NEWS
WordPress Vulnerabilities Digest - September 2022 Part 3
Each vulnerability will have a severity rating oflow, medium, high, or critical. Responsible disclosure and reporting of vulnerabilities is an integral part of keeping the WordPress community safe.
WordPress Core Vulnerabilities
WordPress 6.0.2 was released on August 30, 2022. This security and maintenance release features 12 bug fixes on Core, 5 bug fixes for the Block Editor, and 3 security fixes. Because this is a security release, it is recommended that you update your sites immediately.
No new WordPress core vulnerabilities were disclosed this week.
WordPress Core Dropping Support for WordPress Versions 3.7. 4.0
In more WordPress core security news, the WordPress Security Team will no longer provide security updates for WordPress core versions 3.7 4.0. Please make sure all your WordPress sites are running the latest version.
WordPress Plugin Vulnerabilities
1. Contact Form by WPForms
PLUGIN Contact Form by WPForms Drag & Drop Form Builder for WordPress INSTALLATIONS 5,000,000+ VULNERABILITY Admin+ Arbitrary File Access PATCHED IN VERSION 1.7.5.5 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 1.7.5.5.
2. Sucuri Security
PLUGIN Sucuri Security Auditing, Malware Scanner and Security Hardening INSTALLATIONS 800,000+ VULNERABILITY Event log Entry Creation via CSRF PATCHED IN VERSION 1.8.34 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 1.8.34.
3. Slider, Gallery, and Carousel by MetaSlider
PLUGIN Slider, Gallery, and Carousel by MetaSlider Responsive WordPress Plugin INSTALLATIONS 700,000+ VULNERABILITY Admin+ Stored Cross Site Scripting PATCHED IN VERSION 3.27.9 SEVERITY SCORE Low
The vulnerability has been patched, so you should update to version 3.27.9.
4. Enable Media Replace
PLUGIN Enable Media Replace INSTALLATIONS 600,000+ VULNERABILITY Admin+ Path Traversal PATCHED IN VERSION 4.0.0 SEVERITY SCORE Low
The vulnerability has been patched, so you should update to version 4.0.0.
5. reSmush.it Image Optimizer
PLUGIN reSmush.it : the only free Image Optimizer & compress plugin INSTALLATIONS 200,000+ VULNERABILITY Admin+ Cross-Site Scripting PATCHED IN VERSION 0.4.6 SEVERITY SCORE Low
The vulnerability has been patched, so you should update to version 0.4.6.
6. Download Monitor
PLUGIN Download Monitor INSTALLATIONS 100,000+ VULNERABILITY Admin+ Arbitrary File Download PATCHED IN VERSION 4.5.98 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 4.5.98.
7. Booster for WooCommerce
PLUGIN Booster for WooCommerce INSTALLATIONS 70,000+ VULNERABILITY Subscriber+ Order Status Update PATCHED IN VERSION 5.6.3 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 5.6.3.
8. SearchWP Live Ajax Search
PLUGIN SearchWP Live Ajax Search INSTALLATIONS 60,000+ VULNERABILITY Unauthenticated Local File Inclusion PATCHED IN VERSION 1.6.3 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 1.6.3.
9. WP 2FA
PLUGIN WP 2FA Two-factor authentication for WordPress INSTALLATIONS 30,000+ VULNERABILITY Time-Based Side-Channel Attack PATCHED IN VERSION 2.3.0 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 2.3.0.
10. Top Bar
PLUGIN Top Bar INSTALLATIONS 20,000+ VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION 3.0.4 SEVERITY SCORE Low
The vulnerability has been patched, so you should update to version 3.0.4.
11. Import all XML, CSV & TXT into WordPress
PLUGIN Import all XML, CSV & TXT into WordPress INSTALLATIONS 20,000+ VULNERABILITY Admin+ SQLi; Missing Authorisation PATCHED IN VERSION 6.5.8 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 6.5.8.
12. Advanced Comment Form
PLUGIN Advanced Comment Form INSTALLATIONS 6,000+ VULNERABILITY Admin+ Authenticated Stored XSS PATCHED IN VERSION 1.2.1 SEVERITY SCORE Low
The vulnerability has been patched, so you should update to version 1.2.1.
