January 31, 2019, saw the Beta 3 release of WordPress 5.1, but there was one crucial element that was intended for inclusion in the release but was ultimately scrapped at the last minute.
The feature was named White Screen Of Death Protection (WSOD) and intended to be like a Safe Mode for WordPress.
The idea behind the feature was a noble one: to easily detect fatal PHP errors – the bane of any WordPress developer’s life – and pinpoint the exact theme or plugin causing the problem. By identifying the WordPress theme or plugin causing the error, the WSOD feature would temporarily pause that theme or plugin from running in order to allow developers and administrators time to access the WordPress site’s backend for further investigation and to remedy the problem.
As much as this would have been a time-saving feature for developers, it seems that the WSOD feature would have come at a potentially dire cost.
When security professionals found out about the intended feature, they quickly raised concerns that it could be used by hackers to bypass security plug-ins, dramatically increasing the vulnerability of certain WordPress sites.
A hacker with a little know-how would easily be able to deliberately cause a security plug-in to experience a PHP error. From there, it would simply be a matter of waiting for the WSOD feature to “helpfully” disable the plug-in, giving the hacker easy access to the site.
The potential for abuse was huge, with all manner of security plugins and tools vulnerable, including brute force protection, two-factor authentication, and even firewalls.
Developers who expressed concerns about the feature noted the relentlessness of hackers, finding it inexcusable that the WSOD feature could so readily disable plugins vital to maintaining the security of a website and the privacy of its users, simply in an effort to identify the cause of a fatal PHP error. As web developers and security experts know, any pausing or disabling of security plug-ins – no matter how brief – will leave the website vulnerable and open to attack.
It seems that the development team at WordPress have been working on the WSOD feature for months, with the feature initially designed as one small part of a larger plan to assist WordPress site administrators to move away from old PHP 5.X servers to the newer and more stable 7.X equivalents.
Initially intended to allow developers and administrators to recover from unforeseen crashes following the migration to PHP 7.X servers, it was soon identified that the newly-developed feature could also be used for a wider purpose: to recognize and take steps to remedy fatal PHP errors caused by a variety of WordPress themes and plugins.
This led to the further development of the feature, which would later come to be named White Screen Of Death Protection. Unfortunately, during its development, no one seemed to recognize the potential for abuse.
That was until security expert caught news of the imminent release of the new WSOD in the then-forthcoming WordPress 5.1 and raised the alarm.
There was uncertainty as to whether the WSOD feature would still be released as part of WordPress 5.1, causing much concern from security experts as to the potential reach of the vulnerabilities. Luckily, WordPress decided at the last minute to remove the feature from their 5.1 release.
Whether White Screen Of Death Protection will be reworked and included in the 5.2 or a later release remains to be seen.