WordPress White Screen of Death
Read the full blog post at: https://bit.ly/2Ef5mTn
Over the last few years, hacking has become a common-place problem in the WordPress space. It's not that WordPress's core is extremely vulnerable but all of the third party elements baked into WordPress's infrastructure, coupled with widely available source code is a recipe for disaster.
To combat these growing concerns, WordPress has been working to develop security measures aimed at combating some of the lower-level concerns. For instance, WordPress's new "white screen of death" (actual name) feature is coming with patch 5.1 — due in Spring.
This new feature was originally designed to give users recovery options after the new PHP migration (and subsequent discontinuation.) But, they've also decided to bake the feature into their plugin and themes by forcing all plugins/themes with PHP issues to stop running when they encounter issues.
The migration from PHP 5/6 to PHP 7.x presents a few issues for WordPress users. First, many WordPress plugins/themes are starting to discontinue PHP 5x support — especially paid plugins (e.g., CodeCanyon.) Second, PHP 5.x is no longer receiving security support. For WordPress users, this means that PHP issues are on the horizon. In an effort to combat this, WordPress announced a new feature that would help disable plugins or themes that presented PHP issues. Since many WordPress plugins and themes still use the antiquated PHP version, users switching to PHP 7.x for security reasons may suffer issues with plugins and themes.
The new security feature — set to launch in 5.1 this spring — is called the White Screen of Death Protection (or WSOD.)
So, what's the problem? Well, a few weeks ago, security researchers started to question some of the uses of these new features, and how the white screen of death may actually make WordPress sites more vulnerable.
Since the WSOD is capable of disrupting the functionality of any "misbehaving" plugin, attackers would be able to use the feature to bypass firewalls and other security elements baked into a WordPress website via plugins.
For example, if attackers were to misuse the WSOD, they could disrupt a website's security plugins to bypass their firewalls, making it easier for them to hijack the website via vulnerabilities.
Slavco Mihajloski isn't the only researcher who noticed these potential issues. In a bug discussion thread on WordPress.org for the new feature, Matt Rusnak from WordFence detailed some immediately concerning issues with the feature, which you can view at: https://bit.ly/2Ef5mTn
We recommend all site owners disable the WSOD feature after you've updated your PHP versions. It could be used as a vulnerable element to hijack your website and install back doors. This is especially true if you have security elements installed.
Update: Felix Arntz pulled the PHP Site Health mechanism off-of-the-table citing a " high number of follow-up tickets and associated security concerns". Currently, the WSOD is still active on GitHub and slated for a future release (5.2)