Title: Bug / URL guessing Last modified: May 13, 2020 --- # Bug / URL guessing * Resolved [doffine](https://wordpress.org/support/users/doffine/) * (@doffine) * [6 years, 2 months ago](https://wordpress.org/support/topic/bug-url-guessing/) * Hello WP Maintenance team, * we just noted a problem with URL guessing made by WordPress and your plugin. * When your plugin is active and shows the maintenance screen to users that are not logged in, one does this to avoid anything of the website’s content to be revealed to the outside. * But it seems that you forgot to block WordPress’ URL guessing. We have a website with active maintenance plugin and when we enter an URL into the browser like * `https://WWW.DOMAIN.TLD/w` * (just with a “w” in the end), then the browser URL switches to the URL * `https://WWW.DOMAIN.TLD/submenu/"some-word-with-a-leading-w"` * This is WordPress’ URL guessing that rewrites the URL. But if one has your plugin active he might not want even this information to be revealed to the outside. Maintenance is maintenance. Then no URL path should be revealed. * Are we wrong? * Many greetings, -doffine Viewing 9 replies - 1 through 9 (of 9 total) * [Manuel Rocha](https://wordpress.org/support/users/manuelrocha88/) * (@manuelrocha88) * [6 years, 2 months ago](https://wordpress.org/support/topic/bug-url-guessing/#post-12839427) * [@doffine](https://wordpress.org/support/users/doffine/) sorry for the delay… When You say Url Guess You mean URL Autocorrect Guessing? * Anyway, It seems our plugin it’s not handle the new URL Autocorrect Guessing. * For now You can quickly solve it by disabling the Guessing feature while Your website is under construction. * Just add this to Your template function and should do the job: * ``` function remove_redirect_guess_404_permalink( $redirect_url ) { if ( is_404() && !isset($_GET['p']) ) return false; return $redirect_url; } add_filter( 'redirect_canonical', 'remove_redirect_guess_404_permalink' ); ``` * Thread Starter [doffine](https://wordpress.org/support/users/doffine/) * (@doffine) * [6 years, 2 months ago](https://wordpress.org/support/topic/bug-url-guessing/#post-12839483) * [@manuelrocha88](https://wordpress.org/support/users/manuelrocha88/) thanks for coming back to us. * Since we maintain several hundrets of WordPress installations – many use your plugin – it’s not really the most practicable way to implement this snippet in all of the installations. * It would be more interesting to hear from you, if you intend to fix this bug in your plugin and when you think this could be done? * Many greetings, -doffine * Thread Starter [doffine](https://wordpress.org/support/users/doffine/) * (@doffine) * [6 years, 1 month ago](https://wordpress.org/support/topic/bug-url-guessing/#post-12927730) * [@manuelrocha88](https://wordpress.org/support/users/manuelrocha88/) you just release a new version. Is it that you solved the above problem in the new version so that we are not forced to roll out your code snippet into all installations? * Many greetings, -doffine * [Manuel Rocha](https://wordpress.org/support/users/manuelrocha88/) * (@manuelrocha88) * [6 years, 1 month ago](https://wordpress.org/support/topic/bug-url-guessing/#post-12931919) * [@doffine](https://wordpress.org/support/users/doffine/) we were expecting you to tell us if it solved or not. As You are the only person that complain we need to at least confirm it solved to some of your solutions. * Thread Starter [doffine](https://wordpress.org/support/users/doffine/) * (@doffine) * [6 years, 1 month ago](https://wordpress.org/support/topic/bug-url-guessing/#post-12932228) * [@manuelrocha88](https://wordpress.org/support/users/manuelrocha88/) ok, we just tested it again, and it hasn’t been fixed so far. * URL Autocorrect Guessing by WordPress still rewrites the URL even if your Maintenance plugin is activated. * 1. This is the case in all of our installations of your plugin: On four different servers in different data centers and in many different WordPress installations. It is not an edge case or something like that. It just seems to be the way your plugin behaves at this moment. * 2. Maybe we are – as you state it above – the only ones that noted this bug so far. But this doesn’t change a thing on the fact that this is maybe even a security relevant problem. If one installs your plugin and puts his website behind your maintenance curtains he will rely on this. He will rely on your plugin completely hiding _all_ information/content from the public. Even a “little thing” like a speaking URL could reveal information to the public that should not be revealed( at least at this moment). One does not have to be very creative to imagine cases where this could have really bad consequences. So we are a little bit surprised why you don’t fix this with quite high priority. * 3. It is not difficult to set up a test scenario. Just take a WordPress installation, try out a short, per se not existing link that leads to a subpage by URL Autocorrect Guessing. Then copy this short link to your clipboard. Activate your plugin. Paste the short link and see that it still gets resolved to the complete existing page URL. Voilà: Information revealed. * Many greetings, -doffine * [Manuel Rocha](https://wordpress.org/support/users/manuelrocha88/) * (@manuelrocha88) * [6 years, 1 month ago](https://wordpress.org/support/topic/bug-url-guessing/#post-12932572) * [@doffine](https://wordpress.org/support/users/doffine/) but did you put the code that i give to you? Because on our test environment it worked as expected. We just want to make sure that it will not break other stuff on other clients solutions. As You are the only one complaining you are the only one that can test the solution… * Thread Starter [doffine](https://wordpress.org/support/users/doffine/) * (@doffine) * [6 years, 1 month ago](https://wordpress.org/support/topic/bug-url-guessing/#post-12932673) * [@manuelrocha88](https://wordpress.org/support/users/manuelrocha88/) ok, we just tested your code snippet and it works. * We understood you in a way that you intended to implement this fix in the plugin itself (and the snippet would just be a workaround) so that we don’t have to put this snippet everywhere. * So now as we know your snippet works: Will you put this fix into the plugin’s next release? * Greetings, -doffine * [Manuel Rocha](https://wordpress.org/support/users/manuelrocha88/) * (@manuelrocha88) * [6 years, 1 month ago](https://wordpress.org/support/topic/bug-url-guessing/#post-12934694) * [@doffine](https://wordpress.org/support/users/doffine/) so I already passed the confirmation to dev team and they told me that this will come with the next plugin release. This is going to happen around mid of this month. * Thread Starter [doffine](https://wordpress.org/support/users/doffine/) * (@doffine) * [6 years, 1 month ago](https://wordpress.org/support/topic/bug-url-guessing/#post-12938513) * [@manuelrocha88](https://wordpress.org/support/users/manuelrocha88/) That sounds good. Thank you very much! * -doffine Viewing 9 replies - 1 through 9 (of 9 total) The topic ‘Bug / URL guessing’ is closed to new replies. * ![](https://ps.w.org/maintenance/assets/icon-256x256.png?rev=2689583) * [Maintenance](https://wordpress.org/plugins/maintenance/) * [Frequently Asked Questions](https://wordpress.org/plugins/maintenance/#faq) * [Support Threads](https://wordpress.org/support/plugin/maintenance/) * [Active Topics](https://wordpress.org/support/plugin/maintenance/active/) * [Unresolved Topics](https://wordpress.org/support/plugin/maintenance/unresolved/) * [Reviews](https://wordpress.org/support/plugin/maintenance/reviews/) ## Tags * [path](https://wordpress.org/support/topic-tag/path/) * [url](https://wordpress.org/support/topic-tag/url/) * 9 replies * 2 participants * Last reply from: [doffine](https://wordpress.org/support/users/doffine/) * Last activity: [6 years, 1 month ago](https://wordpress.org/support/topic/bug-url-guessing/#post-12938513) * Status: resolved