13. Simple File List
PLUGIN Simple File List INSTALLATIONS 5,000+ VULNERABILITY Page Creation via CSRF; Admin+ Stored Cross-Site Scripting PATCHED IN VERSION 4.4.13 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 4.4.13.
14. Social Rocket
PLUGIN Social Rocket Social Sharing Plugin INSTALLATIONS 3,000+ VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION 1.3.3 SEVERITY SCORE Low
The vulnerability has been patched, so you should update to version 1.3.3.
15. Were Open!
PLUGIN Were Open! INSTALLATIONS 2,000+ VULNERABILITY Admin+ Stored Cross-Site Scripting PATCHED IN VERSION 1.42 SEVERITY SCORE Low
The vulnerability has been patched, so you should update to version 1.42.
16. Multiple Plugins from Viszt Peter Woo Billingo Plus
PLUGIN Woo Billingo Plus INSTALLATIONS 500+ VULNERABILITY Multiple CSRF PATCHED IN VERSION 4.4.5.4 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 4.4.5.4.
17. TaskBuilder
PLUGIN Taskbuilder WordPress Project & Task Management plugin INSTALLATIONS 100+ VULNERABILITY Subscriber+ Stored XSS via SVG file upload PATCHED IN VERSION 1.0.8 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 1.0.8.
18. Multiple Plugins from Viszt Peter Integration for Szamlazz.hu & Gravity Forms
PLUGIN Integration for Szamlazz.hu & Gravity Forms INSTALLATIONS 40+ VULNERABILITY Subscriber+ Stored XSS via SVG file upload PATCHED IN VERSION 1.2.7 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 1.2.7.
19. Multiple Plugins from Viszt Peter Integration for Billingo & Gravity Forms
PLUGIN Integration for Billingo & Gravity Forms INSTALLATIONS 10+ VULNERABILITY Multiple CSRF PATCHED IN VERSION 1.0.4 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 1.0.4.
20. Booster for WooCommerce
PLUGIN Booster Plus for WooCommerce VULNERABILITY Subscriber+ Order Status Update PATCHED IN VERSION 5.6.1 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 5.6.1.
WordPress Plugin Vulnerabilities No Known Fix
Until a patch is available, immediately uninstall and delete the plugin.
Disable User Login
PLUGIN Disable User Login INSTALLATIONS 1,000+ VULNERABILITY Unauthenticated Settings Update PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched. You should deactivate the plugin.
Memberpress Downloads
PLUGIN Memberpress Downloads VULNERABILITY Subscriber+ Arbitrary File Upload PATCHED IN VERSION No Fix SEVERITY SCORE Critical
The vulnerability has not been patched. You should deactivate the plugin.
Cryptocurrency Pricing list and Ticker
PLUGIN Cryptocurrency Pricing list and Ticker VULNERABILITY Reflected Cross-Site Scripting PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.
Search Logger
PLUGIN Search Logger Know What Your Visitors Search VULNERABILITY Admin+ SQLi PATCHED IN VERSION No Fix SEVERITY SCORE Medium
The vulnerability has not been patched and the plugin is closed. You should uninstall and delete the plugin.
WPGateway
PLUGIN WPGateway VULNERABILITY Unauthenticated Privilege Escalation PATCHED IN VERSION No Fix SEVERITY SCORE Critical
The vulnerability has not been patched. You should deactivate the plugin.
WordPress Theme Vulnerabilities
1. Soledad
THEME soledad VULNERABILITY Reflected Cross-site Scripting PATCHED IN VERSION 8.2.5 SEVERITY SCORE Medium
The vulnerability has been patched, so you should update to version 8.2.5.
If you are under WordPress Managed Maintenance plan - there is nothing to worry about as we've taken the necessary steps to protect your sites. Yay!
The information for this blog post was taken from iThemes Vulnerability Roundup
If you're not under our maintenance plan... well, what are you waiting for? Sign-up today!