chargeup

I already updated to the latest version and I’m still having that folder fill up with malware. I’ve had to clean up that folder a few times. Is it possible that you may have missed another spot in the plugin that is vulnerable?

I’ll keep an eye on it and let you know when it happens again. Everything on the site is up-to-date.

I just reposted the original issue above for you to look into. The other issue with Astra Pro is separate and I didn’t think it needed to be mentioned here in the plugin thread.

The Astra Pro thing a separate issue, but it also deals with that “Cannot modify header information – headers already sent by (output started…” error. That issue is obviously pulling from a file within that other plugin.

I just reshared the Custom Fonts error in the prior message to make sure you saw it and are aware of it.

Don’t take this the wrong way but Brainstorm Support is very frustrating and unfortunately I don’t have the energy or patience to work on another support issue with you. It takes weeks and weeks of deflecting the issue on another plugin or theme (even though I will show proof with everything deactivated that it’s coming from your product), telling me nothing is showing on your end and you are unable to replicate, then finally after weeks admitting there actually is an issue. At that point it could take months for a fix to actually be rolled out (if ever).

I have 4 open tickets with you with and when I ask for updates I get “Our developers are working on the issue. Thanks for you patience.” This typically goes on for weeks at the minimum, but usually much longer.

I do see another post for this exact same issue. Hopefully they have given you enough information to solve this

• This reply was modified 2 years, 8 months ago by chargeup.

I’ve had a ticket out for this issue since May. They are aware of the problem, but have yet to release a fix.

Since the new error has to do with Custom Fonts that’s why I’ve posted a new ticket here

Yeah I’ll reach out over there. Just to give you a heads up, Brainstorm has almost the exact same error on another product of yours that you have known about for the better part of 8 months and have yet to apply a fix for.

I’ll put in a ticket for this plugin and hopefully you will be able to apply a fix sooner than later since these errors are pretty unsightly,

• This reply was modified 2 years, 8 months ago by chargeup.

Thanks and that’s great!

If you don’t mind me asking what exactly is the issue?

From my testing it is definitely spam bots causing it. I’ve been able to watch them hit the form and the timestamp is the same. They are somehow able to bypass the required field for that particular First/Last Name field and it is coming in empty. How they are able to bypass the required field and what they are trying to submit I am unsure of though.

Thanks for the help on this.

I am fairly confident the notices I’ve shared have absolutely nothing to do with the deprecation notices you are showing me from Astra. Those, while there, seem to be separate from what is occurring with your plugin.

I can check access logs and look at time stamps for when users (might be bots or spam) are triggering the warning. They are lining up.

I am also get the same WPForms warnings from 3 different themes I’m using so I can rule out it being a theme issue.

I’ve turned on logging. Hopefully this will give me something to work with.

I’d also take a look at the link I sent to the same issue to see if you can see what was causing the same notice and try and reproduce the error that way. Just thinking out loud.

I’ve downloaded the form. However, it doesn’t look like there is a way to upload the json file here. Any suggestions?

My apologies. I actually pulled that from a staging site using 1.7.8. The code snippets are the same. 508 in that version is the exact same as line 526 & 530 in 1.8.1.3.

I’m not sure your assessment of it being a theme or plugin issue is accurate. I know this is a pretty common response from every theme and plugin author I’ve used. I use WPForms on all types of sites with different themes and plugins. I have gotten the same warnings for quite some time across pretty much all of my sites.

May or may not be a similar issue but here is another user who reported a similar bug from a different file about 2 years ago. You found the issue on that file so might be worth taking a deeper look.

https://wordpress.org/support/topic/warnings-logged-illegal-string-offset-primary-in-class-email-php/