0

I am trying to use WordPress from Azure marketplace to deploy a web app. I ran a Fortify scan on entire code base (wwwroot) which includes wp-admin, wp-includes, wp-content and other boilerplate php files.

There are various issues found like below: enter image description here

What else can I do for static code analysis to detect code vulnerabilities in WordPress boilerplate code?

Improve this question
2
  • if you are asking about static analysis, then you can refine the rest of the post to that. No need to talk about all the other things you aren't interested in
    – schroeder ♦
    Jul 9, 2020 at 19:40
  • There are several Fortify Application Security products from Micro Focus. Based on the screenshot you are using Micro Focus Fortify Audit Workbench which you could have mentioned.
    – Esa Jokinen
    Jul 10, 2020 at 6:34

2 Answers 2

Reset to default
1

You should notice that WordPress is a content management system (CMS). Systems like that are designed for modifying web pages. That includes adding and modifying HTML, JavaScript, HTTP redirects etc. – and even working with databases.

Therefore, your whole security scanning approach is flawed: the findings described as security problems are within the normal operation of WordPress. It would be catastrophic if such functions were publicly available, but they are restricted with a password-based login. That's the area of security you should focus on: whether it's adequate for you or not:

  • Do you use strong passwords? Are there password requirements for all users?
  • Would you need multi-factor authentication?
  • Should the administrative areas be restricted to certain IP addresses?
  • Could the content be served as static pages e.g. from a proxy or CDN? That would ultimately limit the access to all dynamic content including the administrative tools.

Furthermore, are you responsible for security auditing open source code made by others, or just the source code of your web application project? Because this is about the WordPress core, according to Wordpress Security:

The WordPress Security Team is made up of approximately 50 experts including lead developers and security researchers — about half are employees of Automattic (makers of WordPress.com, the earliest and largest WordPress hosting platform on the web), and a number work in the web security field. The team consults with well-known and trusted security researchers and hosting companies.

If you have better resources than that, you could find and fix security problems in the WordPress core. Please contribute the findings to the WordPress project and you'd help in securing 63.6% of the web sites in the world. If Micro Focus Fortify Audit Workbench was the ultimate solution for that, it would have already been used.

Improve this answer
0

You want to scan your Wordpress site for problems? There are so many Wordpress plugins, I think every problem in life can be solved with a Wordpress plugin. So this problem should have a plugin to solve it, not?

Try the Wordfence plugin. It can monitor your website. There is a free and paid version, depending on what you need and on how important your data is.

Improve this answer
2
  • Yes. This is a plugin im looking into. Thanks
    – deachyut
    Jul 9, 2020 at 16:18
  • I edited the question to be more specific. Thanks
    – deachyut
    Jul 9, 2020 at 19:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.