Title: Plugin Security Vulnerabilities Last modified: August 21, 2016 --- # Plugin Security Vulnerabilities * [Dan Rossiter](https://wordpress.org/support/users/danrossiter/) * (@danrossiter) * [11 years, 10 months ago](https://wordpress.org/support/topic/plugin-security-vulnerabilities/) * I have reason to believe that a security vulnerability may exist in this plugin. * If the developer left previous versions of the plugin in the subversion repository or bothered to indicate what security hole was fixed in version `1.8.8.1` (per the [Changelog]([http://wordpress.org/plugins/simple-dropbox-upload-form/changelog/](http://wordpress.org/plugins/simple-dropbox-upload-form/changelog/))) then I might be able to figure out whether the issue is resolved, but as it currently stands I would strongly recommend that no one install this on a production site. * -Dan * [https://wordpress.org/plugins/simple-dropbox-upload-form/](https://wordpress.org/plugins/simple-dropbox-upload-form/) Viewing 6 replies - 1 through 6 (of 6 total) * Plugin Author [hiphopsmurf](https://wordpress.org/support/users/hiphopsmurf/) * (@hiphopsmurf) * [11 years, 10 months ago](https://wordpress.org/support/topic/plugin-security-vulnerabilities/#post-5029509) * Hi Dan, * I can assure you that though I did not catch the bug before it was publicly posted, I was quick to remove the multiple upload functionality along with the effected files and if you would’ve checked the developers page you would’ve seen that I also removed all previous versions including ones that did not contain the security whole. Please do the proper research before spouting off. Thanks! * Thread Starter [Dan Rossiter](https://wordpress.org/support/users/danrossiter/) * (@danrossiter) * [11 years, 10 months ago](https://wordpress.org/support/topic/plugin-security-vulnerabilities/#post-5029523) * The fact that you’ve removed previous versions is exactly my concern. There is no way to verify that sane changes have been made. * I am “spouting off,” because your actions have prevented proper research from being possible. * -Dan * Plugin Author [hiphopsmurf](https://wordpress.org/support/users/hiphopsmurf/) * (@hiphopsmurf) * [11 years, 10 months ago](https://wordpress.org/support/topic/plugin-security-vulnerabilities/#post-5029570) * Removing the files from the repository prevents someone from attempting to use a version that would open their server up to having a malicious script uploaded. Anyone doing “Research” could clearly find what the exploit was without the files on the repo and also confirm that the files were removed completely. * Sorry that I don’t feel compelled to rehash an issue that has already been resolved, but if you feel like you hit a dead end in your research and need pointed in the direction of where to look, feel free to email me directly and I will be happy to help. * Thanks! * Thread Starter [Dan Rossiter](https://wordpress.org/support/users/danrossiter/) * (@danrossiter) * [11 years, 10 months ago](https://wordpress.org/support/topic/plugin-security-vulnerabilities/#post-5029581) * What you did may have been well-intentioned, but the logic is severely flawed. One of the primary benefits of open source development is that other developers can independently verify that a plugin does what it claims. By removing the previous versions, all you have achieved is making it necessary for someone attempting to verify that previous security vulnerabilities to go through the entire source, versus being able to simply run a diff across the versions. * If someone goes into the developers tab and manually pulls down a version other than the current version, it is safe to assume that they are an advanced user and intended to do so. You as an open source developer have the responsibility to make such actions possible, _especially_ when security vulnerabilities are in play. * I will not consider this issue as resolved until the code history is restored. * -Dan * Plugin Author [hiphopsmurf](https://wordpress.org/support/users/hiphopsmurf/) * (@hiphopsmurf) * [11 years, 10 months ago](https://wordpress.org/support/topic/plugin-security-vulnerabilities/#post-5029589) * Sorry but I will not be restoring the code. If someone is an advanced user and wants that information, they will know where to find it. Considering your a plugin developer and have plugins published here on wordpress you should know how to use Trac. * You are welcome to keep this issue open as long as you would like. This is not a support issue and has been marked as such. If you feel that strongly about this issue, please direct further communication to support[at]wordpress[dot]org * Thanks! * Thread Starter [Dan Rossiter](https://wordpress.org/support/users/danrossiter/) * (@danrossiter) * [11 years, 10 months ago](https://wordpress.org/support/topic/plugin-security-vulnerabilities/#post-5029590) * I do indeed know how to use Trac. That does not make this any less of an unscrupulous action on your part. * -Dan Viewing 6 replies - 1 through 6 (of 6 total) The topic ‘Plugin Security Vulnerabilities’ is closed to new replies. * ![](https://s.w.org/plugins/geopattern-icon/simple-dropbox-upload-form_457872. svg) * [Simple Dropbox Upload](https://wordpress.org/plugins/simple-dropbox-upload-form/) * [Frequently Asked Questions](https://wordpress.org/plugins/simple-dropbox-upload-form/#faq) * [Support Threads](https://wordpress.org/support/plugin/simple-dropbox-upload-form/) * [Active Topics](https://wordpress.org/support/plugin/simple-dropbox-upload-form/active/) * [Unresolved Topics](https://wordpress.org/support/plugin/simple-dropbox-upload-form/unresolved/) * [Reviews](https://wordpress.org/support/plugin/simple-dropbox-upload-form/reviews/) * 6 replies * 2 participants * Last reply from: [Dan Rossiter](https://wordpress.org/support/users/danrossiter/) * Last activity: [11 years, 10 months ago](https://wordpress.org/support/topic/plugin-security-vulnerabilities/#post-5029590) * Status: not a support question