syzygist

You are right. I thought I had cleared all plugin and browser caches, but I found one I had missed, and it is fine now. Thanks.

The update to version 2.3.9 did not resolve our issue.

We lost the expand/collapse +/- symbol on our accordions after updating, and I am not able to switch to a different set of symbols in the Display settings for the accordion.

I also agree.

@kpersolutions Happy to help. As you may be aware, you can usually upgrade your PHP yourself if you have a cPanel account. Just search on PHP in the cPanel search field. However even though cPanel offers this tool, it is up to the individual host what versions of PHP they choose to populate it with. I have seen hosts who did not even offer a single maintained version of PHP, and demanded a hosting plan upgrade from customers who wanted to access safe and current software.

Unfortunately, this is not uncommon, and can occur on some big name hosts with high profiles. That does not make it acceptable, however! It’s the equivalent of going into a grocery store, discovering all the food on the shelves is expired, and being charged an entrance fee to access fresh food options. If that sounds outrageous, it’s because it is.

MySQL runs in a separate virtual server, or even on a separate physical server, which serves all of the customers on the server, so those changes usually do have to go through the host unless you have a VPS hosting plan. Good luck!

WordPress doesn’t like questions abut why they’re promoting Bluehost. I have been using MDDHosting for many years. Shock Hosting is a lower cost host that seems to offer a very similar shared hosting experience, though I have less experience with them. Clients who are reluctant to migrate to a different host sometimes become more amenable when they see how much money ti will save them. Not that cost should be the primary consideration when choosing a host, but when they are being overcharged for mediocre service, that becomes persuasive. Also, if they have cPanel, many hosts will migrate a cPanel account for you for free if you open an account with them. Make sure you understand what is happening with their domain-based email before migrating, though.

To get back to the original question of how much of a risk it is, running a site on any server with server software that is no longer being maintained by its publisher (referred to as end of life or end of support) is probably a bad idea. That is why Wordfence and Site Health flag defunct versions. And you should run fast and far from any host that tries to make you purchase a more expensive hosting plan in order to receive an upgrade from expired server software.

Here’s is a page on the PHP site where you can check the status of your version of PHP and where it is in the support cycle. https://www.php.net/supported-versions.php. And here’s a similar chart for MySQL versions: https://en.wikipedia.org/wiki/MySQL#Release_history

In case you’re not aware, since you started this thread, you can re-open it if it gets marked as resolved before your question is fully answered.

I received the same alert from Wordfence regarding a site I manage on Bluehost, which is running MySQL 5.7.23-23 (this is not even the last version of 5.7, which was 5.7.44). 5.7 reached end of life in October 2023, almost a year ago. Despite pointing this out, repeated queries about when they planned to update the server to a secure and current version (which they didn’t answer), and requests to speak to a supervisor (which they also ignored), the Bluehost chatbot told me we would have to update to a VPS plan to get a current version of MySQL!

Note that Bluehost and Hostgator are both owned by Newfold Digital (formerly known as EIG, Endurance Group International) a notorious megahost company that buys up reputable hosts, fires all staff, keeps the label, discontinues support above the chat level, raises prices, and doesn’t tell you that the host you flee to for better service will probably also be owned by them. Their business plan is to lower expectations with these practices so that customers will come to believe nothing better is available. Here is a list of companies owned by Newfold Digital so you can avoid stepping right back into the same situation if you decide to change hosts: https://researchasahobby.com/full-list-eig-hosting-companies-brands/

I also encountered a refusal to run a maintained and current version of MySQL unless I upgraded to a more expensive plan with a site I managed on GoDaddy. They told me the plan would have to be upgraded if I wanted to run a version of MySQL that was not past EOL (End Of Life = no longer receiving support or updates of any kind from the server software publisher, including security updates). the version they were running was not only two years past EOL, it was below the minimum version required to run WordPress. I recommended that the site owner change hosts immediately to preserve the security of the site. He declined to do so, and as I was unwilling to maintain a site with a high risk of being hacked, we parted ways. Two months later he informed me his site had been hacked.

On WPEngine. 3 months before EOL of PHP 8.0, they still hadn’t provided the option to upgrade to 8.1, claiming that it was so similar to 8.0 they had decided to skip it (!). When I asked if they planned to make PHP 8.2 available before 8.0 went EOL, they unapologetically refused to commit to that (as it turned out, they did, barely).

Site managers must not put up with this. There needs to be some kind of hosting industry regulation that requires a minimum of server software that is still being supported by its manufacturer for ALL hosting plans, and that prohibits blackmailing people into upgrading to more expensive plans to get the basics. This practice exploits the fact that a lot of people who manage websites, particularly WordPress websites, don’t know what any of this stuff is, so they don’t understand how outrageous that is.

Here is my chat with Bluehost today. Note that Newfold Digital support does not escalate past the AI-bot. I requested a supervisor three times. Also note the long pauses before each response from them. This chat took half an hour. The chat begins at the bottom and reads up. There was no response for 15 minutes after my last message. Then, an “are you still there – we don’t want to lose you” message, followed by the link to upgrade to VPS again flashed on the chat for about a second, and when I replied with yet another request to speak to a supervisor, the chatbox reset to open a new chat, and the previous messages were all erased. However, having some experience with this kind of tactic, I had already copied them to a file ?? Please feel free to share this chat far and wide.

