New Kinsta Service Doesn't Really Secure Plugin Updates as They Don't Verify Vulnerability Fixes

Описание: The WP Security Minute for March 27, 2025.

This week a press release from WordPress focused web host Kinsta claimed that a new feature they were revealing "makes managing WordPress updates easy and secure." They claimed it was a "major advancement" that "eliminates the biggest burdens of WordPress maintenance: the risk of site-breaking updates, time-consuming manual updates and security vulnerabilities from outdated plugins." This isn't a standard feature, it is "$3 USD a month for each environment — like live or staging — in which it is active." So the price could add up.

While security was a focus of their press release, their service completely misses that updates that are supposed to fix vulnerabilities often fail to fix them. Take the 50,000 install plugin Ultimate Blocks. This week the developer released a new version that was supposed to fix a cross-site scripting issue. Were they finally fixing the vulnerability that was disclosed, but incorrectly claimed to have been fixed, by WPScan 11 months ago? No.

The developer did make another attempt at that, which led Wordfence to claim it had been fixed. That is the 9th time that Wordfence has claimed it has been, without it actually being fixed. Somehow they have failed to notice 8 times that they already claimed it was fixed.

If Kinsta did the vetting that unscrupulous WordPress security providers are not doing, then the feature would be very valuable.