Unauthorized request. Invalid or missing nonce, be sure you are using the current version of the MainWP Dashboard and Extensions

Since updating to the latest version of the dashboard yesterday I have started to see the below error trying to connect to sites.

Unauthorized request. Invalid or missing nonce, be sure you are using the current version of the MainWP Dashboard and Extensions.

Originally I was able to solve it by changing the dashboard user from a “team” access level to an administrator, but now I am seeing the same issue on my admin account. I have also tried disabling the teams plugin.


### WordPress Check                Required                                               Detected                                     Status   ###

FileSystem Method                  = direct                                               direct                                       Pass        
MultiSite Disabled                 =true                                                  true                                         Pass        
WordPress Memory Limit             >=64M                                                  512M                                         Pass        
WordPress Version                  >=3.6                                                  6.0                                          Pass        

### PHP                            Required                                               Detected                                     Status   ###

cURL Extension Enabled             =true                                                  true                                         Pass        
cURL SSL Version                   >=OpenSSL/1.1.0                                        OpenSSL/1.1.1f                               Pass        
cURL Timeout                       >=300 seconds                                          300                                          Pass        
cURL Version                       >=7.29.0                                               7.68.0                                       Pass        
PCRE Backtracking Limit            >=10000                                                1000000                                      Pass        
PHP Allow URL fopen                N/A                                                    YES                                                      
PHP Disabled Functions             N/A                                                    , pcntl_alarm, pcntl_async_signals, pcntl_exec, pcntl_fork, pcntl_get_last_error, pcntl_getpriority, pcntl_setpriority, pcntl_signal, pcntl_signal_dispatch, pcntl_signal_get_handler, pcntl_sigprocmask, pcntl_sigtimedwait, pcntl_sigwaitinfo, pcntl_strerror, pcntl_unshare, pcntl_wait, pcntl_waitpid, pcntl_wexitstatus, pcntl_wifcontinued, pcntl_wifexited, pcntl_wifsignaled, pcntl_wifstopped, pcntl_wstopsig, pcntl_wtermsig,            
PHP Exif Support                   N/A                                                    YES ( V8.0.)                                             
PHP IPTC Support                   N/A                                                    YES                                                      
PHP Loaded Extensions              N/A                                                    Core, FFI, PDO, Phar, Reflection, SPL, SimpleXML, Zend OPcache, bcmath, calendar, cgi-fcgi, ctype, curl, date, dom, exif, fileinfo, filter, ftp, gd, gettext, gmp, hash, iconv, igbinary, imagick, imap, intl, json, libxml, mbstring, memcached, msgpack, mysqli, mysqlnd, openssl, pcre, pdo_mysql, pdo_sqlite, posix, readline, redis, session, shmop, soap, sockets, sodium, sqlite3, standard, sysvmsg, sysvsem, sysvshm, tidy, tokenizer, xml, xmlreader, xmlrpc, xmlwriter, xsl, zip, zlib            
PHP Max Execution Time             >=30 seconds                                           300                                          Pass        
PHP Max Input Time                 >=30 seconds                                           300                                          Pass        
PHP Memory Limit                   >=128M                                                 512M                                         Pass        
PHP Post Max Size                  >=2M                                                   256M                                         Pass        
PHP Safe Mode Disabled             =true                                                  true                                         Pass        
PHP Upload Max Filesize            >=2M                                                   256M                                         Pass        
PHP Version                        >=7.0                                                  8.0.20                                       Pass        
PHP XML Support                    N/A                                                    YES                                                      
SSL Extension Enabled              =true                                                  true                                         Pass        
SSL Warnings                       = empty                                                                                             Pass        

### MySQL                          Required                                               Detected                                     Status   ###

MySQL Client Encoding              N/A                                                    utf8                                                     
MySQL Mode                         N/A                                                    ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION            
MySQL Version                      >=5.0                                                  8.0.28-19                                    Pass        

### Server Configuration           Detected Value                                      ###

Accept Content                     text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Charset Content             N/A                                                    
Architecture                       64		 bit                                               
Gateway Interface                  CGI/1.1                                                
HTTPS                              ON                                                     
Memory Usage                       17.59 MB                                               
Operating System                   Linux                                                  
Request Time                       1655926123                                             
Server Protocol                    HTTP/2.0                                               
Server self connect                Not expected HTTP response body:                       
Server Software                    nginx/1.21.6                                           
User Agent                         Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:101.0) Gecko/20100101 Firefox/101.0

