ACF Pro XSS Vulnerability

Will there be an expedited push to upgrade to 6.1.6 which contains the patch? I am concerned about the delay in the availability of plugins provided by the Pro license in case where security fixes are released in response to a widely published issue like this.

Can you speak to the timeline we are operating under for both this specific issue and the policy in general please?

Thank!

3 Likes

Yes there will be. I sent the request over last week, I’ll make sure it gets handled this week.

1 Like

Awesome, thanks Charlie! Any news on the Modern Calendar and other “featured” plugins available in Pro? I’ve noticed that Rev Slider won’t update for one of my sites as well, for example.

Rev slider for us currently at 6.6.10, but we can update to 6.6.13 as well. Modern Calendar’s upgrader code is currently conflicting with ours, so you have to de-active the plugin and then press upgrade for now. If you’re having an issue getting to 6.6.10, I’d try this same procedure.

ACF Pro update ASAP please

1 Like

@Charlie, I have a site running Slider Revolution that is stuck at 6.6.11 for a long time now. It tells me that 6.6.13 is available but that “automatic updates are unavailable for this plugin”. Deactivating it does nothing to move the needle. What can be done to address this?

I sent another message to update ACF.

@simeoned Since we’re not on 6.6.11 it sounds like you have your own copy. I’d deactivate the theme and try upgrading Slider Revolution after.

I do not have my own copy. But just to zero that out, I deleted the currently installed version and then reinstalled using the Theme Validation and Extensions UI. No change.

“There is a new version of Slider Revolution available. Automatic update is unavailable for this plugin.”

What else could be going on here?

Apologies we are actually on 6.6.11 so you are fine there. Are you on the Slider Revolution upgrade page? I’m not seeing this on the plugin page. It’s still tied to us so you shouldn’t see an active upgrade is available. I’ll send a note to update Slider Revolution to the latest which will also fix this.

Yep, on the plugins page. And this behavior is not new… I see it often for plugins that are part of your partnerships. If you a re expecting to see no updates available until you guys decide its time, it may be time to look into the mechanism that controls that. I might also reiterate the need to look into the significant lag in the acceptance of the Pro license upon activating a new build. These two systems that seem to rely calling home to one “Mothership” or another are not functioning as expected.

Well we updated Slider Revolution so you should be good.

Okay last time you brought this up it was around changing the URL of a license. We addressed that I believed. This sounds like something else. Where is the lag? Does this happen for you after every Pro Unlimited activation? Is this after you activate a license and try to activate another Pro Unlimited? Does the site screenshot currently have this lag issue happening on it?

@charlie thank you but Slider Revolution still can not be updated on the site I am having that trouble with. Screen shot above looks exactly the same (screenshot was doubled by mistake for some reason). So, the issue is not resolved.

With regard to the license validation lag for Pro in general, the Slider Revolution issue is not related except by loose association in that it seems like a similar issue with “calling home”. Apologies if I should have created this in a new thread but I was just mentioning it as an aside. The last time I brought this up officially was in this thread:

and no, in my opinion this issue was not resolved by support. And I just did not have time to follow up on that thread before it closed. You can see that the last thing I said in the thread had several additional questions in it and the staff member simply left it at, “Glad that we were able to help you.” rather than answering those questions.

Let me explain what happens…
The license always eventually validates. So when I said in that thread that this had happened, I was not saying it was a result of being helped in the forums. I was not. I was saying that it always happens eventually after enough time has elapsed. Which, by then, it had. But the issue is still very much present.

Here’s what happens every time I need to start a new build for a client:

  1. Create an account on my server like, “newclientname.gestaltcreations.com”
  2. Point DNS to that location
  3. Install WP & Pro
  4. Run a dig to make sure DNS changes are live, make sure I can load the site in the front end
  5. Activate Pro with my valid Unlimited License
  6. UI reports that I am validated, page reloads
  7. UI reports I am not validated
  8. Repeat until it fixes itself at some arbitrary point in the future. The problem is in my way until that happens, slowing me down.

