ACF Pro XSS Vulnerability

@Charlie, I have a site running Slider Revolution that is stuck at 6.6.11 for a long time now. It tells me that 6.6.13 is available but that “automatic updates are unavailable for this plugin”. Deactivating it does nothing to move the needle. What can be done to address this?

I sent another message to update ACF.

@simeoned Since we’re not on 6.6.11 it sounds like you have your own copy. I’d deactivate the theme and try upgrading Slider Revolution after.

I do not have my own copy. But just to zero that out, I deleted the currently installed version and then reinstalled using the Theme Validation and Extensions UI. No change.

“There is a new version of Slider Revolution available. Automatic update is unavailable for this plugin.”

What else could be going on here?

Apologies we are actually on 6.6.11 so you are fine there. Are you on the Slider Revolution upgrade page? I’m not seeing this on the plugin page. It’s still tied to us so you shouldn’t see an active upgrade is available. I’ll send a note to update Slider Revolution to the latest which will also fix this.

Yep, on the plugins page. And this behavior is not new… I see it often for plugins that are part of your partnerships. If you a re expecting to see no updates available until you guys decide its time, it may be time to look into the mechanism that controls that. I might also reiterate the need to look into the significant lag in the acceptance of the Pro license upon activating a new build. These two systems that seem to rely calling home to one “Mothership” or another are not functioning as expected.

Well we updated Slider Revolution so you should be good.

Okay last time you brought this up it was around changing the URL of a license. We addressed that I believed. This sounds like something else. Where is the lag? Does this happen for you after every Pro Unlimited activation? Is this after you activate a license and try to activate another Pro Unlimited? Does the site screenshot currently have this lag issue happening on it?

@charlie thank you but Slider Revolution still can not be updated on the site I am having that trouble with. Screen shot above looks exactly the same (screenshot was doubled by mistake for some reason). So, the issue is not resolved.

With regard to the license validation lag for Pro in general, the Slider Revolution issue is not related except by loose association in that it seems like a similar issue with “calling home”. Apologies if I should have created this in a new thread but I was just mentioning it as an aside. The last time I brought this up officially was in this thread:

and no, in my opinion this issue was not resolved by support. And I just did not have time to follow up on that thread before it closed. You can see that the last thing I said in the thread had several additional questions in it and the staff member simply left it at, “Glad that we were able to help you.” rather than answering those questions.

Let me explain what happens…
The license always eventually validates. So when I said in that thread that this had happened, I was not saying it was a result of being helped in the forums. I was not. I was saying that it always happens eventually after enough time has elapsed. Which, by then, it had. But the issue is still very much present.

Here’s what happens every time I need to start a new build for a client:

  1. Create an account on my server like, “newclientname.gestaltcreations.com
  2. Point DNS to that location
  3. Install WP & Pro
  4. Run a dig to make sure DNS changes are live, make sure I can load the site in the front end
  5. Activate Pro with my valid Unlimited License
  6. UI reports that I am validated, page reloads
  7. UI reports I am not validated
  8. Repeat until it fixes itself at some arbitrary point in the future. The problem is in my way until that happens, slowing me down.

Then I ask support after this has happened enough times in a row and I have time to report it. But there is no clear answer as to why this happens or how I can fix it or if you guys are doing something to fix it or even looking into it. Other users experience this as well… I know that from other social media groups i am part of. It is not a plugin conflict b/c at the point of the process I am describing, there is no other software to conflict with.

And anyway, like I said, it resolves itself after a period of time. But that lag is not something I consider to be reasonable and indicates a problem in the way license validation works.

I hope that provides some clarity on the ongoing issue. Can you speak to this at all?
Thanks @charlie!

1 Like

@charlie,

I have one more detail to add that just came up for the first time today. I deleted a license from my dashboard and yet it remains active at the site. I’ve done this in preparation for a migration to another hosting provider so the client won’t get my license for their site moving forward.

The same lag seems to be happening when removing a license as well as when attempting to add one to a site.

This seems like it should be near instantaneous in both cases.

1 Like

I’ve had this happen on numerous occasions as well.

2 Likes

Okay, yes what I was referring to earlier was different and not related to Unlimited. It was a cache issue before and I’m sure this is in the same vain. It also didn’t require an update on your end and hopefully this validation issue is the same. Thanks a bunch for the info and I’ll take a deep look tomorrow.

2 Likes

Alright I looked more into this. I am still convinced it’s something caching related if it works after a period of time. The first issue we fixed that I brought up was around changing the url of a single license, which doesn’t apply here. The cache is a 15 minute timer for reference. It does no DNS checks so we can factor that out, otherwise you couldn’t validate development machine.

