Security researchers warn that a new feature that will ship with the next version of the WordPress CMS can be abused to disable security plugins and put WordPress sites and blogs at risk.
The feature, which has a very cool name in “WSOD (white-screen-of-death) Protection” and is considered the equivalent of a WordPress Safe Mode, is scheduled to make its debut with the release of WordPress 5.1, expected this spring.
As described by WordPress core developer Felix Arntz, the feature allows WordPress to recognize when a fatal PHP error occurs and what plugin or theme is causing it.
The WSOD Protection feature will pause the plugin or theme’s code and allow the site’s administrator to access the backend panel, where they can investigate and disable the culprit(s) causing the errors.
The WordPress team began working on the WSOD Protection feature months ago. The feature is part of a grand master plan to help site owners update from using outdated PHP 5.x servers to using the newer 7.x branches.
The WSOD Protection feature was created at first to allow site owners to recover from site crashes after the PHP 7.x migration, but WordPress developers realized this could also be used to catch errors after updates to WordPress plugins or themes, which sometimes also crash sites in similar ways.
But as the feature took shape and neared completion, several security researchers have realized that it could also be abused.
In a blog post published earlier this week, bug hunter Slavco Mihajloski pointed out that attackers could use low-end and sometimes harmless exploits in WordPress plugins to trigger a fatal PHP error that will be caught by the WSOD protection feature.
Since the WSOD protection feature is designed to pause the faulty plugin’s execution, Mihajloski argues that attackers could abuse it to disable firewalls, two-factor authentication, brute-force protection, and other security-focused plugins installed on WordPress sites.
Mihajloski’s worries were also shared by Matt Rusnak, QA Lead at WordFence. In a bug report discussing the feature, Rusnak also pointed out several other attack scenarios where the WSOD Protection feature would end up helping attackers.
The WordPress team answered to Rusnak’s feedback with plans to add a new option in the wp-config.php settings file that would allow site owners to disable WSOD Protection. The new option is named WP_DISABLE_FATAL_ERROR_HANDLER.
It is unclear if WSOD protection will ship enabled by default or not when WordPress 5.1 is released, but the feature remains dangerous still, regardless of the addition of the new wp-config.php option.
Security experts recommend that for the time being, site owners only enable it temporarily when updating the PHP server, the WordPress core, or its themes and plugins. Otherwise, keep it disabled.
Article source: https://www.zdnet.com/article/concerns-raised-about-wordpress-new-white-screen-of-death-protection-feature/#ftag=RSSbaffb68