MageReport.com reported today that they released a new check concerning a recently discovered backdoor in the module Webgility.

While their tool is very helpful in scanning the site and asserting whether our site is vulnerable or not, they do not provide steps for fixing the issue.

Does anyone know what the vulnerability is and what immediate steps can be taken besides for disabling the module? To the best of my knowledge, Webgility has not released an updated module.


So, it turns out that as per Willem de Groot's post - webgility was made aware of the flaw and are apparently not taking it seriously.

The fix according to Willem is to restrict access to the webgility directory to recognized IP addresses.


We have released the patch of Webgility Store Module. Please refer our blog for complete details. https://www.webgility.com/blog/security-vulnerability-update/

  • 2
    on your blog post you write that None of our customers’ stores or data have been breached. - that's a pretty bold statement to make - our customer's store was breached – Haim Nov 22 '18 at 16:05
  • Hello Haim, Please let us know which customer's store was breached so that we can contact him and update their module. – Brajkishor Shacywar Nov 23 '18 at 16:09
  • please release a downloadable plugin. – Kalvin Klien Nov 27 '18 at 18:25

That's what we're trying; IP restriction only allowing client's hosted Quickbooks to access that.

Just took over this project but so far many other issues with webgility. Longer term solution is ditching quickbooks and the need for webgility

  • did you figure out which IP addresses they use to connect or is it the client IP address that connects to the store? – Kalvin Klien Nov 19 '18 at 4:34
  • Actually we tried to lock down to only the IP from Webgility desktop to magento and it did not work. Webgility would not connect. Need to get in touch with Webgility for a working solution. They provided a patch but client had not updated in some time so it changes 100's of lines of code. No bandwidth this week (Black Friday) to properly vet that. – JSMD Nov 20 '18 at 20:43
  • 1
    I will be testing a solution today, I just found a list of IP addresses that belong to Webgility. I'll post them here if you need. – Kalvin Klien Nov 21 '18 at 21:59
  • Any details would be super appreciated if works for you. Been hard to fit this in the schedule but also have a sense of dread... – JSMD Nov 26 '18 at 1:33
  • Apologies, here is contents of .htaccess: pastebin.com/FxyD9UGq This is untested yet - we have been concentrating on other things. If this doesnt work, try to tail -f on your access logs and see which IP addresses are hitting your website. – Kalvin Klien Nov 27 '18 at 4:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.