Wordspew shoutbox getting spammed even though it is only for reg members

plz…i need help !!!

here is the problem with that plugin.. correct me if I am wrong, as I am unwilling to create an account just to doublecheck this:

The form used to send info to the shoutbox is only viewable if you are logged in.

Correct? (No need to answer, Im looking at the plugin source, I already see that I am correct)

Thats all well and fine, however that doesnt protect “the guts”, how it works..

In other words, just because I cannot see the form on the page, doesnt mean I cannot send an http_post to it. If I know the variables to use, its quite easy.

http_post is very basic, and can even be done remotely.

—

There are a cpl things that can be done. For starters, I would take a look at your server logs, and see if the http_posts are being done remotely, as is often the case. If so, you can deter some of it by forcing the referer to come from your domain.

If the refering hit is coming from your domain, then its a little more tricky but you can fix that as well.

Essentially though, it ought to be up the plugin writer to address this. Its a well-known shortcoming of anything using http_post