Plugin inspection:

More Privacy Options

Potentially unsafe

Last revised:

Confidence: Medium
This plugin has been given a short, targeted code review.

Before using this plugin, you should very carefully consider its potential problems and should conduct a thorough assessment. Read more about this recommendation.

Warnings

This recommendation applies to version 3.5 of this plugin, but the most recent version is 4.0.1. These findings may no longer be correct.

Findings

Does not protect any uploaded files, or files that are not php

Does not protect what posts have been made and their content via bypass.

Does not work unless you are using mutisite and it does not protect the network site.

Reason for the 'Potentially unsafe' result

The plugin contains or is likely to contain a vulnerability which could be exploited by an end user and which would compromise the site’s confidentiality, integrity or availability:

Does not block xmlrpc, so you can find out info about posts that are meant to be protected.

Here is an example rpc to see if a post exists or not.

POST /wordpress/fred/xmlrpc.php HTTP/1.1
Host: 127.0.0.1
Content-Length: 243

<?xml version=”1.0″?>
<methodCall>
<methodName>pingback.extensions.getPingbacks</methodName>
<params>
<param><value><string>http://127.0.0.1/wordpress/fred/2013/08/09/hello-world/</string></value></param>
</params>
</methodCall>

Failure criteria

  • Poor coding style

Read more about our failure criteria.