wp2shell: more than a month later. Confirm 6.8.6, 6.9.5, 7.0.2. Patched is not clean.

Read the advisory

Changelog

2020.

Release notes from 2020.

v5.113

minor

MySQL no longer creates database tables with "MyISAM" as the engine. Uses the site default config…

Fixed

  • MySQL no longer creates database tables with "MyISAM" as the engine. Uses the site default configuration. Thank you Kien.
  • "Test this IP" did not work correctly with IP ranges. Thank you Justin.
  • Rewrote Core Scanner module - now works faster and loads data without reloading the entire page via AJAX.
  • Core Scanner module - now works faster and loads data without reloading the entire plugin page. Improved user interface.

Notes

  • xxx,xxx downloads

v5.112

minor

Check for Application Password feature introduced in WP 5.6 · Enable/disable the Application Password feature (Pro)

New

  • Check for Application Password feature introduced in WP 5.6
  • Pro Enable/disable the Application Password feature (Pro)

Fixed

  • PHP notice when downloading and saving vulnerability list.
  • PHP notice when downloading and saving vulnerability list.

Notes

  • xxx,xxx downloads
  • Tested with WordPress 5.6

v5.111

minor

Freemius to 2.4.1 and other 3rd party libraries.

Improved

  • Freemius to 2.4.1 and other 3rd party libraries.

v5.110

minor

Fixes page - Enable/disable security features on your website. · Set Security Headers values on "Fixes" page.

New

  • Fixes page - Enable/disable security features on your website.
  • Set Security Headers values on "Fixes" page.
  • Hide PHP Version and Server info.
  • Import/Export all "Fixes" settings.

Improved

  • user interface, made changes to colors and layout.

Notes

  • Tested up to WP 5.5.1
  • xxx,xxx downloads
  • Further work on PHP compatibility - Thank you Barry.

v5.109.1

patch

Further work on PHP compatibility - Thank you Barry.

Notes

  • Further work on PHP compatibility - Thank you Barry.
  • xxx,xxx downloads

v5.109

minor

Minor error showing last blocked logins in sidebar.

Improved

  • 3rd party libraries for better PHP compatibility.
  • 3rd party libraries for better PHP 7.4 compatibility.

Fixed

  • Minor error showing last blocked logins in sidebar.
  • Check for wp-config permissions (chmod) failed if the file had been moved. Thank you Mk.
  • Wrongly saying "Vulnerabilities found" eventhough no vulns were found.
  • Loading outdated plugin list from file instead of from database - caused problem on some servers.
  • Nginx example corrected for "Referrer-Policy" from "no-referrer" to the correct "same-origin". Thank you Mk.
  • Nginx example corrected for "Feature-Policy" security header. Thank you Mk.
  • "Secure the site" showing up multiple places on plugins page in admin.

Notes

  • xxx,xxx downloads
  • Improvement - Better instructions on how to change weak database passwords and removing the autofixer.
  • Minor cleanup in logging routines.

v5.108.2

patch

Nginx example for "Feature-Policy" security header. Thank you Mk.

Fixed

  • Nginx example for "Feature-Policy" security header. Thank you Mk.
  • Nginx example corrected for "Feature-Policy" security header. Thank you Mk.
  • "Secure the site" showing up multiple places on plugins page in admin.
  • Nginx example corrected for "Referrer-Policy" from "no-referrer" to the correct "same-origin". Thank you Mk.

Notes

  • Improvement - Better instructions on how to change weak database passwords and removing the autofixer.
  • Minor cleanup in logging routines.

v5.108.1

patch

BETA - WILL 5.109 .

Improved

  • 3rd party libraries for better PHP 7.4 compatibility.

Fixed

  • Loading outdated plugin list from file instead of from database - caused problem on some servers.
  • Wrongly saying "Vulnerabilities found" eventhough no vulns were found.
  • Check for wp-config permissions (chmod) failed if the file had been moved. Thank you Mk.
  • Minor error showing last blocked logins in sidebar.

Notes

  • BETA - WILL 5.109 ..

v5.108

minor

"Secure this site" link under all plugins. Thank you Mk.

Fixed

  • "Secure this site" link under all plugins. Thank you Mk.
  • Opening up welcome page for all new plugin installations.

Notes

  • Tested WP 5.5 compatible.
  • More details in Firewall for "Hide login errors".
  • Updating jQuery code due to changes to WordPress 5.5
  • xxx,xxx downloads
  • More detailed description in Firewall for "Hide login errors".

v5.107

minor

Turn login form protection on or off. Thank you Mk. · Block login error messages. Thank you Mk.