### MainWP Dashboard Settings      Detected Value                                      ###

Abandoned plugins/themes tolerance 366                                                    
Basic uptime monitoring enabled    No                                                     
Cache control enabled              Yes                                                    
MainWP Dashboard Version           Latest: 4.2.5 | Detected: 4.2.5 Pass                   
MainWP legacy backups enabled      No                                                     
Maximum number of pages to return  50                                                     
Maximum number of posts to return  50                                                     
Maximum simultaneous install and update requests3                                                      
Maximum simultaneous requests      10                                                     
Maximum simultaneous requests per ip4                                                      
Maximum simultaneous sync requests 10                                                     
Minimum delay between requests     200                                                    
Minimum delay between requests to the same ip500                                                    
Number of child sites              41                                                     
Optimize for shared hosting or big networksNo                                                     
Plugin advanced automatic updates enabledNo                                                     
Primary Backup System              WPvivid Backup for MainWP                              
REST API enabled                   No                                                     
Site health monitoring enabled     No                                                     
Theme advanced automatic updates enabledNo                                                     
Use WP Cron                        Yes                                                    
WP Core advanced automatic updates enabledYes                                                    

### Extensions                     Version                                                License                                      Status   ###

Activity Log for MainWP            2.0.0                                                                                                           
Advanced Uptime Monitor Extension  5.2.2                                                  Actived                                      Pass        
Boilerplate Extension              4.1                                                    Actived                                      Pass        
MainWP Broken Links Checker Extension4.0.0.3                                                Deactivated                                  Warning     
MainWP Clean and Lock Extension    4.0.1.2                                                Actived                                      Pass        
MainWP Custom Dashboard Extension  4.0.2                                                  Actived                                      Pass        
MainWP Domain Monitor Extension    4.0.1                                                  Actived                                      Pass        
MainWP Favorites Extension         4.0.10                                                 Actived                                      Pass        
MainWP File Uploader Extension     4.1                                                    Actived                                      Pass        
MainWP Google Analytics Extension  4.0.4                                                  Actived                                      Pass        
MainWP Maintenance Extension       4.1.1                                                  Actived                                      Pass        
MainWP Pro Reports Extension       4.0.10                                                 Actived                                      Pass        
MainWP Sucuri Extension            4.0.11                                                 Actived                                      Pass        
MainWP White Label Extension       4.1.1                                                  Actived                                      Pass        
MainWP WooCommerce Status Extension4.0.8                                                  Actived                                      Pass        
WPvivid Backup MainWP              0.9.24                                                                                                          

### Plugin                         Version                                                Status                                    ###

Activity Log for MainWP            2.0.0                                                  Active                                       
FluentSMTP                         2.1.1                                                  Active                                       
MainWP Broken Links Checker Extension4.0.0.3                                                Active                                       
MainWP Child                       4.2.3                                                  Active                                       
MainWP Dashboard                   4.2.5                                                  Active                                       
Patchstack Security                2.1.19                                                 Active                                       
Typemarker                         1.6.3                                                  Active                                       
WP 2FA - Two-factor authentication for WordPress2.2.1                                                  Active                                       
WP fail2ban                        4.4.0.4                                                Inactive                                     
WPvivid Backup MainWP              0.9.24                                                 Active                                       
WPvivid Backup Plugin              0.9.73                                                 Active                                       
WPvivid Plugins Pro                2.2.5                                                  Active                                       

Hey @7thcircle

We have included WP Nonce verification to the “Go to WP Admin” request for additional security in the MainWP version 4.2.5.

If a MainWP extension has a Go to WP Admin button or a request, it needs to be updated to the latest available version, which includes adjustments for nonce changes.

After updating the dashboard and extensions I had the same issue on my other computer. A hard page refresh (or clearing local browser cache) did the trick.

As I have dug into this it looks to be the Broken Link Checker extension. Since it is no longer supported, is there some documentation on how the nonce changes need to be implemented since I need to make sure that WPVivid and Activity Log for MainWP are are aware of the updates needed too.

The nonce that was implemented in MainWP is the standard WordPress Nonce. You can learn more about it on WordPress Codex, including the implementation details: WordPress Nonces « WordPress Codex

If you would like, you can add this code to the end of the admin URLs in the Broken Link Checker extension to enable nonces for it.
image

Apologies for posting it in image form, but when trying to post the code itself here, I’m getting an error. Probably a security feature.

We have already alerted the developers of 3rd party extensions about nonce changes.

2 Likes

Great. Thanks for the info. For anyone interested, I have updated BLC and pushed it to the same Github location as my previous updates

2 Likes

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.