• Resolved altometa

    (@altometa)


    Hi,

    I discovered that bots are able to register via MarketKing form, on top of that, they are also able to automatically approve themselves as a vendor. Is there a way to prevent them from bypassing the form? I think this is a serious security issue.

    • This topic was modified 9 months, 2 weeks ago by altometa.
Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Support Stefan

    (@stefanst1)

    Hi there,

    Thank you for reaching out.

    MarketKing extends the standard WooCommerce registration functionality by adding custom vendor fields, but the core registration process remains WooCommerce’s native implementation.

    I can recommend some solutions:

    1. We strongly recommend installing a CAPTCHA plugin to prevent automated bot registrations. This free plugin should work well with the registration form:
      https://ww.wp.xz.cn/plugins/recaptcha-woo/

    We specifically recommend using the reCAPTCHA v2 “I’m not a robot” checkbox option, as it provides a good balance between security and user experience.

    1. For additional protection against bots, you might want to consider implementing website-wide security measures such as:
    • Cloudflare Bot Protection
    • Web Application Firewall (WAF)
    • Security plugins such as Wordfence
    • Rate limiting for registration attempts

    Kind regards,
    Stefan

    Thread Starter altometa

    (@altometa)

    I already use Cloudflare on the form. They are not even using the form. They are submitting it via some kind of endpoint. But I already disabled WooCommerce registration as well as WordPress registration. So it means they are getting through MarketKing’s endpoint.

    Plugin Support Stefan

    (@stefanst1)

    Hi again,

    MarketKing does not have any kind of unique registration endpoint or dedicated registration functionality. We process all registrations through standard WooCommerce registration features – MarketKing only adds some additional custom fields to this registration to set additional data that describes the vendor store.

    It is certainly possible that bots are making registrations programmatically and that kind of issue is quite frequent on WP sites. On our side, we view it as beyond the scope of our plugin to strengthen the site against these kind of attacks – they are highly complex and would be impossible for us to address properly as they have more to do with the general security of the site.

    I recommend to proceed with configuring a Captcha plugin as that is able to help in the majority of these cases. Additionally a dedicated security plugin like Wordfence should be able to help.

    Thread Starter altometa

    (@altometa)

    Nope, Captcha doesn’t work. I already tried that with Cloudflare Turnslide. They just bypass the token because they don’t register on the form.

    The reason why I suspect it’s MarketKing’s issue is because the bots were able to set part of the marketking generated usermeta – marketking_account_approved to “yes” even though I set MarketKing’s setting to review application. WooCommerce doesn’t create that usermeta.

    Anyway, I was able to reinforce the endpoint via a plugin that I created. I added some checks on the registration endpoint including setting a honeypot trap. It seemed to stop the bot registrations. Guess it’s good now.

    You may close this ticket. Thank you…

    • This reply was modified 9 months, 1 week ago by altometa.
Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘Bot Registration’ is closed to new replies.