{"id":18776771,"date":"2026-01-06T18:54:25","date_gmt":"2026-01-06T18:54:25","guid":{"rendered":"https:\/\/wordpress.org\/support\/topic\/plugin-security-issues-2\/"},"modified":"2026-01-06T18:54:25","modified_gmt":"2026-01-06T18:54:25","slug":"plugin-security-issues-2","status":"publish","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/plugin-security-issues-2\/","title":{"rendered":"Plugin security issues"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Hi,<br \/><br \/>We are evaluating the plugin and did a quick code quality review as of version 1.1.93.<br \/>Could you advise on the following items?<br \/><br \/><strong>1. SSL Verification disabled on remote requests<\/strong><br \/>We found multiple wp_remote_get(\u2026, [&#8216;sslverify&#8217; =&gt; false]) calls when downloading labels and<br \/>other resources. This is a potential security risk.<br \/>Why is SSL verification disabled?<br \/><br \/><strong>2. Remote downloads using file_get_contents()<\/strong><br \/>We saw file_get_contents($file_url) used to download remote label files (no WP HTTP API,<br \/>timeouts, or error handling).<br \/>Can this be replaced with wp_remote_get() with explicit timeouts and safe handling?<br \/>Are the remote URLs always guaranteed to be ShipAny-owned\/whitelisted?<br \/><br \/><strong>3. Caching\/writes inside the plugin directory<\/strong><br \/>The plugin creates\/writes to wp-content\/plugins\/shipany\/cache and attempts mkdir(&#8230;,0777) \/ chmod(&#8230;).<br \/>Not sure that&#8217;s suitable for Bedrock\/Trellis projects where plugin directories are read-only. Not runtime storage. The permission choices are also questionable.<\/p>\n","protected":false},"template":"","class_list":["post-18776771","topic","type-topic","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/18776771","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/18776771\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=18776771"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}