Mendbird
Menu

The plugin register. Used on 200,000+ sites

Health Check & Troubleshooting

10known security flaws found in Health Check & Troubleshooting
since January 2018

1 with no fix yet

Version 1.6.0 or later fixes the others. One has no fix yet. A site on an older version is open to them.

Or let us look for you

Free, with no sign up. About ten seconds, and nothing on your site is touched. See an example report

When they were found.

Advisory: a security flaw, January 2018Advisory: Reading files, January 2019Advisory: Forged requests, January 2019Advisory: Reading files, January 2019Advisory: a security flaw, January 2019Minor: Forged requests, March 2023Minor: Reading files, December 202520182020202220242026

DangerousMajorMinorAdvisory

What they could let someone do.

What could happen

  • Reading files

    Someone could read files on the server they should never see, such as the settings file holding the database password, or delete files the site needs.

    How: The software takes a file name from a request and does not check that it stays inside its own folder.

    Read about it here
  • Forged requests

    Someone could get a signed in administrator to change something without knowing, such as adding a new admin or changing settings, just by visiting a page.

    How: The software does not check that a change came from its own pages, so another site can quietly send one through the administrator's browser.

    Read about it here
Every known flaw, newest first (10)
  1. December 2025MinorReading filesNo fix yet. Needs a login on the site (Admin+).
  2. March 2023MinorForged requestsFixed in 1.6.0. No login needed.
  3. January 2019AdvisoryReading filesFixed in 1.2.4.
  4. January 2019AdvisoryA security flawFixed in 1.2.4.
  5. January 2019AdvisoryReading filesFixed in 1.2.4.
  6. January 2019AdvisoryForged requestsFixed in 1.2.4.
  7. January 2018AdvisoryA security flawFixed in 1.2.4.
  8. Date not knownAdvisoryA security flawFixed in 1.2.4.
  9. Date not knownAdvisoryReading filesFixed in 1.2.4.
  10. Date not knownAdvisoryA security flawFixed in 1.2.4.

From the public lists of known flaws, checked daily. A flaw is listed once it is made public, often after a fix is out.

Be told the day a new one is found.

Mendbird checks your site every morning against the lists of known flaws, and emails you in plain English the day one hits something you run. Free for 14 days, then £9 a month.

Start my free trial