Security.
Snipfire runs code on WordPress sites, so we take reports seriously and answer them quickly. Here's how to reach us and what happens next.
Reporting a vulnerability.
Email support@snipfirewp.com with "Security" in the subject. Please don't open a public issue, post in a forum or mention it on social media until a fix is out.
- The plugin (Snipfire, Snipfire Pro or Snipfire Tweaks) and its version, and your WordPress and PHP versions.
- What an attacker can do, and which role or access they need.
- Steps to reproduce, or a proof of concept: a short snippet, request or WP-CLI command is ideal.
- Whether you'd like to be credited, and under which name.
What happens next.
We keep you posted along the way, and tell you if anything slips.
| Within 2 working days | We confirm we've got your report. |
|---|---|
| Within 5 working days | We tell you whether we can reproduce it and how serious we think it is. |
| Critical and high severity | A fixed release within 7 days of confirming it, sooner when it's being exploited. |
| Medium and low severity | Fixed in a release within 30 days. |
| After the fix | We credit you in the changelog if you want, and agree with you when to publish details. We ask for up to 90 days from your report before full disclosure, and usually need far less. |
What's in scope.
Snipfire, Snipfire Pro and Snipfire Tweaks (the latest released versions), and this website where it touches your sites: the downloads and the update endpoints.
We want to hear about
- Running code or changing snippets without the right team access level.
- Getting around Snipfire's PHP kill switch, DISALLOW_UNFILTERED_HTML or safe mode.
- Missing capability or nonce checks, XSS, SQL injection, reading files you shouldn't, leaking secrets.
- Anything that would let someone other than us get an update installed.
Out of scope
- What administrators, or people given full access, can do on purpose: writing and running PHP is what the plugin is for.
- The code people write in their own snippets.
- Problems that need an already compromised server or WordPress install, or physical access.
- Denial of service by flooding, spam, social engineering, and scanner reports without a working attack.
- Missing security headers or best-practice notes without a concrete impact, and other plugins and themes unless ours makes them exploitable.
Safe harbour.
If you act in good faith, follow this policy, only test on sites you own or are allowed to test, avoid privacy violations, data loss and service disruption, and give us reasonable time to fix the problem before telling anyone, we won't pursue or support legal action against you, and we'll treat your research as authorised. If in doubt, ask us first at the same address.
Signed releases.
Snipfire updates itself from this website, so every release from 0.17.0 on is signed with an Ed25519 key that never touches this website's server. Snipfire installs an update only if the signature matches a release key built into the version you have, and the version is newer.
Release key (public)
a65QYWyErblb7QwDpIuzD3jVK/KqM3qMZ0skfKoGR0w=
SHA-256 fingerprint: 1ede bf60 58ad b8bb 3c2b 8fc8 2ef1 e88d e70e d881 1377 fc3b 06fa 5195 94fe 88deCheck a download yourself
With nothing but PHP 7.2 or newer:
curl -sL -o snipfire.zip https://snipfirewp.com/download/snipfire.zip
curl -sL -o snipfire.zip.sig https://snipfirewp.com/download/snipfire.zip.sig
php -r '$s=json_decode(file_get_contents("snipfire.zip.sig"),true);$h=hash_file("sha256","snipfire.zip");echo sodium_crypto_sign_verify_detached(base64_decode($s["signature"]),"snipfire|".$s["version"]."|".$h,base64_decode("a65QYWyErblb7QwDpIuzD3jVK/KqM3qMZ0skfKoGR0w="))?"OK: ".$s["version"]."\n":"NOT VERIFIED\n";'"OK" and a version number means the zip is exactly what we signed. Anything else: don't install it, and please tell us.
If the release key ever changes, the next key is added to the plugin in a release that's still signed with the current one, and announced here and in the changelog. Download page
Move your snippets over this afternoon.
Importing changes nothing until you switch over, and your old shortcodes keep working.