WPIntell

Source evidence

[Plugin: Admin username changer] Security issue

Admin username changer · support · 2012-08-09T09:49:00+00:00

mixedsentiment
highseverity
0.95relevance
10replies
Evidence linked to opportunitycommercial context

Proof Health

Open evidence

Commercial opportunities need traceable source links before they are treated as build-worthy.

5 / 31 rows with source links

16.1% of this page's analysis has direct source links.

0 build-decision rows missing links

0 rows here require auditable proof before promotion.

26 rows with no attached evidence

0 rows have source counts but still need direct links.

Conversation

support
Julio Potier resolved
Hello Your plugin makes life easy for hackers because you do not use security nonce tokens. Also, the plugin sends you an email each time the plugin option page is visited, without user agreement, this is spam and forbidden. Read the codex to learn how to add nonces to your form/ajax. Btw, all websites do not starts with ‘ http://www.’ ;, check “parse_url()” php function. Also, check $wpdb->update() function. Last, what is JS is not activated, like on Screen Readers for blind people ? See you ! http://wordpress.org/extend/plugins/admin-username-changer/ Thank you for your suggestions Julio. Email sending was in the plugin for maybe 5 minutes and i removed it immediately and sent an email to the webmaster of the url that was sent to me – to uninstall it and re install the new clean one. I’ll make the changes you suggested in the next release. Greets Thank you emcode, i’ll be here 😉 The new version is in the tags folder, 1.1 🙂 Check it out and let me know what you think, and then i’ll release it. Greets! Great news! But the actual trunk version is 1.0 Change Stable tag: 1.1 to Stable tag: trunk in readme.txt file DOne 🙂 Is it possible to install and activate, change the username, and then uninstall and delete for security? thanks Yes. Hello, What will happen to my posts if I change the admin user name? It’s currently the only user, and I have hundreds of posts. Will they be deleted? 🙂 Non, the username is not linked to posts, the ID is. Thank you. 🙂

Comments

10 shown
yoshitech 2012-08-09T16:42:00+00:00

Thank you for your suggestions Julio. Email sending was in the plugin for maybe 5 minutes and i removed it immediately and sent an email to the webmaster of the url that was sent to me – to uninstall it and re install the new clean one. I’ll make the changes you suggested in the next release. Greets

Julio Potier 2012-08-09T17:01:00+00:00

Thank you emcode, i’ll be here 😉

yoshitech 2012-08-10T08:03:00+00:00

The new version is in the tags folder, 1.1 🙂 Check it out and let me know what you think, and then i’ll release it. Greets!

Julio Potier 2012-08-10T10:09:00+00:00

Great news! But the actual trunk version is 1.0 Change Stable tag: 1.1 to Stable tag: trunk in readme.txt file

yoshitech 2012-08-10T10:16:00+00:00

DOne 🙂

David100351 2012-11-21T16:37:00+00:00

Is it possible to install and activate, change the username, and then uninstall and delete for security? thanks

Julio Potier 2012-11-21T20:19:00+00:00

Yes.

akalsha 2013-01-22T22:12:00+00:00

Hello, What will happen to my posts if I change the admin user name? It’s currently the only user, and I have hundreds of posts. Will they be deleted? 🙂

Julio Potier 2013-01-22T22:29:00+00:00

Non, the username is not linked to posts, the ID is.

akalsha 2013-01-22T22:30:00+00:00

Thank you. 🙂