Password Confirm Action

Prompts the user for their password whenever they try to perform an action which could be used by an attacker to escalate privileges or engineer futur

Author:Stephen Harris (profile at wordpress.org)
WordPress version required:4.2.2
WordPress version tested:4.2.27
Plugin version:0.2.0
Added to WordPress repository:11-05-2015
Last updated:11-05-2015
Warning! This plugin has not been updated in over 2 years. It may no longer be maintained or supported and may have compatibility issues when used with more recent versions of WordPress.
Rating, %:0
Rated by:0
Plugin URI:http://github.com/stephenharris/password-conf...
Total downloads:901
Active installs:10+
plugin download
Click to start download

Context

Please see Trac Ticket 20140.

XSS attacks and ‘lunch time raid’ attacks, among others, can allow an attacker to ‘steal’ a log-in session, and act as an authenticated user without knowing that user’s password.
The aim of this plugin is to prevent that user from being able to engineer permanent access to the site. They may attempt to do this by doing one or more of the following:

  • Setting the password of the hijacked user to one of their choosing
  • Changing the e-mail of the hijacked user
  • Creating a new user
  • Changing the role of their account to escalate privileges

The plugin prevents the attacker from doing any of these by prompting them for the user’s password.

Caveat

Of course by default WordPress allows adminstrative users the ability to install arbitrary plugins and themes, and edit existing plugins/themes through in-built editors. These freedoms render the above solution impotent. It is outside of the immediate scope of this plugin to password protect those features, though it may be considered at later date.
It’s the advice of the plugin author that you should disable such features in your site’s wp-config.php by adding:

define( 'DISALLOW_FILE_MODS', true ); 

as outlined in https://codex.wordpress.org/Editing_wp-config.php#Disable_plugin_and_Theme_Update_and_Installation.

To report bugs or feature requests, please use Github issues.

Can I Help?

Yes! Please do!. You could do either of the following:

  1. Use the plugin and report any issues.
  2. Find an unassigned issue and start working on it (please make PRs to the develop branch).

If you have an expertise in accessibility I would welcome any suggestions or improvements. Or if you encounter any issues regarding accessibility please do report these.

A special thanks

A special thanks to Human Made whose Require Password plugin (written by Jenny Wong) served as an inspiration for this plugin.


ChangeLog