New

  • Turn login form protection on or off. Thank you Mk.
  • Block login error messages. Thank you Mk.
  • Introducing check for outdated plugins - not updated in 5+ years.
  • Greatly improved speed in plugin admin pages.
  • Feature added - Block login error messages.
  • Added warning on WooCommerce login form.

Improved

  • Freemius SDK to 2.4.0

Fixed

  • The warning "Vulnerabilities found on your system!" was shown even if there were no vulnerabilities detected.
  • The warning "Vulnerabilities found on your system!" was shown even if there were no vulnerabilities detected. Thank you all who reported this issue.
  • Improved loading speed in plugin admin pages.
  • Loading speed for the Database Optimizer tab greatly improved.
  • PHP notice when testing for "headers contain detailed PHP version info.".
  • Improved loading speed in plugin admin pages in general.

Notes

  • xxx,xxx downloads
  • General code cleanup.

v5.106

minor

Tests - Filter "untested" - tests not run yet.

New

  • Tests - Filter "untested" - tests not run yet.

Fixed

  • Tests - Fixed bug in getting permissions for WP config file.
  • Whitelabel - removed plugin name showing up under debug info. Thank you Jay.

Notes

  • Layout improvements - fixing visual bugs.
  • Moved vulnerability check to every 24 hours.
  • Firewall: Added option to immediately block any attempts to log in with username "admin".
  • Firewall: Fixed bug with setting limits for failed logins in admin.
  • PHP 7.4 compatibility check
  • Code cleanup.

v5.105

minor

Compatibility with Yoast SEO - Thank you Thomas ;-)

Improved

  • language files.

Fixed

  • Compatibility with Yoast SEO - Thank you Thomas ;-)
  • PHP warning - undefined index - Thank you Mariusz.

Notes

  • Improvement - Loading of JS and CSS files.
  • Improvement - Loading of JS and CSS files in Firewall module.

v5.104

minor

visitor log pruning - Keep the visitor log size down. Customizable interval and you can also turn off firewall loggin…

New

  • visitor log pruning - Keep the visitor log size down. Customizable interval and you can also turn off firewall logging entirely.
  • Added vulnerability testing for installed themes.
  • Added vulnerability count to the menu.
  • Added visitor log pruning - Keep the visitor log size down. Customizable interval and you can also turn off firewall logging entirely.
  • Dismiss warnings for 24 hours directly in warning text.
  • Dismiss vulnerability warnings for 24 hours directly in warning text.
  • Plugin translated to Bulgarian - Thank you Valentin!
  • Dismiss vulnerability warnings for 24 hours directly in warning notice.
  • missing Nginx examples for username enumeration. Thank you Fahmi.

Fixed

  • Scheduled Scanner results - Broken results for "Core Scanner" - Thank you Mk.

Notes

  • Cleanup code
  • More options for how often to send email notifications in event logger - Thank you Mk.
  • Code cleanup.

v5.103

minor

malware scanner patterns - Thank you Cathal for submitting sample.

Improved

  • malware scanner patterns - Thank you Cathal for submitting sample.
  • Showing when malware patterns were last updated on malware page.
  • Showing when malware patterns were last updated on malware tab.

Fixed

  • Layout of suggestions under "Details" were improved.
  • Bug where results for "Check if active plugins are compatible with your version of WP" were empty - Thank you @lsbk

Notes

  • xxx,xxx downloads

v5.102

minor

more user agents to block - Thank you Laurent.

New

  • more user agents to block - Thank you Laurent.

Improved

  • list of vulnerable plugins.

Fixed

  • bug with importing settings - Thank you Thomas.

Notes

  • Tested up to newly released WP 5.4.1

v5.101

minor

Downgrade IP2location library to 8.1.1 - Fixes problem with library requiring PHP 7.1

Notes

  • Downgrade IP2location library to 8.1.1 - Fixes problem with library requiring PHP 7.1

v5.100

minor

Removed syslog logging to file. Many users had problems with the

Improved

  • welcome page for new installations.
  • layout on settings page, fixing markup mistakes.
  • language files.

Fixed

  • Removed syslog logging to file. Many users had problems with the

Notes

  • xxx,xxx downloads
  • Code cleanup and security hardening.

v5.99

minor

Nginx examples to security headers - Thank you Dzul.

New

  • Nginx examples to security headers - Thank you Dzul.

