Security researchers warn that a new feature that will ship with the next version of the WordPress CMS can be abused to disable security plugins and put WordPress sites and blogs at risk.
The feature, which has a very cool name in "WSOD (white-screen-of-death) Protection" and is considered the equivalent of a WordPress Safe Mode, is scheduled to make its debut with the release of WordPress 5.1, expected this spring.
As described by WordPress core developer Felix Arntz, the feature allows WordPress to recognize when a fatal PHP error occurs and what plugin or theme is causing it.
The WSOD Protection feature will pause the plugin or theme's code and allow the site's administrator to access the backend panel, where they can investigate and disable the culprit(s) causing the errors.
The WordPress team began working on the WSOD Protection feature months ago. The feature is part of a grand master plan[1] to help site owners update from using outdated PHP 5.x servers[2] to using the newer 7.x branches.
The WSOD Protection feature was created at first to allow site owners to recover from site crashes after the PHP 7.x migration, but WordPress developers realized this could also be used to catch errors after updates to WordPress plugins or themes, which sometimes also crash sites in similar ways.
But as the feature took shape and neared completion, several security researchers have realized that it could also be abused.
In a blog post[3] published earlier this week, bug hunter Slavco Mihajloski pointed out that attackers could use low-end and sometimes harmless exploits in WordPress plugins to trigger a fatal PHP error that will be caught by