the infrastructure.
    Join the pilot program today!
  • Support for BIND DNS has been removed from Plesk for Windows due to security and maintenance risks.
    If a Plesk for Windows server is still using BIND, the upgrade to Plesk Obsidian 18.0.70 will be unavailable until the administrator switches the DNS server to Microsoft DNS.

Issue WordPress Toolkit vulnerability report unclear

Visnet

Basic Pleskian
Dear Plesk team and Pleskians,

For one staging website on my Plesk server (Plesk Obsidian) I am getting the following two reports from the WordPress Toolkit extension:
website URL filteredWordPress License Manager for WooCommerce plugin <= 2.2.5 - Sensitive Information Disclosure vulnerability
website URL filteredWordPress License Manager for WooCommerce plugin <= 2.2.5 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

However, it is unclear:
  • What the nature of this vulnerability is, how to find more information about it and how to pinpoint the issue in the plugin code
  • How to solve this or what to report to the plugin developer (for instance, this plugin does not have any new versions available yet)
Without this information reports like these are more confusing than helpful.

Am I missing something?
Or could this be improved to be more helpful to a server administrator?

Cheers!
 
To add to my initial report:

Using Plesk 18.0.41.1 with WordPress Toolkit extension 5.9.3-6032

I just found out that when using the WordPress Toolkit through the Plesk panel, under Security > Vulnerabilities (filter) the same notices actually provide a 'Details' button that is linking to:
- WordPress License Manager for WooCommerce plugin <= 2.2.5 - Sensitive Information Disclosure vulnerability - Patchstack
- WordPress License Manager for WooCommerce plugin <= 2.2.5 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability - Patchstack

Suggestion:
Either include these same links in the report e-mail or explain how/where to find them in the Plesk panel.
 
Thank you for your feedback! We have filed a task to improve our email notifications based on your feedback. Let us know if you have any other feedback.
 
Back
Top