Prompts the user for their password whenever they try to perform an action which could be used by an attacker to escalate privileges or engineer futur …

Stephen Harris

<h4>Context</h4>
<p>Please see <a href="https://core.trac.wordpress.org/ticket/20140" rel="nofollow ugc">Trac Ticket 20140</a>.</p>
<p>XSS attacks and ‘lunch time raid’ attacks, among others, can allow an attacker to ‘steal’ a log-in session, and act as an authenticated user without knowing that user’s password.<br />
The aim of this plugin is to prevent that user from being able to engineer permanent access to the site. They may attempt to do this by doing one or more of the following:</p>
<ul>
<li>Setting the password of the hijacked user to one of their choosing</li>
<li>Changing the e-mail of the hijacked user</li>
<li>Creating a new user </li>
<li>Changing the role of their account to escalate privileges</li>
</ul>
<p>The plugin prevents the attacker from doing any of these by prompting them for the user’s password.</p>
<h4>Caveat</h4>
<p>Of course by default WordPress allows adminstrative users the ability to install arbitrary plugins and themes, and edit existing plugins/themes through in-built editors. These freedoms render the above solution impotent. It is outside of the immediate scope of this plugin to password protect those features, though it may be considered at later date.<br />
It’s the advice of the plugin author that you should disable such features in your site’s <code>wp-config.php</code> by adding:</p>
<pre><code>define( 'DISALLOW_FILE_MODS', true ); </code></pre>
<p>as outlined in <a href="https://codex.wordpress.org/Editing_wp-config.php#Disable_plugin_and_Theme_Update_and_Installation" rel="nofollow ugc">https://codex.wordpress.org/Editing_wp-config.php#Disable_plugin_and_Theme_Update_and_Installation</a>.</p>
<p><strong>To report bugs or feature requests, please use <a href="http://github.com/stephenharris/password-confirm-action/issues" rel="nofollow ugc">Github issues</a>.</strong></p>
<h4>Can I Help?</h4>
<p><strong>Yes! Please do!</strong>. You could do either of the following:</p>
<ol>
<li>Use the plugin and <a href="http://github.com/stephenharris/password-confirm-action/issues" rel="nofollow ugc">report any issues</a>.</li>
<li>Find an <a href="http://github.com/stephenharris/password-confirm-action/issues" rel="nofollow ugc">unassigned issue</a> and start working on it (please make PRs to the develop branch).</li>
</ol>
<p>If you have an expertise in accessibility I would welcome any suggestions or improvements. Or if you encounter any issues regarding accessibility please do report these.</p>
<h4>A special thanks</h4>
<p>A special thanks to Human Made whose <a href="https://github.com/humanmade/hm-require-password" rel="nofollow ugc">Require Password</a> plugin (written by Jenny Wong) served as an inspiration for this plugin.</p>


Alternatives to Password Confirm Action

Top alternatives