5 ms·

Blog post on wordpress.org concerning this: https://wordpress.org/news/2024/10/secure-custom-fields/ https://wordpress.org/news/2024/10/secure-custom-fields/

righthand 2y ago
> There is separate, but not directly related news that Jason Bahl has left WP Engine to work for Automattic and will be making WPGraphQL a canonical community plugin. We expect others will follow as well. Anything to prop up their position and throw the company they are attacking under the bus. What a jerk.
- None4U 2y ago
  Which, by the way, previously ended with "We expect others will defect as well." before the post was edited
  - righthand 2y ago
    Not surprised. What scum.
0cf8612b2e1e 2y ago
This is a rare and unusual situation brought on by WP Engine’s legal attacks, we do not anticipate this happening for other plugins. Yeah, that is not how trust works.
smarx007 2y ago
> This update is as minimal as possible to fix the security issue. What is the actual issue? CVE number?
- kristofferR 2y ago
  I think they mean that it's developed by WP Engine and that's the security issue.
- Sebguer 2y ago
  Details haven't been made public yet: https://www.cve.org/CVERecord?id=CVE-2024-9529 https://www.cve.org/CVERecord?id=CVE-2024-9529 Though, Automattic posted publicly that there was a vulnerability shortly after filing the CVE, while simultaneously blocking WPEngine from being able to push a fix to it because they'd cut off access to wp.org
  - FireBeyond 2y ago
    I wonder how many Automattic resources Matt threw at ACF to find a vulnerability to catalyze this situation?
    - ImPostingOnHN 2y ago
      Same, I was imagining Gavin Belsom and his warehouse full of Hooli employees scouring over the Pied Piper demo. Similarly, this is all to resolve the personal grudge of an exceedingly rich dude who wants even more money.
- mananaysiempre 2y ago
  I can’t find the actual number because Automattic’s tweet[1] announcing it has been deleted, but it’s the one mentioned in the ACF 6.3.8 release notes[2]. The authors of ACF can’t upload that version to wordpress.org themselves because Matt banned them from there before making the announcement. ETA: Matt says[3] it’s a different vulnerability. Anybody willing to break out the almighty diff? [1] Discussed at the time: https://news.ycombinator.com/item?id=41752289 https://news.ycombinator.com/item?id=41752289 [2] https://www.advancedcustomfields.com/blog/acf-6-3-8-security-release/ https://www.advancedcustomfields.com/blog/acf-6-3-8-security... [3] https://news.ycombinator.com/item?id=41821829 https://news.ycombinator.com/item?id=41821829
- jorams 2y ago
  The diff contains two (identical) changes that aren't just ripping out upgrade notices for the pro version: Two functions that stop callbacks from accessing $_POST now also stop them from accessing $_REQUEST, which also contains everything in $_POST. Also confirmed by WP Engine's update notice[1]. I honestly don't see why anyone would treat this as a security issue. Everything involved is PHP code that can do whatever it wants, not in any kind of sandbox. Edit: And even if it were this update doesn't fix the problem. POST variables can still be accessed: filter_input(INPUT_POST, 'name'); [1]: https://www.advancedcustomfields.com/blog/acf-6-3-8-security-release/#changelog https://www.advancedcustomfields.com/blog/acf-6-3-8-security...
hadad 2y ago
The support notice got deleted[1]. The plugin developer got banned. Blocking access from certain ip. Shady or problematic hosting term[2]. I think hosting your code on wordpress.org is considered dangerous. 1. https://wordpress.org/support/topic/future-updates-for-acf-are-available-through-their-website/ https://wordpress.org/support/topic/future-updates-for-acf-a... 2. https://github.com/wordpress/wporg-plugin-guidelines/blob/trunk/guideline-18.md https://github.com/wordpress/wporg-plugin-guidelines/blob/tr...
deleted 2y ago
[deleted]

righthand 2y ago

> There is separate, but not directly related news that Jason Bahl has left WP Engine to work for Automattic and will be making WPGraphQL a canonical community plugin. We expect others will follow as well. Anything to prop up their position and throw the company they are attacking under the bus. What a jerk.

None4U 2y ago
Which, by the way, previously ended with "We expect others will defect as well." before the post was edited
- righthand 2y ago
  Not surprised. What scum.

0cf8612b2e1e 2y ago

This is a rare and unusual situation brought on by WP Engine’s legal attacks, we do not anticipate this happening for other plugins. Yeah, that is not how trust works.

smarx007 2y ago

> This update is as minimal as possible to fix the security issue. What is the actual issue? CVE number?

kristofferR 2y ago
I think they mean that it's developed by WP Engine and that's the security issue.
Sebguer 2y ago
Details haven't been made public yet: https://www.cve.org/CVERecord?id=CVE-2024-9529 https://www.cve.org/CVERecord?id=CVE-2024-9529 Though, Automattic posted publicly that there was a vulnerability shortly after filing the CVE, while simultaneously blocking WPEngine from being able to push a fix to it because they'd cut off access to wp.org
- FireBeyond 2y ago
  I wonder how many Automattic resources Matt threw at ACF to find a vulnerability to catalyze this situation?
  - ImPostingOnHN 2y ago
    Same, I was imagining Gavin Belsom and his warehouse full of Hooli employees scouring over the Pied Piper demo. Similarly, this is all to resolve the personal grudge of an exceedingly rich dude who wants even more money.
mananaysiempre 2y ago
I can’t find the actual number because Automattic’s tweet[1] announcing it has been deleted, but it’s the one mentioned in the ACF 6.3.8 release notes[2]. The authors of ACF can’t upload that version to wordpress.org themselves because Matt banned them from there before making the announcement. ETA: Matt says[3] it’s a different vulnerability. Anybody willing to break out the almighty diff? [1] Discussed at the time: https://news.ycombinator.com/item?id=41752289 https://news.ycombinator.com/item?id=41752289 [2] https://www.advancedcustomfields.com/blog/acf-6-3-8-security-release/ https://www.advancedcustomfields.com/blog/acf-6-3-8-security... [3] https://news.ycombinator.com/item?id=41821829 https://news.ycombinator.com/item?id=41821829
jorams 2y ago
The diff contains two (identical) changes that aren't just ripping out upgrade notices for the pro version: Two functions that stop callbacks from accessing $_POST now also stop them from accessing $_REQUEST, which also contains everything in $_POST. Also confirmed by WP Engine's update notice[1]. I honestly don't see why anyone would treat this as a security issue. Everything involved is PHP code that can do whatever it wants, not in any kind of sandbox. Edit: And even if it were this update doesn't fix the problem. POST variables can still be accessed: filter_input(INPUT_POST, 'name'); [1]: https://www.advancedcustomfields.com/blog/acf-6-3-8-security-release/#changelog https://www.advancedcustomfields.com/blog/acf-6-3-8-security...

hadad 2y ago

The support notice got deleted[1]. The plugin developer got banned. Blocking access from certain ip. Shady or problematic hosting term[2]. I think hosting your code on wordpress.org is considered dangerous. 1. https://wordpress.org/support/topic/future-updates-for-acf-are-available-through-their-website/ https://wordpress.org/support/topic/future-updates-for-acf-a... 2. https://github.com/wordpress/wporg-plugin-guidelines/blob/trunk/guideline-18.md https://github.com/wordpress/wporg-plugin-guidelines/blob/tr...

deleted 2y ago

[deleted]