message from wordfence

  • Resolved Kimbert

    (@kimbert)


    10 years, 3 months ago

    Hello

    Does anybody know what this means? Or is it spam?

    We don't usually see this kind of perfect storm, but we've just seen fixes for severe vulnerabilities in three WordPress plugins released in the same 24 hour window. One of them is a WooCommerce plugin. The vulnerabilities have already been disclosed on either the Bugtraq or Securityfocus mailing lists, so exploits may already be in the wild.

Full details on our blog...

Regards,

Mark Maunder
Wordfence Founder & CEO

    https://wordpress.org/plugins/woocommerce/

Viewing 7 replies - 1 through 7 (of 7 total)
  • Plugin Contributor Mike Jolley

    (@mikejolley)

    10 years, 3 months ago

    Looks like he is not talking about WooCommerce itself https://www.wordfence.com/blog/2016/02/three-wordpress-plugin-vulnerabilities-fixes-released/

    Thread Starter Kimbert

    (@kimbert)

    10 years, 3 months ago

    Hello Mike,
    Thank you for the reassurance because I just feel so insecure sometimes with thhe different plugins.

    I have had a bad experience with one and I am terrified to click on any links.

    What do think is the best way to be secure for our sites and our clients who purchase on our sites?

    thank you again,
    Kathleen

    Plugin Contributor Mike Jolley

    (@mikejolley)

    10 years, 3 months ago

    Just keep up to date – most responsible developers will issue security patches before disclosure.

    Thread Starter Kimbert

    (@kimbert)

    10 years, 3 months ago

    ok will do thank you.

    How about some sort of logo on our sites to reassure buyers?

    Should I put up wordfence’s logo and others?

    thank you
    K

    Plugin Contributor Mike Jolley

    (@mikejolley)

    10 years, 3 months ago

    It’s not really likely that most ‘buyers’ know what WordPress is – run your site over HTTPs, and you can use trustseals from the SSL certificate providers perhaps.

    Thread Starter Kimbert

    (@kimbert)

    10 years, 3 months ago

    Will look at that.

    Thank you Mike

    K

    Thread Starter Kimbert

    (@kimbert)

    10 years, 3 months ago

    Hi again Mike

    I have run a Stop spammers scan and the scan came up with these threats concerning Woo Commerce ( there were others but I wont put them up here)

    On this site I had a problem at Xmas with a bad plug in that created alot of spam emails and I noticed that some of them even tried to login to our site. http://www.thereddoorgallery.org

    Does this code look strange to you?
    On line 18 this is in red ‘$key(); `

    and line 19 this is in red too $clazz(

    18.	/home/thereddonv/www/wp-content/plugins/woocommerce/woocommerce.php 
144: return $this->$key();
	19.	/home/thereddonv/www/wp-content/plugins/woocommerce/includes/gateways/simplify-commerce/includes/Simplify/PaymentsApi.php 
137: $object = new $clazz();

    I have just received an email from Jetpack saying this site went down and is back up again. It may have been my host site but I haven’t had any news from them yet.

    thank you for your help,

    K
    thank you for looking at this.

Viewing 7 replies - 1 through 7 (of 7 total)

The topic ‘message from wordfence’ is closed to new replies.