Security Update

THP Studio
(@thpstock)

2 years, 1 month ago

Hey,

Will there be a release very soon to fix the security issue that was publicly published on Jan 30?

Thanks.

Viewing 6 replies - 1 through 6 (of 6 total)

Plugin Author mandsconsulting
(@mandsconsulting)

2 years, 1 month ago

Hello,

Can you please provide more details about this security issue?

Thanks,

Thread Starter THP Studio
(@thpstock)

2 years, 1 month ago

Hi,

Sure, you can see it published in a number of places:

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/email-before-download/email-before-download-697-cross-site-request-forgery

https://patchstack.com/database/vulnerability/email-before-download/wordpress-email-before-download-plugin-6-9-7-cross-site-request-forgery-csrf-vulnerability

And as far as I can see it affects the current version.

Thanks.

Plugin Author mandsconsulting
(@mandsconsulting)

2 years, 1 month ago

Thank you for informing us. We are going to work on resolving this.

Thanks,

Thread Starter THP Studio
(@thpstock)

2 years, 1 month ago

Thanks for the update, please let me know as soon as it is fixed.

Thank you.

Thread Starter THP Studio
(@thpstock)

2 years ago

Hi,

Any updates on fixing this vulnerability?

Thanks.

Plugin Author mandsconsulting
(@mandsconsulting)

1 year, 11 months ago

Hello,

We investigated the vulnerability issue and are complying with all of the wordpress standards. Our plugin is built on top of the CF7 form, so mentioning these vulnerabilities to them as well may be beneficial. The vulnerabilities that were linked were provided from a 3rd party website we do not have full access to. If you have more information about this vulnerability and want to collaborate please let us know. Our initial investigation turned up no vulnerabilties on our side of the application.

Viewing 6 replies - 1 through 6 (of 6 total)

The topic ‘Security Update’ is closed to new replies.