mailborder

@furioussnail That sounds very … Apple, Inc. WordPress gives you a framework so you do not have to reinvent the wheel every time you stand up a website. This plugin gives you the option to add customization without hacking the WordPress code. For example, we have a licensing server that interacts with a WordPress plugin to expand some capabilities. We don’t use this plugin, but I wrote one that basically does the same thing.

Where this can be a security issue is at what point in the WordPress evaluation this plugin does its thing. For giggles, I tested this plugin trying to submit something that would get evaluated from the from end. The developer has correctly applied the filters so it doesn’t happen.

You are correct that plugins made by inexperienced developers can lead to exploits. This plugin is not one of them. And deciding that something like this is bad and should be avoided is like taking a horse because airplanes crash. Yeah, they do, but they are mostly pretty damn handy.

I had to stop and read this comment a couple of times. Frankly, it makes no sense at all. I can tell you are not a programmer, so why would you post something like this?

You are correct that PHP runs on the server. However, your points seems to lead people (non programmers) into thinking this plugin somehow makes it possible for this developer to make the PHP code run in the broswer.

This is nonsense. PHP cannot run in a web browser. PHP is an interpreted language. It is evaluated, compiled to an intermediate bytecode, and then interpreted by the runtime engine. This is all done on the server. It does not matter where or what page this is done in WordPress. Someone could create their own security hole with this plugin if they do not know what they are doing, but that is akin to saying knives cut people. Sure, they do if you do not handle it correctly, but it doesn’t make the knife inherently dangerous.

Your review makes no sense. It is misleading and should be removed.

FWIW – I do not even know this plugin’s developer.

They added the fix to the last update, so you do not have to make a manual hack now.

I found the problem and reported it to Ultimate Member. If you want to put a temp fix on your code:

edit: /wp-content/plugins/ultimate-member/core/um-permalinks.php
line 85

fix:
if ( strtolower($_REQUEST['hash']) != strtolower(um_user('account_secret_hash')) ) wp_die('The secret key provided does not match this one for the user.');

original:
if ( $_REQUEST['hash'] != um_user('account_secret_hash') ) wp_die('The secret key provided does not match this one for the user.');

why: some OS’s and/or browsers convert URLs to lower case. If your UM account hash has an upper case letter in the string the validation fails.

I am not sure why this was never found. It took me a massive 5 minutes to debug.