{31} Tickets in the Security component (90 matches)

Max items per page

Arguments

COMPONENT

Slated for Next Release (2 matches)

Ticket	Summary	Owner	Priority	Severity	Milestone	Type	Workflow	Modified
#57304	Add SensitiveParameter attribute to DB connection and login variables		normal	normal	6.8	enhancement	has-patch	10/01/2024
#43936	Settings: Warn when open registration and new user default is privileged	audrasjb*	normal	normal	6.8	feature request	has-patch	10/02/2024
Tickets Awaiting Review (57 matches)
Ticket	Summary	Owner	Priority	Severity	Milestone	Type	Workflow	Modified
#61942	Add "no-store" to Cache-Control header to prevent unexpected cache behavior		normal	normal	Awaiting Review	defect (bug)		08/30/2024
#60090	Double login with cloned wordpress instance		normal	major	Awaiting Review	defect (bug)		12/22/2023
#60994	Github bot detected some high risk security issue in npm packages.		normal	normal	Awaiting Review	defect (bug)		04/11/2024
#61640	Issues in edit_link Function: Inconsistent Return Values, Insufficient Permission Error Handling, and Data Sanitization		normal	major	Awaiting Review	defect (bug)	has-patch	07/31/2024
#52333	Lack of the : entity on the list of allowed entity names in kses.php		normal	minor	Awaiting Review	defect (bug)	has-patch	01/20/2021
#41391	Links to media in password protected pages		normal	normal	Awaiting Review	defect (bug)		07/24/2017
#53618	Nonce use for AJAX calls interferes with page caching		normal	normal	Awaiting Review	defect (bug)		07/07/2021
#59824	PHP Warning raised in pluggable.php when passing NULL instead of a string		normal	normal	Awaiting Review	defect (bug)		11/07/2023
#37559	Password protected pages require the password only once		normal	normal	Awaiting Review	defect (bug)		06/04/2019
#61711	Password-protected pages lacking appropriate 'Cache-Control' request header		normal	normal	Awaiting Review	defect (bug)		09/03/2024
#37264	Please do not chmod 666 the wp-config.php file on installation.		normal	normal	Awaiting Review	defect (bug)	has-patch	03/22/2019
#53869	Post type / Taxonomy Label Hardening: Prevent Raw HTML tags in output / Media Library eval of HTML entities in label		normal	normal	Awaiting Review	defect (bug)	has-patch	08/04/2021
#53994	REST API requests with session cookies but an invalid/missing nonce are considered authenticated for most of the request		normal	normal	Awaiting Review	defect (bug)		08/24/2021
#56860	Sodium Compat library is improperly loaded		normal	normal	Awaiting Review	defect (bug)		10/20/2022
#58771	Someone logged onto my WordPress Admin Site, changed the password, and created a User Registration		normal	normal	Awaiting Review	defect (bug)		07/10/2023
#53019	The _sanitize_text_fields function removing the octets that incorrectly work with Arabic RTL languages.		normal	normal	Awaiting Review	defect (bug)		03/14/2023
#59355	TypeError: Cannot read properties of undefined (reading 'hasClass') in wp-auth-check.min.js		normal	normal	Awaiting Review	defect (bug)		09/15/2023
#60864	URL sanitizing strips valid characters instead of encoding, documented use is invalid		normal	normal	Awaiting Review	defect (bug)	has-patch	04/03/2024
#58916	Wrong User Password Reset		normal	normal	Awaiting Review	defect (bug)		07/29/2023
#34852	fix broken re-auth loop (due to expired session)		normal	normal	Awaiting Review	defect (bug)		06/04/2019
#58679	meta key field in usermeta table should NOT use accent insensitive collations		normal	major	Awaiting Review	defect (bug)		10/30/2023
#57447	wp_ajax_inline_save function does not check if post has "public" or "show_ui" enabled		normal	normal	Awaiting Review	defect (bug)		01/11/2023
#60347	wp_kses breaking text fragments links		normal	normal	Awaiting Review	defect (bug)		06/21/2024
#56521	wp_kses wp_kses_hair fails to allow a valueless attribute when is follwed by /		normal	major	Awaiting Review	defect (bug)	has-patch	09/06/2022
#38260	A FORCE_SSL_CANONICAL constant		normal	normal	Awaiting Review	enhancement		06/04/2019
#38259	A FORCE_SSL_CONTENT constant		normal	normal	Awaiting Review	enhancement		06/04/2019
