Plugin Author
YARPP
(@jeffparker)
There is no known vulnerability at the moment. Can you please elaborate?
Thread Starter
John
(@dsl225)
I think normally they try to send you some sort of notification that they’ve found a vulnerability, but given what I saw on the Patchstack site, that notification would likely appear to be spam if you didn’t know what it was.
They want you to sign up for their service as a plugin developer/owner and claim ownership of the plugin. Then they’ll provide the details of the vulnerability and, once you’ve fixed it, verify the vulnerability is gone and mark it as fixed.
They pay people to find vulnerabilities. They verify the vulnerabilities and then publish them. And the Solid Security plugin (which I also use) subscribes to their service.
Sounds like it’s an actual vulnerability though.
Good luck!
We have WP Defender, it’s reporting this:
—
CVSS Score 5.3
WordPress Yet Another Related Posts Plugin (YARPP) plugin <= 5.30.10 – Broken Access Control vulnerability
-Vulnerability type: Broken Access Control
-No Update Available
—
A fix would be greatly appreciated!
-
This reply was modified 1 year, 6 months ago by
kevinbrands.
-
This reply was modified 1 year, 6 months ago by kevinbrands.
-
This reply was modified 1 year, 6 months ago by kevinbrands.
another request to patch the current vulnerability, I received a message from my host last week saying it needed to be deactivated because no patch was available.
Moderator note: NO MORE “ME, TOO” TOPICS.
If you want to follow this topic, click “subscribe” on the right.
Plugin Author
YARPP
(@jeffparker)
Hello everyone,
We have been tracking progress of this bug over at this thread – https://wordpress.org/support/topic/update-713/
UPDATE: New version with patch is live! Please update to version 5.30.11 or newer.
https://wordpress.org/plugins/yet-another-related-posts-plugin/#developers
We have notified Patchstack (reporter of bug). They should mark this as resolved soon, which then should make its way to Wordfence and others.
In case you were not following along the other thread, there was zero risk as the “bug” was in a section of code that hasn’t been referenced or called for many years (dead code).
Thank you so much for your patience through this. Please update ASAP.
