Sucuri secure 1.8.25 plugin causing one of the admin-ajax call fail in prod

Current version 1.8.39

Changelog

1.8.39

• Fixed API service messaging

1.8.38

• Fixed API service handling when the SUCURISCAN_API_URL config value is not defined
• Fixed API service UI messaging

1.8.37

• Fixed plugin image assets and screenshots to match new branding
• Fixed password reset email link protocol
• Fixed remote fonts usage
• Removed wordpress.sucuri.net API dependency
• Updated screenshots

1.8.36

• Changed Branding fonts, colors and images to match the current Sucuri brand

1.8.35

• Fixed “Early referer checks on admin hooks”

1.8.34

• Added referer check on admin hooks

1.8.33

• Fixed “Added option to clear cache by path”

1.8.32

• Fixed “Empty wp-config file after automatic secret key updates”

1.8.31

• Fixed “Path cannot be empty” error

1.8.30

• Bump version

1.8.29

• Changed ownership

1.8.28

• Silence fopen warning

1.8.27

• Add support for PHP 8
• Reduce memory requirements when reading a log file
• Fix DISALLOW_FILE_EDIT related notice

1.8.26

• Replace the word “blacklist” with “blocklist” in the codebase
• Replace the word “whitelist” with “allowlist” in the codebase

@hehe1234 – I had already checked these version details but couldn’t find information related to the issue I am facing

We are having the same issue with extremely problematic results. When utilizing The Events Calendar:

1. Admins are periodically getting “saved to admin-ajax” errror when saving event posts.
2. This creates massive amount of security exceptions in the Sucuri log naming our own VPS IP address as culprit.
3. While this is occuring, our disk use spins up to 100% rendering the site front-end and back-end unusable until processes spin down.
4. We have the latest plugin version.
5. This is a huge issue.

@kanikajain1509 We apologies for the delays. I have taken the issue to the development team and is currently under review with an internal ticket number (# 10943). Once the issue has been fixed I will issue an update.

@sucuri1 – I need one more information. If we are using the free version of the plugin and API key has not been set, how will the plugin behave? Will it still do all the scan and report in case of any vulnerability found?

@sucuri1 – Any update?