#38261	A FORCE_SSL_SCRIPTS constant		normal	normal	Awaiting Review	enhancement		06/04/2019
#37757	Add `allowed_classes` to `maybe_unserialize` When WordPress is running on PHP 7+		normal	normal	Awaiting Review	enhancement	has-patch	09/13/2017
#60824	Add filters to to wp_verify_nonce()		normal	normal	Awaiting Review	enhancement	has-patch	03/22/2024
#23165	Admin validation errors on form nonce element IDs (_wpnonce)		normal	normal	Awaiting Review	enhancement	has-patch	02/08/2021
#58636	Automatic Sanitization of Nonces in wp_verify_nonce		normal	normal	Awaiting Review	enhancement		06/26/2023
#56785	Automatically catch potential security issues before release		normal	normal	Awaiting Review	enhancement		10/11/2022
#39656	Create a submenu item under About admin bar for security		normal	normal	Awaiting Review	enhancement		01/23/2017
#53296	Do trim $hook_name within add_action() and add_filter() function		normal	normal	Awaiting Review	enhancement	has-patch	05/29/2021
#40237	Educate users about modern password best-practices		normal	normal	Awaiting Review	enhancement		06/06/2022
#62005	Enhance wp_hash function to support custom hashing algorithms		normal	normal	Awaiting Review	enhancement	has-patch	09/25/2024
#51611	Escape echoing Core functions		normal	normal	Awaiting Review	enhancement		10/24/2020
#43320	Harden API requests against man-in-the-middle attacks		low	minor	Awaiting Review	enhancement		02/18/2018
#50510	Improve security of wp_nonce implementation		normal	normal	Awaiting Review	enhancement	dev-feedback	07/11/2023
#51159	Let's expand our context specific escaping methods for wp_json_encode().		normal	normal	Awaiting Review	enhancement		05/09/2024
#62055	Put index.php into Public folder on the root directory		normal	normal	Awaiting Review	enhancement		09/16/2024
#52544	Removing database tables allows anyone to take over all website files		normal	major	Awaiting Review	enhancement		07/05/2022
#57424	Specific hook for Content Security Policy		normal	normal	Awaiting Review	enhancement		01/05/2023
#54512	Suggestion for file protection		normal	normal	Awaiting Review	enhancement		11/25/2021
#61706	Support for storing and getting encrypted options		normal	normal	Awaiting Review	enhancement		07/19/2024
#38262	Task: Opt in SSL Improvements		normal	normal	Awaiting Review	enhancement		02/05/2020
#60470	Use `filter_input` instead of superglobals where possible		normal	normal	Awaiting Review	enhancement		02/09/2024
#36177	default htaccess should include security measures		normal	normal	Awaiting Review	enhancement		04/12/2024
#58765	the_block_template_skip_link() - XSS vulnerability - Apply FIX		normal	normal	Awaiting Review	enhancement	has-patch	07/08/2023
#54280	wp_verify_nonce should return a filter		normal	normal	Awaiting Review	enhancement		10/17/2021
#55514	2FA by default for WordPress		normal	normal	Awaiting Review	feature request		03/06/2023
#43215	Allow wp_kses to pass allowed CSS properties		normal	normal	Awaiting Review	feature request		10/07/2024
#53902	Automating the creation of inline javascript and inline stylesheet nonces or hashes		normal	normal	Awaiting Review	feature request		07/03/2024
#55950	FIDO passwordless authentication?		normal	minor	Awaiting Review	feature request		06/08/2022
#61322	HTTPOnly attribute for WP Test Cookies		normal	major	Awaiting Review	feature request	has-patch	08/29/2024
#38536	Hook/Function to Set Content-Security-Policy		normal	normal	Awaiting Review	feature request		06/04/2019
#50613	disable update for themes e plugin		normal	normal	Awaiting Review	feature request		07/09/2020
Candidates for Closure (8 matches)
Ticket	Summary	Owner	Priority	Severity	Milestone	Type	Workflow	Modified
#44637	Escape strings in wp-admin/themes.php		normal	normal	Awaiting Review	defect (bug)	reporter-feedback	06/07/2021
#58900	Escaping: Output String did not run through a proper escaping function		normal	normal	Awaiting Review	defect (bug)	close	12/08/2023
#50027	Retire Phpass and use PHP native password hashing		normal	normal	Awaiting Review	defect (bug)	needs-unit-tests	10/13/2023
