percussivemaintenance

While they could clear the data in that table, or find a method to make it a view-like table from MS SQL instead, dropping it is the quickest and easiest method. DROP permissions aren’t as much of a security risk these days. In the early days of the Internet and WordPress, it was common for the “thugs” of the Internet to just deface a website or drop the tables causing significant damage.

These days the threat actors are injecting malware into the site, which uses the standard permissions like INSERT which are required for WordPress to be usable.

Removing permissions like DROP, CREATE, ALTER, etc. and then manually updating the plugins is one way to tackle it. With how quickly vulnerabilities are being targeted by threat actors as AI is facilitating these attacks, this leaves you a larger security risk of your site being compromised.

Finding this issue, I’ve granted all necessary permissions for the plugins to always stay up to date and have re-enabled auto-updates.

What WordFence could do is check for the permissions and then send a notification stating the 2 options I have posted — either removing the permissions to harden the site and then follow the manual update method, or enable the permissions with auto-update.