Wordfence Intelligence Weekly WordPress Vulnerability Report (November 27, 2023 to December 3, 2023)

Wordfence just launched its bug bounty program. Through December 20th 2023, all researchers will earn 6.25x our normal bounty rates when Wordfence handles responsible disclosure for our Holiday Bug Extravaganza! Register as a researcher and submit your vulnerabilities today!

Last week, there were 124 vulnerabilities disclosed in 123 WordPress Plugins and 2 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 39 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 12,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following in real-time to our Premium, Care, and Response customers last week:

• wp-autoload.php backdoor – while we typically write firewall rules for vulnerabilities, we wrote a firewall rule to block successful exploitation of this piece of malware we wrote about here. 
• Backup Migration <= 1.3.6 – Unauthenticated Arbitrary File Download to Sensitive Information Exposure

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Total Vulnerabilities by CVSS Severity Last Week

Total Vulnerabilities by CWE Type Last Week

Researchers That Contributed to WordPress Security Last Week

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through this form. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name	Software Slug
12 Step Meeting List	12-step-meeting-list
360 Javascript Viewer	360deg-javascript-viewer
AMP for WP – Accelerated Mobile Pages	accelerated-mobile-pages
Abandoned Cart Lite for WooCommerce	woocommerce-abandoned-cart
AdFoxly – Ad Manager, AdSense Ads & Ads.txt	adfoxly
Add to Cart Text Changer and Customize Button, Add Custom Icon	woo-add-to-cart-text-change
Ads by datafeedr.com	ads-by-datafeedrcom
Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates	affiliatebooster-blocks
Antispam Bee	antispam-bee
Aparat	aparat
Aruba HiSpeed Cache	aruba-hispeed-cache
Author Box, Guest Author and Co-Authors for Your Posts – Molongui	molongui-authorship
Automatic Youtube Video Posts Plugin	automatic-youtube-video-posts
BSK Forms Blacklist	bsk-gravityforms-blacklist
Backup Migration	backup-backup
Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss	bp-better-messages
BigCommerce For WordPress	bigcommerce
BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin	bookingpress-appointment-booking
BrainCert – HTML5 Virtual Classroom	html5-virtual-classroom
Bravo Translate	bravo-translate
Button Generator – easily Button Builder	button-generation
CF7 Google Sheets Connector	cf7-google-sheets-connector
Campaign Monitor for WordPress	forms-for-campaign-monitor
Chartify – WordPress Chart Plugin	chart-builder
Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back	chat-bubble
Client Dash	client-dash
Coming soon and Maintenance mode	coming-soon-page
CommentLuv	commentluv
Contact Form 7	contact-form-7
Contact Form – Custom Builder, Payment Form, and More	powr-pack
Credit Tracker	credit-tracker
Crypto Converter Widget	crypto-converter-widget
Currency Converter Calculator	currency-converter-calculator
Database for CF7	database-for-cf7
Debug Log Manager	debug-log-manager
Delete Post Revisions In WordPress	delete-post-revisions-on-single-click
Doofinder WP & WooCommerce Search	doofinder-for-woocommerce
Ecwid Ecommerce Shopping Cart	ecwid-shopping-cart
Email Address Encoder	email-address-encoder
Enhanced Text Widget	enhanced-text-widget
Event post	event-post
Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media	evergreen-content-poster
Export WP Page to Static HTML/CSS	export-wp-page-to-static-html
File Gallery	file-gallery
Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms	happyforms
Forms by CaptainForm – Form Builder for WordPress	captainform
Formzu WP	formzu-wp
GDPR Cookie Consent by Supsystic	gdpr-compliance-by-supsystic
Gift Up Gift Cards for WordPress and WooCommerce	gift-up
GoDaddy Email Marketing	godaddy-email-marketing-sign-up-forms
Guest Author	guest-author
HDW Player Plugin (Video Player & Video Gallery)	hdw-player-video-player-video-gallery
HUSKY – Products Filter for WooCommerce Professional	woocommerce-products-filter
Hubbub Lite (formerly Grow Social)	social-pug
IdeaPush	ideapush
Importify – Dropshipping WooCommerce Plugin for Aliexpress, Amazon, Etsy, Alibaba, Walmart & More	importify
Innovs HR – Complete Human Resource Management System for Your Business	innovs-hr-manager
JetBlocks for Elementor	jet-blocks
JetBlog for Elementor	jet-blog
JetCompareWishlist for Elementor	jet-compare-wishlist
JetElements	jet-elements
JetEngine	jet-engine
JetFormBuilder — Dynamic Blocks Form Builder	jetformbuilder
JetMenu for Elementor	jet-menu
JetPopup	jet-popup
JetProductGallery	jet-woo-product-gallery
JetReviews for Elementor	jet-reviews
JetSearch	jet-search
JetSmartFilters for Elementor	jet-smart-filters
JetTabs for Elementor	jet-tabs
JetThemeCore for Elementor	jet-theme-core
JetTricks for Elementor	jet-tricks
JetWooBuilder for Elementor	jet-woo-builder
KP Fastest Tawk.to Chat	kp-fastest-tawk-to-chat
LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing…	ladipage
List all posts by Authors, nested Categories and Titles	list-all-posts-by-authors-nested-categories-and-titles
MSync	msync
Media File Renamer: Rename Files (Manual, Auto & AI)	media-file-renamer
MkRapel Regiones y Ciudades de Chile para WC	wc-ciudades-y-regiones-de-chile
Mollie Payments for WooCommerce	mollie-payments-for-woocommerce
Multiple Post Passwords	multiple-post-passwords
MyTube PlayList	mytube
Nested Pages	wp-nested-pages
NextScripts: Social Networks Auto-Poster	social-networks-auto-poster-facebook-twitter-g
Ocean Extra	ocean-extra
Page Builder: Pagelayer – Drag and Drop website builder	pagelayer
Parallax Slider Block	parallax-slider-block
Participants Database	participants-database
Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina)	wp-retina-2x
PowerPack Pro for Elementor	powerpack-elements
Prevent Landscape Rotation	prevent-landscape-rotation
Product Size Chart For WooCommerce	product-size-chart-for-woo
Qode Essential Addons	qode-essential-addons
Quotes for WooCommerce	quotes-for-woocommerce
Razorpay for WooCommerce	woo-razorpay
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login	custom-registration-form-builder-with-submission-manager
Related Post	related-post
Responsive Lightbox & Gallery	responsive-lightbox
SchedulePress – Best Editorial Calendar, Missed Schedule & Auto Social Share	wp-scheduled-posts
Seraphinite Accelerator	seraphinite-accelerator
Sign In Scheduling Online Appointment Booking System	10to8-online-booking
Simple Long Form	simple-long-form
Site Offline Or Coming Soon Or Maintenance Mode	site-offline
SiteOrigin Widgets Bundle	so-widgets-bundle
Social Share Buttons & Analytics Plugin – GetSocial.io	wp-share-buttons-analytics-by-getsocial
SoundCloud Shortcode	soundcloud-shortcode
SpeedyCache – Cache, Optimization, Performance	speedycache
Spiffy Calendar	spiffy-calendar
Swift Performance Lite	swift-performance-lite
Track Geolocation Of Users Using Contact Form 7	track-geolocation-of-users-using-contact-form-7
UPS, Mondial Relay & Chronopost for WooCommerce – WCMultiShipping	wc-multishipping
WP Catalogue	wp-catalogue
WP CleanFix	wp-cleanfix
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce	wp-event-manager
WP Forms Puzzle Captcha	wp-forms-puzzle-captcha
WP Pocket URLs	wp-pocket-urls
WP Shortcodes Plugin — Shortcodes Ultimate	shortcodes-ultimate
WordPress Brute Force Protection – Stop Brute Force Attacks	guardgiant
YASR – Yet Another Star Rating Plugin for WordPress	yet-another-stars-rating
affiliate-toolkit – WordPress Affiliate Plugin	affiliate-toolkit-starter
canvasio3D Light	canvasio3d-light
teachPress	teachpress
which template file	which-template-file

