WP Manifestindependent plugin directory
manifest / security / wordpress-plugin-security-protection

Markei.nl WordPress Security & Protection WP RegistryMedium-severity findings · 2 findingsOpen the reportB

Security & protection improvements: login event history, prevent login brute force, hide backend, update status API

by Markei.nl · github.com/markei/wordpress-plugin-security-protection · website

★ 0stars
476composer installs
v1.5.1latest · 3 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/markei/wordpress-plugin-security-protection/archive/refs/heads/master.zip

On Packagist as markei/wordpress-security-protection:

composer require markei/wordpress-security-protection
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/markei/wordpress-plugin-security-protection ↗

Markei Security and Protection

Install the plugin via Composer

composer require markei/wordpress-security-protection

Activate the plugin in WordPress admin

Add the next two lines to wordpress/wp-config.php above require_once(ABSPATH . 'wp-settings.php');

define('MARKEI_SECURITY_PROTECTION_HIDEBACKEND_URL', '/my-secret-cms');
define('MARKEI_SECURITY_PROTECTION_UPDATEINFO_SECRET', 'super-secret-key');
define('MARKEI_SECURITY_PROTECTION_BLOCKXMLRPC', true);

Replace /my-secret-cms with an URL you like. Do not use my-secret-cms, wp-admin or wp-login! Mention the slash in the beginning. Replace super-secret-key with a random long value.

Log out and use your new URL to relogin.

The API for update status report is located at http://www.my-wordpress.tld/.markei/security-and-protection/update-state?secret=super-secret-key

Releases

7 releases.

Tag
Published
v1.5.1 latest
May 7, 2023 3 years ago
v1.5.0
May 5, 2023 3 years ago
v1.4.0
Jan 4, 2021 5 years ago
v1.3.0
Mar 10, 2019 7 years ago
v1.2.0
Jan 18, 2018 8 years ago
v1.1.0
Jan 9, 2018 8 years ago
v1.0.0
Dec 28, 2017 8 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Markei.nl WordPress Security & Protection 1.0.0 · audited by WP Registry

Medium-severity findings.

1 medium 1 low
Audited release
1.0.0
Findings
2
Worst severity
medium
Content hash
101cdd7794d5bb26375121ce…

Findings

  • medium Open redirect on hide-backend unlock URL via target parameter

    unsafe_input

    When MARKEI_SECURITY_PROTECTION_HIDEBACKEND_URL is configured, visiting that path with target and check=sha1(NONCE_SALT.target.NONCE_SALT) calls wp_redirect($_GET['target']). Anyone who can compute the HMAC (requires NONCE_SALT) or who obtains a legitimate unlock link can redirect users to an arbitrary external URL. The target is also reflected in HTML without escaping if redirect headers fail.

    markei-security-protection.php:75-95

    Recommendation

    Allowlist redirect targets to same-site paths; use wp_safe_redirect and esc_url on any echoed URL.

  • low Update-state JSON endpoint gated only by shared secret in query string

    information_disclosure

    When MARKEI_SECURITY_PROTECTION_UPDATEINFO_SECRET is defined, GET /.markei/security-and-protection/update-state?secret=... dumps core/plugin update inventory. Secret-in-URL risks leakage via logs/Referer; comparison is timing-unsafe string equality.

    markei-security-protection.php:107-117

    Recommendation

    Prefer Authorization header + hash_equals; avoid putting secrets in query strings.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →