2018
-
Disclosure: SQL Injection in Cart66 Pro
Apr 6
Last month I discovered a critical SQL injection vulnerability in the no-longer-developed yet still actively used Cart66 Pro plugin for WordPress. Here are the details …
-
Introducing Secure Updates for WordPress
Feb 26
Today I introduce the a new plugin that provides secure updates for WordPress: DGXPCO.
2014
-
WordPress 4.1 Includes a Session UI
Nov 14
My attempts to build a session UI over the weekend failed. My attempt to build one during a team hackathon was sidelined so we could focus on, what seemed at the time, far more interesting code. Now, though, I can jump on board with the new session UI being merged into WordPress 4.1!
-
WordPress, Security, and Member Management
Oct 15
If you’re logging in to WordPress as an administrator just to write a post, you’re doing it wrong.
-
Interesting Hacking Attempts
Aug 11
When someone hacks a plugin or theme, it’s bad. When someone hacks the foundation of those systems (WordPress), it’s worse. When someone hacks the base upon which WordPress is built (Apache, Nginx, or whatever server you use), it’s tragic.
-
WordPress Core Proposal: Session Management
Aug 6
When you log in to WordPress, the platform should record the event, where it occurred from, and the device that was used. This would empower you to kill off rogue sessions if necessary.
-
WordPress and Password Hashing
Apr 21
WordPress’ password creation/verification system is pluggable (meaning you can replace it with your own implementation). Before you do so, though, you should understand what’s already implemented and why.
-
Why Showing The WordPress Username Is A Security Risk
Apr 4
There have been a handful of discussions lately surrounding WordPress and usernames – particularly whether or not exposing usernames is a security risk. The consensus appears to be “no.” I beg to differ.
-
WordPress Core Proposal: SUDO
Jan 8
Logging in to your WordPress site as an administrator when your plan is just to write is a bad idea. The admin user should be for administration and you should use an editor-level user for writing. But this dual-login workflow can be needlessly complicated on many sites. Instead, I propose we introduce a SUDO mode…
-
Photon and HTTPS – Making It Work
Jan 5
Jetpack’s Photon service doesn’t like it when image assets are served over SSL. I took some time to dig in to the issue and coded a quick workaround to enable Photon on a site locked down to serve all assets over SSL.