Security Issues

I had the same warning: WordPress Optimize Database after Deleting Revisions plugin <= 5.0.110 – Cross Site Request Forgery (CSRF) vulnerability

Such a pity,

Please notify when you have found a good replacement. I am on a pension now but still manage a couple of Community WordPress websites and this apparently abandoned plug-in came in very handy in keeping those databases tidy.

Thank you,
Yolanda aka nathair

The WP toolkit running on Plesk isalso reporting the vulnerability.

@cageehv as far as i could find,
these types of issues can be prevented by using “nonces” and validating, sanitizing and escaping your code where possible,

https://wpvip.com/2023/02/28/how-to-protect-against-csrf-attacks-with-wordpress-nonces/

From Wordfence:

The Optimize Database after Deleting Revisions plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.0.110. This is due to missing or incorrect nonce validation on the ‘odb_start_manually’ function. This makes it possible for unauthenticated attackers to start the database optimization process via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Nice one Rolf!
Let’s hope this fixes things.

Thank you Rolf @cageehv
I suggest that you contact Wordfence and others that reported the issue so they’ll know it’s fixed 🙂

It really is appreciated Rolf, I’ve used your plugin for lots of clients over the years and I’d have no idea what could replace it! All the best (hat tip emoji)