Detector for sitepress-multilingual-cms's version doesn't work

[DrMurx]

Before submitting an issue, please make sure you fully read any potential error messages output and did some research on your own.

Subject of the issue

The version of sitepress-multilingual-cms isn't detected properly with the current dynamic_finders.yml which tries to match a regular expression in the plugin's changelog.md.

Nowadays sitepress-multilingual-cms doesn't have a changelog.md anymore, instead it comes with a changelog directory where every version has its own markdown file.

Given that, the current dynamic_finders.yml might even detect a wrong version of the plugin if the site's theme has a custom 404 error page (will be delivered due to the missing changelog.md) which accidentally matches the regular expression to detect the version.

Your environment

• Version of WPScan: 3.5.5
• Version of Ruby: 2.4.4p296
• Operating System (OS): Linux

[erwanlr]

Thanks for the report!

[DrMurx]

@erwanlr I think the new changelog directory gives a very unique approach to find the exact version if WPML even if the other detection mechanisms won't work (certain wordpress caching plugins spoil the detection via query parameters).

Here's an arbitrary site I just googled that has directory listings turned on so you can see the version markdown files:

https://www.inkoma-albert.com/wp-content/plugins/sitepress-multilingual-cms/changelog/

Since most sites don't allow directory listing, wpscan would have to enumerate the markdown files.

Also, wpscan's dynamic_finder should respect a 404 response when using the BodyPattern class. I think that's a different, yet related issue to the problem I described initially.

[erwanlr]

I am aware of the changelog directory, however there is an inconsistency between the version form the files there and the version from other places, such as the WPML generator tag.

In your example, the latest in the changelog is 4.0.0 whereas the WPML generator tag is at 3.9.3. I've checked some other blogs using the plugin as well and notice the same behaviour.

Furthermore, given the very aggressive nature of the detection via the changelog directory, and the fact that we would need to know the latest version of the premium plugin, it's not worth it.

I've just noticed that there is also the version disclosed via the wpml-dependencies.json file, so I've added that.

Re the respect of the 404, I will have a look

[erwanlr]

404 are now ignored by the BodyPattern DF