Hi @terry777,

If you don’t want the Site Scan notification to be send twice a day and you cannot mute the security vulnerability (for whatever reason), you can (temporarily) disable the Site Scan notification:

Security > Settings > NOTIFICATIONS > Site Scan Results

If currently ticked, untick the Enabled checkbox and click on the blue Save All button. Note after this you are also no longer automatically notified of any other detected security vulnerabilities resulting from the Site Scan. However the Site Scan continues to run twice a day and site scan results continue to be logged.

• This reply was modified 1 year, 5 months ago by nlpro.

@nlpro Thanks. This is so annoying. The owner of several websites is getting notifications every time any one of these messages is sent. In the plugin settings, I’m the only one who is supposed to be getting them. I just tried to change the scan settings, but now my host’s firewall is locking me out from doing that. I think I may have to pursue an alternate plugin to iThemes. This is too annoying.

Hi @poppydev,

Are you referring with “the nag” to the Site Scan notification email ?

(I’m specifically asking this because there is another type of notification. It’s an alert in the Security Admin Messages).

Also I noticed that you cant clear your log so after a while your database will be clogged up.

When installed and activated the iTSec plugin creates a cron task (purge-log-entries) that maintains the log on a daily basis. By default the iTSec plugin keeps log data for (the last) 60 days. Log purging/maintenance is controlled by the DAYS TO KEEP DATABASE LOGS setting:

Security > Settings > CONFIGURE (Global Settings) -> Logging section

+++++ To prevent any confusion, I’m not iThemes +++++

How is this resolved?

Does WordPress plan on fixing this

Hi @nlpro,

I have already made the suggested changes to all of my sites, however, I put in a bug report with WP to see if they were working on this and got a great response, pretty much the same as what has been posted already, but it appears they are working on it:

Comment (by samiamnot):

The issue is rated as a medium severity issue. It seemingly requires a

vulnerability chain (unless there is another vulnerability to chain

together, it is not exploitable). I am sure that the WP developers are

actively working on a fix. See

https://nvd.nist.gov/vuln/detail/CVE-2022-3590. If you are nervous, the

vulnerability is in [https://codex.wordpress.org/XML-RPC_Support WordPress

XML-RPC] and you can turn it off via a number of

[https://wordpress.org/plugins/search/xml-rpc/ WordPress plugins].

-- 

Ticket URL: <https://core.trac.wordpress.org/ticket/57363#comment:3>

WordPress Trac <https://core.trac.wordpress.org/>

WordPress publishing platform

WP <= 6.1.1 – Unauthenticated Blind SSRF via DNS Rebinding

getting this issue from last one week

and this error

Module

File Change

Type

Warning

Description11947 Added, 0 Removed, 0 Changed

Does anyone have an answer to when this will be overcome? I host a bunch of WP sites and use Plesk. On the WP Toolkit, there is a bright red warning for essentially every site on every server. Having to click through regularly in order to determine if the issue is just this one, or if new warnings have appeared, is a massive time sink.

Hello,

Our website has been compromised and based on our hosting scan, WordPress is the only one prompting vulnerability. We are not using any plugins that are under malicious attack threat list.

Do we have an update on this yet?

Marjorie Stach