WordPress performs update checks without verifying the information came from wordpress org.
Update downloads are also insecure because the downloaded file is not checked to verify that it has not been modified from the version on wordpress.org.
This plugin reduces the chance of successful man-in-the-middle attack by modifying the update process so that update checks and update downloads are performed using HTTPS connection to wordpress.org.
This process is still vulnerable to HTTPS handling on the server hosting the WordPress installation, to the attacker gaining access to SSL certificate for wordpress org, or in SSL encryption..
The plugin also modifies the plugin and installation processes to make them use HTTPS connection..
The plugin requires that HTTPS connection can be made on the server hosting the WordPress installation and that HTTPS connection can be made to wordpress.org.
The plugin does not secure the update process of plugins and themes that are not updated through wordpress.org..
If there are pending updates available at the time the in installed those will not be downloaded over HTTPS until after the next update check occurs and the relevant download links are modified so that the download is done using HTTPS connection..
Copy plugin files to the plugins folder...
Browse the code, check out SVN repository, or subscribe to the development log by RSS...
Read more
Related items:
