Hello, @ete
Can you please confirm whether you’re currently using a custom login page, a membership plugin, or a separate 2FA/captcha alongside Wordfence? If so, please confirm which plugins you’re using for those.
Also, if you’re able to log in (either after temporarily disabling the plugin or temporarily downgrading it to the prior version), could you please send diagnostics by navigating to the Wordfence > Tools > Diagnostics page and using the Send Report option? You can send those to the default wftest@wordfence.com email with your forum username in the second field. Please let me know here when you’ve sent those.
We have a video here that goes through the process of temporarily deactivating Wordfence by renaming the plugin folder in wp-content/plugins. That section starts at the 2:25 mark of the video. Once disabled, please try logging in and then renaming the wordfence directory back to its original name. At that point, please send over diagnostics. Additionally, please confirm any error messages you’re seeing on the pages while Wordfence is enabled.
Thanks,
Scott
Thread Starter
ete
(@ete)
Hello there,
There is no custom login page (normal wp-login), no membership plugins, using 2FA from wordfence and no other alongside aside from the built in Turnstile for contact forms from WPForms Lite.
I cannot go through the process of disabling the plugin, I run a commercial site that has more than 1 decade and that would be too risky.
I can though give you some of the errors that WordPress is auto-detecting on wp-login through the critical issue temporary email “recovery mode” (you will see a custom db renaming)
Error Details
An error of type E_ERROR was caused in line 276 of the file /wp-content/plugins/wordfence/modules/login-security/classes/controller/db.php. Error message: Uncaught RuntimeException: Failed to execute query: DROP TABLE IF EXISTS dnsnz_wfls_role_counts in /wp-content/plugins/wordfence/modules/login-security/classes/controller/db.php:276
Stack trace: 0 /wp-content/plugins/wordfence/modules/login-security/classes/controller/db.php(228): WordfenceLS\Controller_DB->query() 1 /wp-content/plugins/wordfence/modules/login-security/classes/controller/db.php(213): WordfenceLS\Controller_DB->migrate_schema_to_version_3() 2 /wp-content/plugins/wordfence/modules/login-security/classes/controller/db.php(196): WordfenceLS\Controller_DB->run_schema_migration() 3 /wp-content/plugins/wordfence/modules/login-security/classes/controller/db.php(181): WordfenceLS\Controller_DB->migrate_to_schema_version() 4 /wp-content/plugins/wordfence/modules/login-security/classes/controller/passkey.php(72): WordfenceLS\Controller_DB->require_schema_version() 5 /wp-content/plugins/wordfence/modules/login-security/classes/controller/passkey.php(234): WordfenceLS\Controller_Passkey->require_schema() 6 /wp-content/plugins/wordfence/modules/login-security/classes/controller/wordfencels.php(738): WordfenceLS\Controller_Passkey->any_passkeys_active() 7 /wp-includes/class-wp-hook.php(341): WordfenceLS\Controller_WordfenceLS->_login_enqueue_scripts() 8 /wp-includes/class-wp-hook.php(365): WP_Hook->apply_filters() 9 /wp-includes/plugin.php(522): WP_Hook->do_action() 10 /wp-login.php(120): do_action() 11 /wp-login.php(1497): login_header() 12 {main}
thrown
-
This reply was modified 3 days ago by
ete.
-
This reply was modified 3 days ago by ete.
Hey ete, I tried to write a post with some screenshots about this error as I found a resolution. Unfortunately the automated agents marked it as spam as I included screenshots.
Verify the user account on the database as full permissions, at least DROP permissions.
What fixed it for me was disabling the plugin in recovery mode, granting the database user account DROP permissions, then re-enabling the plugin, and finally removing DROP permissions again if you set the plugin to not auto-update.
Hello, @ete
Thanks for your patience.
I recommend checking to be sure the database user has DROP privileges and, if not, granting them. We also use DROP to truncate tables after scans, so we recommend leaving that privilege in place if possible.
Thanks,
Scott
Thread Starter
ete
(@ete)
Thanks @percussivemaintenance for spotting the origin of the problem right away.
Thanks @wfscott for the suggestion.
Since enabling global DROP permissions opens a massive potential security hole. Wouldn’t it be a risk-free way to fix the DROP issues with Wordfence by doing this?:
— Strictly confine DROP, ALTER, and CREATE privileges to Wordfence tables
GRANT CREATE, ALTER, DROP ON your_database_name.wp_wf% TO ‘your_wp_user’@’localhost’;
While they could clear the data in that table, or find a method to make it a view-like table from MS SQL instead, dropping it is the quickest and easiest method. DROP permissions aren’t as much of a security risk these days. In the early days of the Internet and WordPress, it was common for the “thugs” of the Internet to just deface a website or drop the tables causing significant damage.
These days the threat actors are injecting malware into the site, which uses the standard permissions like INSERT which are required for WordPress to be usable.
Removing permissions like DROP, CREATE, ALTER, etc. and then manually updating the plugins is one way to tackle it. With how quickly vulnerabilities are being targeted by threat actors as AI is facilitating these attacks, this leaves you a larger security risk of your site being compromised.
Finding this issue, I’ve granted all necessary permissions for the plugins to always stay up to date and have re-enabled auto-updates.
What WordFence could do is check for the permissions and then send a notification stating the 2 options I have posted — either removing the permissions to harden the site and then follow the manual update method, or enable the permissions with auto-update.
Thanks for the feedback. I’ve taken note for the team. I’ll resolve the case here; however, if you continue to see any errors or issues after granting DROP priviliges, please let us know.
Thanks,
Scott
