Day: March 31, 2021

wp_create_nonce does not secure you against CSRF or XSRF

Author wefightforsecurityPosted on March 31, 2021March 31, 2021Categories csrf, wordpress functions security, wp securityTags , , , , , , ,

What is wp_create_nonce and what is it for?

wp_create_nonce is a function for theme and plugin developers using WordPress. The majority of developers understandably believe this secures their forms from cross site request forgery, unfortunately it doesn’t. WordPress is great at making functions for developers that any reasonable person would believe has security built-in. When it comes to WordPress that isn’t the case.

How do I secure forms from hackers?

wp_create_nonce is a good starting point, but you have to use wp_verify nonce, to validate that the form protection against CSRF will actually work. If you just do wp_create_nonce, it is like putting a lock on a door, with tape, that anyone can remove. When you use wp_verify_nonce in your code, it is like properly securing the lock, which should’ve happened in the first place.

Why should my forms be secure against CSRF & hackers?

Forms interact with the users database, and many admin forms don’t prevent from malicious content being submitted. So, an attacker could inject their own malicious code, damage your site, or do anything they want as that user.

Now I can hear you rolling your eyes and saying CSRF isn’t a problem, because it requires a logged in developer to go to a malicious site. That isn’t true, yes, it requires a logged in developer going to a site, but it doesn’t have to be one that is inherently malicious. Also, interaction isn’t required, if you properly automate things. Their site can be attacked while they look at a picture or play a game. It is deceptively easy to misuse insecure forms. While CSRF isn’t as bad as sql injections or how most developers use is_admin(), it certainly needs to be secured.

In conclusion, secure all your code.

What is a SQL Injection? Is My Site safe?

Author wefightforsecurityPosted on March 31, 2021March 31, 2021Categories sql injections

What is a SQL injection?

A sql injection put simply is when someone injects their own code or information into your site or apps database. The way this happens is usually due to a vulnerable piece of code that didn’t put in security measures around the interaction allowed with the database.

What is a database?

A database stores everything you write, all your images, everything. Personal information including usernames, and any personally identifying information is stored there.

How do I know if my site can be hacked with a sql injection?

If you aren’t a developer and don’t know how to read code, the short answer is you don’t know. Many developers tell you everything is secure, when it certainly most isn’t. 3rd party companies like ourselves are able to check the security of your site for you and coordinate with the developers to make it more secure.

Do sql injections cause bad publicity or put companies out of business?

Yes, they do. Whenever you hear a company has been breached and the database has been compromised, that most likely was a sql injection. While there are other ways to get into the database, a persistent xss, a sql injection is very common and quite often the culprit.