awakegal

Hi Nick,

Thank You!

I was happy to see an update today in my plugins.

Patch Stack is who reported the vulnerability to iThemes so probably better to contact Patchstack..

I received an email from iThemes Security which said Known issues

This is the only information I have:

https://patchstack.com/database/vulnerability/ultimate-social-media-plus/wordpress-social-share-icons-social-share-buttons-plugin-3-5-7-broken-access-control?_a_id=431

https://www.cve.org/CVERecord?id=CVE-2023-38514

Great you!

I added the code to wp-config.

I can log into the website as now there is a black bar above the website, however I cannot access the dashboard.

Perhaps I should uninstall Ninjafirewall?

How would I do this manually via ftp?

Thanks.

Yes, I cleared the cookies

When I try to login I get this message:
Sorry, you are not allowed to access this page

And the email I received from Ninjafirewall says:
NinjaFirewall has blocked an attempt to modify a user capability by someone who does not have administrative privileges:

Blog: https://website.com/
Username: xxxxx, ID: 2
meta_key: wp_sw_capabilities
meta_value: a:1:{s:6:”editor”;b:1;}
User IP: 161.97.232.163
SCRIPT_FILENAME: /home/customer/www/website.com/public_html/wp-admin/plugins.php
REQUEST_URI: /wp-admin/plugins.php?charsout=370&plugin=wp-user-role-switcher%2Fwp-user-role-switcher.php&plugin_status=all&paged=1&s&action=role_switcher&role=editor&nonce=688cd274b7
Date: April 29, 2021 @ 11:46:27 (UTC -0700)

A PHP backtrace has been attached to this message for your convenience.

This protection (and notification) can be turned off from NinjaFirewall “Firewall Policies” page.

Horrible support.

I am also getting the same warnings from iThemes Security.

Thank you for the code you posted two weeks ago.

I ended up uninstalling NF so that I could finish the websiite. Once I moved it to a new cPanel, installed NF again and have not had any problems.

Very strange though that I didn’t have any issues with NF on the other websites in the subdomain.

Yes.

In public_html there is the maindomain.com and the folder for dev.maindomain.com

And, I have 4 other websites folders in the same public_html that have ninjafirewall installed.

Thanks

I have exactly the same issue.

I am able to exclude files in the backup process and I was able to migrate the website and run NinjaFirewall installer again.

Now going to edit scheduled backups on all the other websites to exclude the PHI INI file.

Many thanks for your help.

thank you !

Thanks for the quick reply and the links to read more!