Why are government organisations which handle sensitive information using Wordpress?
There's a UK government policy to try and use open source, they even have a github profile https://github.com/alphagov
WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]
71–80 of 127 posts
Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]
#72Earlier quoted context omitted.
> A feature known as the Download Monitor plug-in created a webpage with the clear URL which provided a link to the live version, which bypassed the need for authentication. This rendered the protections on the ‘future’ function of WordPress redundant as it bypassed the required authentication needed to gain access to the pre-uploaded document. WordPress is a nice piece of software, but the plugin situation is gettin…
The main issue is that there isn't any governance to the plugin store. Once you have a plugin in there, you have free reign to do whatever you want with it. Getting it in there is a PITA though. For example, a library author and I created a plugin, but they wouldn't let me submit it because I wasn't the other author, and they wouldn't let him submit it because he wasn't me. True story.
There's also the fact that Matt Mullenweg (the guy who owns automattic) has made hostile takeovers of plugin pages before
Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]
#73Earlier quoted context omitted.
It's still a failure in principle. The effects of this particular instance of the failure were minimal but it was still an accidental leak of (at the time) private information. They just got lucky.
> The effects of this particular instance of the failure were minimal the effects are not minimal if you're crooked: getting this sort of information early is potentially extremely lucrative (why crooked? because trading on UPSI is illegal)
Surely it was no longer UPSI (Unpublished Price Sensitive Information) after the OBR published it?
Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]
#74> The available mitigation is at server level and prevents access to download or file storage directories directly. If configured properly, this will block access to the clear URL and return a ‘forbidden’ message. This is the second contributory configuration error – the server was not configured in this way so there was nothing to stop access to the clear URL bypassing protections against pre-publication access That…
Since at least Drupal 7, the core CMS has included the concept of “private files.” The files are stored in a directory that is not served publicly by the web server. Instead the CMS generates a proxy URL for each file, which is handled by the CMS like a page URL before serving the file by streaming it through PHP. So: it’s a heavier load on the server, but you get full permission management by the CMS. Wordpress does…
> I was surprised to find that it’s not even available as a community plugin.
I found this one https://wordpress.org/plugins/prevent-direct-access/
Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]
#75This doesn't seem to have much to do with Wordpress or its plugin ecosystem but rather an oversight since the behavior itself isn't necessarily a bug. I think the "well yeah, why would you use Wordpress?" comments kinda miss that.
It's a ubiquitous practice to serve file uploads from a place outside of webserver middleware. This happens pretty much any time an upload permalink is on a different domain or subdomain, and it's standard on probably 90% of platforms.
Discord and Twitter file upload urls would be an example off the top of my head.
It would have been prevented if the public url used a random UUID, for example. But that's also not the behavior users necessarily want for most uploads.
Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]
#76> The available mitigation is at server level and prevents access to download or file storage directories directly. If configured properly, this will block access to the clear URL and return a ‘forbidden’ message. This is the second contributory configuration error – the server was not configured in this way so there was nothing to stop access to the clear URL bypassing protections against pre-publication access That…
Since at least Drupal 7, the core CMS has included the concept of “private files.” The files are stored in a directory that is not served publicly by the web server. Instead the CMS generates a proxy URL for each file, which is handled by the CMS like a page URL before serving the file by streaming it through PHP. So: it’s a heavier load on the server, but you get full permission management by the CMS. Wordpress does…
That's even worse than I thought. I assumed it is a setting like in Drupal.
To me it really doesn't make any sense to have that kind of giant hole in your permissions system from the start.
Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]
#77For those of you not closely following UK politics: the Office for Budget Responsibility (OBR) mistakenly published their Economic and Fiscal Outlook (EFO) document 40 minutes early, pre-empting the announcements by the Chancellor. This is being treated as an incredibly big deal here: https://www.bbc.co.uk/news/articles/cd74v35p77jo
> which it blamed on a "technical error" It's not a technical error at all! Technical errors are faults caused by technology, like a software or hardware bug. That's not what happened here. WordPress behaved exactly as it was supposed to. The true cause is revealed later in the article, > staff thought they had applied safeguards to prevent early publication, there were two errors in the way in which they were set up…
I don't think that's a worthwhile distinction. All software bugs are human errors, since the machine is correctly following the human programmer's incorrect instructions; whether that's at the level of assembly instructing the CPU; or a higher level like Wordpress instructing the PHP interpreter; or an even higher level of a document hosting solution instructing Wordpress.
Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]
#78The real kicker is in point 1.13: > website activity logs show the earliest request on the server for the URL https://obr.uk/docs/dlm_uploads/OBR_Economic_and_fiscal_outl... . This request was unsuccessful, as the document had not been uploaded yet. Between this time and 11:30, a total of 44 unsuccessful requests to this URL were made from seven unique IP addresses. In other words, someone was guessing the correct st…
> In other words, someone was guessing the correct staging URL before the OBR had even uploaded the file to the staging area. This suggests that the downloader knew that the OBR was going to make this mistake, and they were polling the server waiting for the file to appear. The URLS are predictable. Hedge-funds would want to get the file as soon as it would be available - I imagine someone set up a cron-job to try th…
This is so incompetent.
Given the market significance of the report it's damn obvious that this would happen. They should have assumed that security via obscurity was simply not enough, and the OBR should have been taking active steps to ensure the data was only available at the correct time.
> Hedge-funds would want to get the file as soon as it would be available - I imagine someone set up a cron-job to try the URL every few minutes.
It's not even just hedge-funds that do this. This is something individual traders do frequently. This practise is common place because a small edge like this with the right strategy is all you need to make serious profits.
Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]
#79Should have used S3 and a datetime-based access policy. Eg
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Statement1",
"Effect": "Allow",
"Action": [
"s3:GetObject"
],
"Resource": "arn:aws:s3:::obr-leaky-bucket/myfirst.pdf",
"Condition": {
"DateGreaterThan": {
"aws:CurrentTime": "2025-11-26T12:30:00"
}
}
}
]
}Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]
#80Earlier quoted context omitted.
> The effects of this particular instance of the failure were minimal the effects are not minimal if you're crooked: getting this sort of information early is potentially extremely lucrative (why crooked? because trading on UPSI is illegal)
Surely it was no longer UPSI (Unpublished Price Sensitive Information) after the OBR published it?
I agree. They didn’t intend to publish it, but they did publish it. They might not have advertised its presence yet, but it was freely available to anyone who asked.