Notes

  • xxx,xxx downloads
  • PRO: Event logging can now be turned on and off - Thank you Matt.
  • Security hardening.

v5.98

minor

name to vulnerability warning. · warning to "Check if database table prefix is the default one" test - Thank you Martin.

New

  • name to vulnerability warning.
  • warning to "Check if database table prefix is the default one" test - Thank you Martin.

Notes

  • Security hardening the automatic fixers.
  • xxx,xxx downloads
  • Reworked the fix for changing database table prefix. Thank you Martin.

v5.97

minor

a link to the welcome page in the sidebar. · a link to the welcome page in the sidebar if you want to view it.

New

  • a link to the welcome page in the sidebar.
  • a link to the welcome page in the sidebar if you want to view it.

Fixed

  • The "filter test by status" not working properly if status changed. If you ran a test, fixed a failed test and ran again, the test would not show up the right place.
  • Removed the "pointer" introducion in favor of the new "welcome page" for new users.
  • The "filter test by status" not working properly if status changed. If you ran a test, fixed a failed test and ran again, the test would not change status.

Notes

  • xxx,xxx downloads
  • Vulnerabilities: More details for each vulnerability.

v5.96

minor

Quick filter tests - Failed tests, tests with warnings or those tests that are OK. · Quickly see how many vulnerabili…

New

  • Quick filter tests - Failed tests, tests with warnings or those tests that are OK.
  • Quickly see how many vulnerabilities you have in the tab view.

Improved

  • admin view layout and styling.

Fixed

  • PHP Notice in some cases - Thank you Mike :-)

Notes

  • xxx,xxx downloads
  • Vulnerabilities - Easier to visually scan recommendations - hiding clutter in interface.

v5.95

minor

more details to the wp-config.php test - Thanks @lsbk.

New

  • more details to the wp-config.php test - Thanks @lsbk.

Notes

  • Work on following WordPress Coding Standards.
  • Minor change in the WP constants test.
  • Moved the malware definitions API to a faster location.
  • Code cleanup.
  • Plugin has been tested up to WordPress 5.4

v5.94

minor

Security Tests - Fixed the test for wp-config.php file permissions - thank you @lsbk :-)

Improved

  • language files.

Fixed

  • Security Tests - Fixed the test for wp-config.php file permissions - thank you @lsbk :-)

Notes

  • Security hardening.
  • xxx,xxx downloads
  • Work on following WordPress Coding Standards.

v5.93

minor

Fatal error happened in some situations - "Call to undefined method".

Improved

  • the welcome page.

Fixed

  • Fatal error happened in some situations - "Call to undefined method".

v5.92

minor

Plugin onboarding - welcome page for new users.

New

  • Plugin onboarding - welcome page for new users.

Fixed

  • PHP notice when blocking some visitors.

Notes

  • Security hardening and working on WordPress coding standards.

v5.91

minor

Vulnerability warning did not load properly on all admin pages.

Improved

  • language files.

Fixed

  • Vulnerability warning did not load properly on all admin pages.
  • "Thank you for installing" pointer was reset when updating. Thank you Thomas for helping getting this fixed.

Notes

  • xxx,xxx downloads
  • Code cleanup.

v5.90

minor

more dangerous filenames to look for. · Sitewide warnings for when vulnerabilities are detected. Can be dismissed for…

New

  • more dangerous filenames to look for.
  • Sitewide warnings for when vulnerabilities are detected. Can be dismissed for 24 hours.
  • Sitewide warnings for when vulnerabilities are detected. Warnings can be dismissed for 24 hours.

Notes

  • More code refactoring to follow WordPress Standards.
  • xxx,xxx downloads
  • Security Tests: Added more dangerous filenames to look for.

v5.89

minor

xxx,xxx downloads

Notes

  • xxx,xxx downloads
  • Refactoring code to better follow WordPress Standards.
  • Code cleanup - Removing unused code.

v5.88

minor

Quick overview Dashboard Widget - Get a quick overview of your security status.

New

  • Quick overview Dashboard Widget - Get a quick overview of your security status.

Improved

  • language files.

Fixed

  • Cloud Firewall - Error saving GeoIP in WordPress Multisite configuration. Thank you Roy.

Notes

  • xxx,xxx downloads
  • Improvement - Load required composer component libraries with a unique namespace to prevent clashes with other plugins including same libraries.

v5.87

minor

Test for "Referrer-Policy" security header. Thank you Jonathan. · Test for "Feature-Policy" security header. Thank yo…

New

  • Test for "Referrer-Policy" security header. Thank you Jonathan.
  • Test for "Feature-Policy" security header. Thank you Jonathan.

