• Hi, Pleskians! We are running a UX testing of our upcoming product intended for server management and monitoring.
    We would like to invite you to have a call with us and have some fun checking our prototype. The agenda is pretty simple - we bring new design and some scenarios that you need to walk through and succeed. We will be watching and taking insights for further development of the design.
    If you would like to participate, please use this link to book a meeting. We will sent the link to the clickable prototype at the meeting.
  • (Plesk for Windows):
    MySQL Connector/ODBC 3.51, 5.1, and 5.3 are no longer shipped with Plesk because they have reached end of life. MariaDB Connector/ODBC 64-bit 3.2.4 is now used instead.
  • The Horde webmail has been deprecated. Its complete removal is scheduled for April 2025. For details and recommended actions, see the Feature and Deprecation Plan.

Resolved WP Toolkit vulnerability alert might be a false positive? [Unauthenticated Blind SSRF]

pascual

New Pleskian
Server operating system version
Ubuntu 22.04
Plesk version and microupdate number
Plesk Obsidian 18.0.48
I have a question regarding a possible false positive in the WP Toolkit vulnerability alerts.

Last night we received alerts that all our WordPress installations are affected by a, supposedly newly discovered, security flaw.
This flaw is named as "WordPress <= 6.1.1 - Unauth. Blind SSRF vulnerability".

However after som digging it seems that there is a chance that this is a false positive, at least for those sites that have disabled XMLRPC and pingbacks. See the discussion over at the Wordpress support forum ("Site scan reports WP 6.1.1 vulnerability").

Anyone have any ideas on how to react to this or have any insights to share about the supposed vulnerability? We have a lot of hosted customers running Wordpress with WP Toolkit, and I expect a rush of customer support tickets regarding this warning today.
 
Hi @pascual,

This is a low risk WordPress core vulnerability (info here), and there is no fix yet for this vulnerability in WordPress itself. I expect WordPress team to release a minor security update very soon.

Situation like this sucks for everyone around, so we are working on introducing virtual patches to WPT. They should be able to block vulnerabilities from being exploited even if an update with a fix isn't available yet.
 
Hi @pascual,

This is a low risk WordPress core vulnerability (info here), and there is no fix yet for this vulnerability in WordPress itself. I expect WordPress team to release a minor security update very soon.

Situation like this sucks for everyone around, so we are working on introducing virtual patches to WPT. They should be able to block vulnerabilities from being exploited even if an update with a fix isn't available yet.

Thank you so much! :D
 
Jan 24 and WordPress still hasn't addressed the issue. May I suggest that WP-Toolkit be updated so it checks to confirm that Pingbacks/XML-RPC both are disabled, and if so, not report a threat. If either one are enabled, then by all means, yes, do report it as a threat until WordPress updates.
 
@doncullen Plesk is aware of this and similar situations. For that reason we are working on introducing virtual patches in WP Toolkit. However, this is not an easy task and needs a lot of consideration and testing. It cannot be done on-the-fly. It would be Wordpress' responsibility to fix the issue in the first place. Until then we can only assist you with workarounds as described in
 
We get that the onus is on Wordpress to fix this but Plesk developed and is responsible for managing the extension - simplest thing they can do is add an alert mute/silence feature to silence the annoying visual and email alerts.

Really, it's that simple!
 
Back
Top