Then I ask support after this has happened enough times in a row and I have time to report it. But there is no clear answer as to why this happens or how I can fix it or if you guys are doing something to fix it or even looking into it. Other users experience this as well… I know that from other social media groups i am part of. It is not a plugin conflict b/c at the point of the process I am describing, there is no other software to conflict with.

And anyway, like I said, it resolves itself after a period of time. But that lag is not something I consider to be reasonable and indicates a problem in the way license validation works.

I hope that provides some clarity on the ongoing issue. Can you speak to this at all?
Thanks @charlie!

1 Like

@charlie,

I have one more detail to add that just came up for the first time today. I deleted a license from my dashboard and yet it remains active at the site. I’ve done this in preparation for a migration to another hosting provider so the client won’t get my license for their site moving forward.

The same lag seems to be happening when removing a license as well as when attempting to add one to a site.

This seems like it should be near instantaneous in both cases.

1 Like

I’ve had this happen on numerous occasions as well.

2 Likes

Okay, yes what I was referring to earlier was different and not related to Unlimited. It was a cache issue before and I’m sure this is in the same vain. It also didn’t require an update on your end and hopefully this validation issue is the same. Thanks a bunch for the info and I’ll take a deep look tomorrow.

2 Likes

Alright I looked more into this. I am still convinced it’s something caching related if it works after a period of time. The first issue we fixed that I brought up was around changing the url of a single license, which doesn’t apply here. The cache is a 15 minute timer for reference. It does no DNS checks so we can factor that out, otherwise you couldn’t validate development machine.

I spun up from scratch and it was fine unfortunately. I noticed in that thread you were using WP Engine. Is it copying wp_options in this case?

@simeoned In a secure note do you want to let me know which domain that site in the screenshot is? I’ll confirm what data I’m seeing on my end.

So let’s start here and try to get closer.

@charlie,

There is now a secure note created for the Slider Revolution issue. Couple things…

I am not using WP Engine except in a few cases where my clients have dictated that they want to use that or already had hosting established. In the vast majority of cases they are on my VPS. But I don’t see how that is relevant to either issue.

Issue 1: Slider Revolution can not be updated for the site I provided int he secure note. Again, this site is on my VPS and there is no server side caching on this site.

Issue 2: License Validation can not complete properly. The behavior was described above but I’ll restate it here:

  1. Create an account on my server like, “newclientname.gestaltcreations.com”
  2. Point DNS to that location
  3. Install WP & Pro
  4. Run a dig to make sure DNS changes are live, make sure I can load the site in the front end
  5. Activate Pro with my valid Unlimited License
  6. UI reports that I am validated, page reloads
  7. UI reports I am not validated
  8. Repeat until it fixes itself at some arbitrary point in the future. The problem is in my way until that happens, slowing me down.

This happens regardless of the hosting environment and you can see that @JvP agreed that this is an issue. And I can attest to a ton of other people raising their hand about this on FB groups. It happens to many of us who have similar workflows.

Again, there are no other plugins installed in this scenario and certainly no special caching configured at that point. That kind of caching is installed as a finishing move, not during development.

Please let me know your thought when you’ve had a. moment to review.
Thank you!

Dan

In that secure note I need HTTP auth and I think I’ll be good to look at the dashboard. Looking at the cache I have some ideas based on the domain.

Secure note updated with that info. Sorry about that.

No worries. I see what you mean now. Even deactivating before updating didn’t help. I have a feeling deleting and then installing the plugin would help. But it might be good to check a couple of things first. I don’t know if you have time spin up a staging server, but I’d like to try without WordFence on. I noticed you added to it’s whitelist and am curious if we need to do anything there ourselves. IE whitelist theme.co domain. I’ll run though that on my own sites as well. Thanks for your patience.

I would also double check the following wp_options entry is the license you are expecting.
x_product_validation_key