Improved

  • language file.

Fixed

  • Typos in some of the security header test descriptions and details.
  • The instructions to completely disable XML-RPC was wrong, thank you Ivan for spotting this!
  • Not using whitelabel name in emails.
  • Not using whitelabel name in emails. Thank you Ivan.
  • Only load pointers if the whitelabel feature is not enabled. Thank you Ivan.

Notes

  • xxx,xxx downloads
  • Tightening and optimizing code.

v5.86

minor

test - Check if the debug.log file exists and advice how to block it. · Check if the debug.log file exists and advice…

New

  • test - Check if the debug.log file exists and advice how to block it.
  • Check if the debug.log file exists and advice how to block it.
  • Check if the REST API is enabled. Thank you Cuong.
  • More details if a test fails about what went wrong.

Fixed

  • If opening details window about a test and the test have not been run yet, the spinner stayed looping forever.
  • Not removing all settings when deactivating the plugin.
  • Some completed tests might have extra details and they were missing.

Notes

  • xxx,xxx downloads
  • Typo - "incompatibile" -> "incompatible".

v5.85

minor

See when last time a test was run and for how long when you click corresponding "Details" button.

New

  • See when last time a test was run and for how long when you click corresponding "Details" button.

Notes

  • Improvement: Do not remove settings when deactivating plugin temporarily, remove when uninstalling plugin. Thank you Cuong.
  • Improvement: Added polyfill for BC Math PHP extension which might not be installed per default in all server configurations.

v5.84

minor

firewall country blocking to work with IP2Location, replacing MaxMinds GeoLite2.

Improved

  • firewall country blocking to work with IP2Location, replacing MaxMinds GeoLite2.

Fixed

  • Export tool blocked when username enumeration block was enabled. Thank you Cuong.
  • Updated firewall country blocking to work with IP2Location, replacing MaxMinds GeoLite2.
  • Minor warnings in HTML output on Whitelabel tab.
  • WordPress Export tool blocked when username enumeration block was enabled. Thank you Cuong.

Notes

  • xxx,xxx downloads
  • Complete test overwrite - You can now select individual tests to run + no
  • Testing: Complete test overwrite - Testing is much faster now.
  • Testing: You can now select individual tests to run.
  • Testing: Live updates, no page refresh needed.
  • Testing: Security test rewrite - Testing is much faster now.

v5.83

minor

email template for issues with Outlook email rendering.

New

  • email template for issues with Outlook email rendering.

Fixed

  • wording in the two tests for the Shellshock bug. Thank you Ivan.

Notes

  • xxx,xxx downloads

v5.82

minor

Vulnerability scanner: Improved recommendation and visuals

Notes

  • Vulnerability scanner: Improved recommendation and visuals
  • xxx,xxx downloads
  • Vulnerability list now also checks WordPress version and shows known vulnerabilities.
  • Vulnerability scanner: Improved recommendations and visuals.

v5.81

minor

Vulnerabilities module.

Improved

  • Vulnerabilities module.

v5.80

minor

xxx,xxx downloads

Improved

  • dependencies, Monolog 1.25.1 -> 1.25.3 and psr 1.1.0 -> 1.1.2

Notes

  • xxx,xxx downloads
  • Introducing Vulnerabilities checking for all users. This module keeps an eye on known vulnerable plugins on your site and warns you if there is a potential problem.

v5.79

minor

Activation bug. Errors could occur and these would be logged to the database. This would fail if…

Fixed

  • Activation bug. Errors could occur and these would be logged to the database. This would fail if it happens before the tables were actually created. Thank you Cuong.
  • Whitelabel feature created a double plugin listing. Thank you Cuong and Jay.

v5.78

minor

Improvements to feature "dangerous files in your root folder" - Easier overview - added checks fo…

Improved

  • license and account system Freemius SDK to version 2.3.2

Fixed

  • Activation bug. Errors could occur and attempt to be logged to the database, fail if it happens before the tables were actually created.
  • Whitelabel feature created a double plugin listing. Thank you Cuong and Jay.

Notes

  • Improvements to feature "dangerous files in your root folder" - Easier overview - added checks for more unwanted files
  • Better details on privacy and data sharing when you activate plugin.
  • Enriched opt-in and license activation forms.

Install the free plugin on WordPress.org, or go Pro for cloud firewall, malware scanning, and agency tools.

Free on WordPress.org Get WP Security Ninja Pro

Larger screenshot

Enlarged image