NEWS
WordPress Vulnerabilities Digest - March 2022 Part 3
Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe.
WordPress Core Vulnerabilities
WordPress 5.9.2 was released on March 11, 2022, as a security and maintenance release with 1 bug fixe and 3 security fixes. Because this is a security release, be sure to update to WordPress 5.9.2 as soon as possible!
1. WordPress Core
VULNERABILITY Prototype Pollution in jQuery PATCHED IN VERSION 5.9.2 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 5.9.2.
2. WordPress Core
VULNERABILITY Contributor+ Stored Cross-Site Scripting PATCHED IN VERSION 5.9.2 SEVERITY SCORE High
The vulnerability has been patched, so you should update to version 5.9.2.
3. WordPress Core
VULNERABILITY Prototype Pollution via Gutenbergs WordPress/url package PATCHED IN VERSION 5.9.2 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 5.9.2.
WordPress Plugin Vulnerabilities
1. WooCommerce
PLUGIN WooCommerce INSTALLATIONS 5,000,000+ VULNERABILITY Orders Marked as Paid (via PayPal Standard Gateway) PATCHED IN VERSION 6.3.1 SEVERITY SCORE Low
The vulnerability has been patched, so you should update to version 6.3.1.
2. UpdraftPlus
PLUGIN UpdraftPlus WordPress Backup Plugin INSTALLATIONS 3,000,000+ VULNERABILITY Reflected Cross-Site Scripting PATCHED IN VERSION 1.22.9 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 1.22.9.
3. Gutenberg
PLUGIN Gutenberg INSTALLATIONS 300,000+ VULNERABILITY Contributor+ Stored Cross-Site Scripting; Prototype Pollution via Gutenbergs WordPress/url package PATCHED IN VERSION 12.7.2 SEVERITY SCORE High
The vulnerability has been patched, so you should update to version 12.7.2.
4. Ad Inserter
PLUGIN Ad Inserter Ad Manager & AdSense Ads INSTALLATIONS 200,000+ VULNERABILITY Reflected Cross-Site Scripting PATCHED IN VERSION 2.7.12 SEVERITY SCORE Low
The vulnerability has been patched, so you should update to version 2.7.12.
5. MapPress Maps for WordPress
PLUGIN MapPress Maps for WordPress INSTALLATIONS 60,000+ VULNERABILITY Admin+ File Upload to Remote Code Execution PATCHED IN VERSION 2.73.13 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 2.73.13.
6. Profile Builder
PLUGIN Profile Builder User Profile & User Registration Forms INSTALLATIONS 50,000+ VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION 3.6.8 SEVERITY SCORE Low
The vulnerability has been patched, so you should update to version 3.6.8.
7. Amelia < 1.0.48
PLUGIN Amelia Events & Appointments Booking Calendar INSTALLATIONS 40,000+ VULNERABILITY Customer+ SMS Service Abuse and Sensitive Data Disclosure; Customer+ Arbitrary Appointments Status Update PATCHED IN VERSION 1.0.49 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 1.0.49.
8. Easy Social Icons
PLUGIN Easy Social Icons INSTALLATIONS 40,000+ VULNERABILITY Admin+ SQL Injection PATCHED IN VERSION 3.1.4 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 3.1.4.
9. Google Pagespeed Insights
PLUGIN Insights from Google PageSpeed INSTALLATIONS 30,000+ VULNERABILITY Reflected Cross-Site Scripting PATCHED IN VERSION 4.0.4 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 4.0.4.
10. WP Block and Stop Bad Bots
PLUGIN Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection INSTALLATIONS 10,000+ VULNERABILITY Unauthenticated SQLi PATCHED IN VERSION 6.88 SEVERITY SCORE High
The vulnerability has been patched, so you should update to version 6.88.
11. Booking Package
PLUGIN Booking Package Appointment Booking Calendar System INSTALLATIONS 9,000+ VULNERABILITY Unauthenticated Sensitive Data Disclosure PATCHED IN VERSION 1.5.29 SEVERITY SCORE High
The vulnerability has been patched, so you should update to version 1.5.29.
12. Ad Inserter
PLUGIN Ad Inserter Pro INSTALLATIONS Unknown VULNERABILITY Reflected Cross-Site Scripting PATCHED IN VERSION 2.7.12 SEVERITY SCORE Low
The vulnerability has been patched, so you should update to version 2.7.12.
13. Members List
PLUGIN Members List Plugin INSTALLATIONS Unknown VULNERABILITY Reflected Cross-Site Scripting PATCHED IN VERSION 4.3.7 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 4.3.7.
14. Ninja Forms File Uploads Extension
PLUGIN Ninja Forms File Uploads Extension INSTALLATIONS Unknown VULNERABILITY Unauthenticated Arbitrary File Upload PATCHED IN VERSION 3.3.1 SEVERITY SCORE Critical
The vulnerability has been patched, so you should update to version 3.3.1.
15. Ninja Forms File Uploads Extension
PLUGIN Ninja Forms File Uploads Extension INSTALLATIONS Unknown VULNERABILITY Unauthenticated Stored Cross-Site Scripting PATCHED IN VERSION 3.3.13 SEVERITY SCORE High
The vulnerability has been patched, so you should update to version 3.3.13.
16. Mark Posts
PLUGIN Mark Posts INSTALLATIONS Unknown VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION 2.0.1 SEVERITY SCORE Low
The vulnerability has been patched, so you should update to version 2.0.1.
WordPress Plugin Vulnerabilities No Known Fix
Dropdown Menu Widget
PLUGIN Dropdown Menu Widget VULNERABILITY Subscriber+ Arbitrary Settings Update to Stored XSS PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched. You should deactivate the plugin.
Library File Manager
PLUGIN Library File Manager VULNERABILITY Subscriber+ Arbitrary File Creation/Upload/Deletion PATCHED IN VERSION No Fix SEVERITY SCORE Critical
The vulnerability has not been patched. You should deactivate the plugin.
KingComposer
PLUGIN Page Builder: KingComposer Free Drag and Drop page builder by King-Theme VULNERABILITY Subscriber+ Stored Cross-Site Scripting PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched. You should deactivate the plugin.
FormBuilder
PLUGIN FormBuilder VULNERABILITY Stored Cross-Site Scripting via CSRF PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched. You should deactivate the plugin.
Material Design for Contact Form 7
PLUGIN Material Design for Contact Form 7 VULNERABILITY Subscriber+ Arbitrary Settings Update leading to DoS PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched. You should deactivate the plugin.
Updates Continue for 400+ Plugins, Themes Impacted by Insecure Freemius Version
Last week, it was discovered that many plugins and themes are using an insecure version of the Freemius Framework, which is used to power their upsell paths from free to Pro.
As of this report, over 400 plugins and 25 themes are impacted. Because the list is so large, were linking directly to the WPScan vulnerability disclosure for the latest information about patches.
WordPress Theme Vulnerabilities
Good news! No new WordPress theme vulnerabilities were disclosed this week.
If you are under WordPress Managed Maintenance plan - there is nothing to worry about as we've taken the necessary steps to protect your sites. Yay!
The information for this blog post was taken from iThemes Vulnerability Roundup
If you're not under our maintenance plan... well, what are you waiting for? Sign-up today!