I spun up from scratch and it was fine unfortunately. I noticed in that thread you were using WP Engine. Is it copying wp_options in this case?

@simeoned In a secure note do you want to let me know which domain that site in the screenshot is? I’ll confirm what data I’m seeing on my end.

So let’s start here and try to get closer.

@charlie,

There is now a secure note created for the Slider Revolution issue. Couple things…

I am not using WP Engine except in a few cases where my clients have dictated that they want to use that or already had hosting established. In the vast majority of cases they are on my VPS. But I don’t see how that is relevant to either issue.

Issue 1: Slider Revolution can not be updated for the site I provided int he secure note. Again, this site is on my VPS and there is no server side caching on this site.

Issue 2: License Validation can not complete properly. The behavior was described above but I’ll restate it here:

  1. Create an account on my server like, “newclientname.gestaltcreations.com
  2. Point DNS to that location
  3. Install WP & Pro
  4. Run a dig to make sure DNS changes are live, make sure I can load the site in the front end
  5. Activate Pro with my valid Unlimited License
  6. UI reports that I am validated, page reloads
  7. UI reports I am not validated
  8. Repeat until it fixes itself at some arbitrary point in the future. The problem is in my way until that happens, slowing me down.

This happens regardless of the hosting environment and you can see that @JvP agreed that this is an issue. And I can attest to a ton of other people raising their hand about this on FB groups. It happens to many of us who have similar workflows.

Again, there are no other plugins installed in this scenario and certainly no special caching configured at that point. That kind of caching is installed as a finishing move, not during development.

Please let me know your thought when you’ve had a. moment to review.
Thank you!

Dan

In that secure note I need HTTP auth and I think I’ll be good to look at the dashboard. Looking at the cache I have some ideas based on the domain.

Secure note updated with that info. Sorry about that.

No worries. I see what you mean now. Even deactivating before updating didn’t help. I have a feeling deleting and then installing the plugin would help. But it might be good to check a couple of things first. I don’t know if you have time spin up a staging server, but I’d like to try without WordFence on. I noticed you added to it’s whitelist and am curious if we need to do anything there ourselves. IE whitelist theme.co domain. I’ll run though that on my own sites as well. Thanks for your patience.

I would also double check the following wp_options entry is the license you are expecting.
x_product_validation_key

OK! Now we are somewhere. Turns out that this Slider Revolution issue was due to on older single Pro license that was part of another themeco account entirely. That older account belongs to my partner and he set that site up originally. It was never part of my Unlimited account until just now when I switched it over.

Once I used my license instead, I did have to delete the plugin and reinstall it from the Pro dashboard but that was easy and it fixed it right away.

I’ll also say that the license validation happened immediately as well – just like i’d expect it to. Obviously, this domain has had its DNS correctly configured for years. This makes me think that the difference is when we create new sites with a fresh DNS configuration there is some problem with that side of things. You said we could eliminate that as a possibility but… I’d like to put it back on the table. I really think that theory has legs.

Sorry for the confusion about the Slider Rev portion of this discussion That was my bad. There are other sites in my Unlimited account that start with the word “charlotte” so it didn’t jump out at me. Anyway, that part is 100% now and it all makes sense. If we can solve the License validation issue, we should be good to go.

Thanks @charlie

Great glad that fixes the package update issues.

So if it’s a DNS / Domain thing. Internally we use the following function. Which works differently if the site is a multisite. If your problems exist without using multisite we can probably scratch the multisite config being the problem.

You are always on the correct domain when you attempt right? IE your not on a raw IP. You don’t currently have a site doing this right? We could probably scratch this off too if adding a wildcard subdomain A record removes the issue on your end. I’m trying a DNS test on my end, just waiting for it to take change and then do a fresh install.

Some takeways already, it’d be nice to see the domain it’s going to attempt the validation on the validation page. And a secret section where an admin can see which license is in fact installed would be nice too.

Multisite is not a factor.
I am always on the correct domain, yes.
Standard subdomain: newclient.gestaltcreations.com.
I do not have one set up currently that is in the middle of this issue.

The problem is that when I go to set one up like this again, we’d have to coordinate so you could do your tests. We’d have to be ready at the same time. As far as which license it would use, I always use the same unlimited license key I have when setting up a site as described. So that part can be provided to you and relied upon to be accurate.

How could we coordinate a testing time that would be convenient?

I’m here central American time 9-5. Tomorrow or Friday I can take a look if you want to get a sample site going. 1pm sounds good with me, but let me know.
The next time I see the issue at with any unlimited I’ll check our what our cache says before trying to validate for them as well to see if it’s a cache issue.

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.