Security issue

Hi Yigit,

You closed the topic that started with this message:

Hi Guys,

I got the following security report from Zerocopter for three websites running Enfold. I am not sure this is a real security risk for the use of Enfold?

It works the same as is described in the article below but for a unclaimed theme, like here: https://wordpress.org/themes/enfold/
https://vavkamil.cz/2021/11/25/wordpress-plugin-confusion-update-can-get-you-pwned/

It is called the WP theme confusion attack. I can send you all of the infromation but then I need to be able to upload the images they sent me.

Please let me know what you think and whether you need additional information. Thanks Rob

BUT the person who told us about the security issue says it still is a security issue because of this reason:

This is incorrect, as soon as the WordPress update API can reach an official theme endpoint, e.g. https://wordpress.org/themes/enfold, it will prioritise that update. This is the default fallback in WordPress Core, it always checks the official /themes endpoint before checking a third-party asset.
You can read about it in the following thread: https://wordpress.org/support/topic/custom-theme-being-replaced-with-wordpress-org-theme/
It explains the situation quite well, even though it is a bit dated (WordPress Core works the same).

Is it true that when hypothetically someone would claim the URL: https://wordpress.org/themes/enfold/ that the update API would prioritise that URL?

Thanks Rob