Multisite cross-site security issue

  • Rolf Allard van Hagen

    (@ravanh)


    1 week ago

    Hi, I hoped to be able to safely use Search & Replace Everything by WPCode on a multisite installation but the plugin (even when only activated on one subsite) gives access to ALL database tables to any subsite admin, not just the subsite tables.

    Could that be fixed?

Viewing 2 replies - 1 through 2 (of 2 total)
  • Plugin Author Mircea Sandu

    (@gripgrip)

    6 days, 1 hour ago

    Hi @ravanh,

    Thank you for reaching out. Yes, we can look into what options we have to limit the plugin to a subsite for the next release. This is the type of tool that writes directly to the database so usually it’s being used by a super-admin at network level, that’s why we don’t have that option atm.

    Thread Starter Rolf Allard van Hagen

    (@ravanh)

    4 days, 16 hours ago

    Thanks 🙂

    To use at network level only, should it be network activated? I fear that will open everything up to every sub-site admin…

    Or better activate it only on the main site?

Viewing 2 replies - 1 through 2 (of 2 total)

You must be logged in to reply to this topic.