You said
I want to speak to a supervisor.
5:54 PM

Business said
Please know as I mentioned the plan feature can’t be changed by any persons
please once refer this article : https://www.bluehost.com/help/article/shared-hosting-prices
5:54 PM

You said
I want to speak to a supervisor.
5:52 PM

Business said
Have a nice day
5:52 PM

Business said
if not
5:52 PM

Business said
That is not possible in the shared hosting plan I’m so sorry
Apart from this Is there anything else I can assist you today?
5:52 PM

You said
We are not going to buy VPS to get basic software in a safe, currently supported version. That is the minimum you must provide for ALL hosting plans.
5:50 PM

Business said
Access this link for there plan : https://www.bluehost.com/hosting/vps
5:49 PM

You said
Escalate. This is unacceptable.
5:49 PM

Business said
You aren’t even running the latest version of the expired software ?? >>>> for latest version go for VPS/DED hosting plan
5:49 PM

You said
You also didn’t answer my question about when you plan to update your server to software that is actively supported. That is the absolute minimum you must offer for ANY hosting plan.
5:49 PM

You said
You aren’t even running the latest version of the expired software ??
5:48 PM

You said
You still didn’t answer my question. How do you justify charging for ANY plan on a server with outdated and insecure software?
5:46 PM

Business said
Please know the price which you are paying is for the shared hosting in which we have certain feature, so if you want to get more updated version you need to purchase VPS/DED hosting
5:45 PM

You said
You didn’t answer my question. How do you justify charging us for a hosting account on a server with crucial software that hasn’t been updated in more than 6 years, and for which support ceased a year ago?
5:44 PM

Business said
MySQL Version 5.7.23-23
This is the current version you have
and that can’t be changed in shared hosting
5:43 PM

You said
MySQL 8.0 has been out for 6 years….
5:41 PM

You said
Support for 5.7 ended almost a year ago, which apparently means you are running an insecure version of MySql on a shared server with hundreds of customers. When do you plan to bring your server current?
5:40 PM

Business said
I’m sorry as I mentioned in shared hosting we can’t update that
5:38 PM

You said
That can’t be right. 5.7 is past EOL.
5:36 PM

Business said
in order to do that you need to purchase VPS/DED
5:35 PM

Business said
Upon checking I can see that you have shared hosting account : WordPress Choice Plus Hosting
In which the MySQL can’t be upgraded or changed
5:35 PM

You said
How do I upgrade our MySQL from 5.7 to 8.0?
5:34 PM

And yet, Bluehost is still listed as a “best provider” on https://www.ads-software.com/hosting/

• This reply was modified 3 months, 2 weeks ago by syzygist. Reason: fixed typos

Wordfence, a very popular WordPress security plugin with 5+million installations, has flagged 10 files from your plugin as having been changed from the version of those files in the WordPress repository. Flagging website plugin files that don’t match the version in the WordPress repository is meant to alert users that site files have been changed by malware or hackers, but can also be triggered when plugin authors make change to the plugin files in the WordPress repository without releasing them as a new version. This creates a lot of extra work for people who maintain websites, as they have to investigate ever file to determine whether the change is due to hacking, or poor practices by plugin authors. Please release any file changes as a new version of the plugin, don’t just change the files in the repository without doing that.

This is NOT resolved!

I’m glad to hear it. When will the correctly updated version be posted?

A new update was just released, which claims to fix the issue. I don’t vouch for it one way or the other – I have applied it, but will wait to see whether Wordfence updates their vulnerability report to agree before I accept it as fixed. However, just thought I’d let people who are following the thread know, since the plugin developers still haven’t bothered to reply here.

When are you going to fix this? It has been 6 days since the last update (which did not fix it), and the vulnerability has been public for more than 3 weeks (which means you’ve known about it for a lot longer). Are you even working on a fix? When you have 200,000 users you can’t just go silent like this about a security vulnerability that is affecting thousands of sites. And this is the second time this has happened. Last time, we temporarily removed our gallery, but if you’re going to make a habit of this, I will recommend to clients that we switch to a more reliable plugin with more responsive authors.

I also had this occur on one out of 13 sites I updated today. 7 sites I updated manually, the other 5 auto-updated, and it was one of those that threw the error (it’s the only site I manage on Dreamhost, if that has any relevance). The public site was unaffected, but I couldn’t log in to the admin until I renamed the plugin folder via FTP. Reactivating the plugin caused the problem to recur.

To fix, I deleted the plugin via FTP, then reinstalled it through wp-admin from the zip file that I first downloaded from the repo. I didn’t try installing direct from the repo, so I don’t know whether that would have worked just as well.

Two appreciations I want to mention: One, the restore feature added in this update. I have been using this plugin for many years, and am really excited to see this. The second appreciation is that this incident made me realize how really rare this kind of problem has become. I can’t remember the last time I got a critical error notice and there actually was a problem. I’m not fan of the block builder, but the improved WordPress stability is a great thing.

Excellent! Settings carried over after I made a change, and I can now see results for both checkboxes in the emailed message, though they look a little different, but works for our purposes. Thanks a lot!

Fair enough. VS Contact Form is, after all, a SIMPLE contact form. Thanks a lot for trying to help us out!