MediaServe Thanks! Would you be willing list the plugins you like to blacklist?
You're welcome! Here’s an example blacklist:
wp-file-manager
file-manager-advanced
filester
filebird
file-manager
real-media-library-lite
wpide
folders
fileorganizer
media-library-organizer
nmedia-user-file-uploader
shared-files
softdiscover-db-file-manager
cm-download-manager
wp-file-manager-pro
wp-file-download
wpide-pro
hide-my-site
disable-admin-notices
call-now-icon-animate
wp-copyprotect
wordpress-social-login
simple-csv-xls-exporter
To blacklist them, just add them to the file:
/var/log/cpfenceav/blacklisted-wp-plugins.txt
As a rule of thumb, any vulnerable plugin that has no patches available should not be allowed on your server. WP-AutoShield sends weekly vulnerability reports every Monday morning for each server. Just check these reports regularly, look at the "Remediation" row, and grab all the plugins that say "No known patch available" , then manually review and add them to the blacklist.
If you are like us and prefer not to manually review them, and instead want to automatically blacklist all vulnerable plugins with no patch available on all your servers in one go, you can do the following:
1- Run cPFence Multirun Tool
cpfence --multirun
2- List vulnerable plugins with no patch available:
grep "No known patch available" /var/log/cpfenceav/vulnerabilities_*.csv | awk -F',' '$1 == "plugin" {print $2}' | sort -u
3- If the output looks good, append them to the blacklist automatically for all your servers in one go :
grep "No known patch available" /var/log/cpfenceav/vulnerabilities_*.csv | awk -F',' '$1 == "plugin" {print $2}' | sort -u >> /var/log/cpfenceav/blacklisted-wp-plugins.txt
