'Updating failed. The response is not a valid JSON response' after update 2.4.2

Hi,

In WordPress, I encounter an "Updating failed. The response is not a valid JSON response" error when saving events (at the very least). The cause turns out to be version 2.4.2 of SecurityCheck Pro; if I disable that plugin, I can save without issues. A side effect of this error is that I frequently get blocked, as actions quickly trigger an entry in the dynamic blacklist.

Best regards

Ad Stam

 

Hi Ad,

Can you please export and send me the firewall logs? I will check them to see what's happening.

Regards,
Jose

Hi Jose,

Here is the log (zipped CSV). To be honest, I hadn't checked the log; otherwise, I would have asked my question in more detail. Earlier entries in the event calendar worked fine (and I can no longer save them without the error message now, even without making any changes).
 

Hi Ad,

Thank you very much for the detailed report and the log, they were very helpful.

I have found the cause. Version 2.4.2 added inspection of JSON requests (the format the WordPress block editor uses to save content). As a side effect, the firewall's XSS filter treats legitimate HTML in your content, such as the image in your event description, as an attack. It blocks the save, which is why WordPress shows "The response is not a valid JSON response", and it also adds your IP to the dynamic blacklist.

I am already working on a fix, and I will publish a new version with it today or tomorrow morning.

In the meantime, if the blocks are getting in your way, you can use this temporary workaround:
1. Go to Securitycheck Pro > Firewall > Filter exceptions and add wp-json/wp/v2/mec-events to the exceptions of the "Strip tags" filter.
2. Remove your IP from the dynamic blacklist.

Once the update is installed you can remove that exception again.

Regards,
Jose

Hi Ad,

I have just published version 2.4.3 of Securitycheck Pro for WordPress, which fixes the problem you reported. It is available in the Downloads area of our website.

When you have a moment, please install it and let me know whether it has solved the issue on your site.

If you added the temporary exception (wp-json/wp/v2/mec-events) to the "Strip tags" filter, you can remove it after updating.

Once you confirm that everything works as expected, I will release the update to all users.

Thank you again for your detailed report and your help.

Regards,
Jose

Hi Jose,

Thanks for the quick action. Here is confirmation that the fix is ​​working! Events can be saved properly again!

Regards, Ad