#57882	User that has capability to create user can make only administrator.		normal	normal	Awaiting Review	defect (bug)	reporter-feedback	03/07/2023
#31686	wp_authenticate_username_password() should check for a WP_Error object		normal	normal	Awaiting Review	defect (bug)	reporter-feedback	08/06/2019
#37670	wp_validate_redirect fails when running WordPress on a port		normal	normal	Awaiting Review	defect (bug)	reporter-feedback	06/04/2019
#56335	use hash_equals to check password hash		normal	trivial	Awaiting Review	enhancement	close	10/12/2022
#55228	Provide Option to Remove Password Visibility Button and Dashicons from WordPress' Login Form		normal	normal	Awaiting Review	feature request	close	02/25/2022
Tickets Needing Feedback (7 matches)
Ticket	Summary	Owner	Priority	Severity	Milestone	Type	Workflow	Modified
#15394	Ancient "Are you sure you want to do this" now confusing		normal	minor	Future Release	defect (bug)	dev-feedback	05/17/2019
#16483	Visibility: password-protected exposes multiple pages		normal	normal	Future Release	defect (bug)	dev-feedback	01/30/2022
#56141	Enhance installer security		high	major	Future Release	enhancement	dev-feedback	12/31/2023
#37000	Support for the SameSite cookie attribute		normal	normal	Future Release	enhancement	dev-feedback	06/06/2024
#29429	Support frame-ancestors directive over X-Frame-Options		normal	normal	Future Release	enhancement	dev-feedback	07/29/2019
#21022	Use bcrypt for password hashing; updating old hashes		normal	major	Future Release	enhancement	dev-feedback	09/11/2024
#30465	Dashboard alert if a plugin/theme was removed from WordPress repo		normal	normal	Future Release	feature request	dev-feedback	06/19/2024
Tickets with Patches (6 matches)
Ticket	Summary	Owner	Priority	Severity	Milestone	Type	Workflow	Modified
#50828	Update ca-bundle.crt and remove expired certificates	SergeyBiryukov	normal	normal	Future Release	defect (bug)	has-patch	11/10/2021
#53973	WordPress <= 5.8 - Authenticated Persistent XSS (User role name)		normal	normal	Future Release	defect (bug)	has-patch	06/15/2024
#51407	Remove inline event handlers and JavaScript URIs for Strict CSP-compatibility	adamsilverstein	normal	normal	Future Release	enhancement	dev-feedback	12/26/2023
#38474	wp_signups.activation_key stores activation keys in plain text	SergeyBiryukov	normal	normal	Future Release	enhancement	has-patch	04/23/2024
#37604	'Password Lost/Changed' emails should give indication of the strength of the new password		normal	normal	Future Release	feature request	dev-feedback	04/09/2018
#20140	Ask old password to change user password		normal	major	Future Release	feature request	dev-feedback	07/28/2024
Unpatched Bugs (2 matches)
Ticket	Summary	Owner	Priority	Severity	Milestone	Type	Workflow	Modified
#34041	Tying nonces to sessions breaks when users are switched		normal	major	Future Release	defect (bug)		06/04/2019
#48955	WP 5.3.1 changes cause potential backwards compatibility breakage with kses		normal	normal	Future Release	defect (bug)		08/12/2020
Unpatched Enhancements (8 matches)
Ticket	Summary	Owner	Priority	Severity	Milestone	Type	Workflow	Modified
#57875	Add password strength meter for password protected content		normal	normal	Future Release	enhancement		06/01/2023
#28521	FORCE_SSL constant for really forcing SSL	adamsilverstein	normal	normal	Future Release	enhancement		06/08/2023
#44058	Include security sniffs in PHPCS ruleset		normal	normal	Future Release	enhancement		05/16/2018
#36087	Migration plan from insecure RNG fallback		normal	normal	Future Release	enhancement		09/30/2020
#51438	Use CSP directive upgrade-insecure-requests when using HTTPS		normal	normal	Future Release	enhancement	needs-unit-tests	11/09/2021
#52388	Use HTTPS URL already during installation if supported		normal	normal	Future Release	enhancement	needs-unit-tests	01/28/2021
#32067	Remove inline javascript from WP-Core to allow CSP protection		normal	normal	Future Release	feature request		06/18/2024
#50437	Add leniency to the overdue check for plugin and theme auto updates		normal	normal	Future Release	task (blessed)		07/14/2020