WordPress Themes with Reported Vulnerabilities Last Week

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

HUSKY – Products Filter for WooCommerce (formerly WOOF) <= 1.3.4.2 – Unauthenticated SQL Injection via search terms

JetEngine <= 3.2.4 – Authenticated (Contributor+) Privilege Escalation

CommentLuv <= 3.0.4 – Server Side Request Forgery via do_click

Backup Migration <= 1.3.6 – Unauthenticated Arbitrary File Download to Sensitive Information Exposure

CF7 Google Sheets Connector <= 5.0.5 – Unauthenticated Sensitive Information Exposure via Debug Log

Multiple Plugins by Crocoblock <= (Various Versions) – Missing Authorization to Unauthenticated Unauthorized Action

MSync <= 1.0.0 – Authenticated (Administrator+) SQL Injection

Mollie Payments for WooCommerce <= 7.3.11 – Authenticated (Shop Manager+) Arbitrary File Upload

BookingPress <= 1.0.76 – Authenticated (Administrator+) Arbitrary File Upload

JetEngine <= 3.2.4 – Missing Authorization

WP Cleanfix <= 5.5.0 – Missing Authorization via register

WordPress Brute Force Protection – Stop Brute Force Attacks <= 2.2.5 – Authenticated (Administrator+) SQL Injection via orderby

Contact Form 7 <= 5.8.3 – Authenticated (Editor+) Arbitrary File Upload

Bravo Translate <= 1.2 – Authenticated (Administrator+) SQL Injection

Chat Bubble <= 2.3 – Cross-Site Request Forgery via cbb_submit_settings_data

Prevent Landscape Rotation <= 2.0 – Cross-Site Request Forgery via adminpage.php

Database for CF7 <= 1.2.4 – Missing Authorization via wpcf7db_delete AJAX action

MkRapel Regiones y Ciudades de Chile para WC <= 4.3.0 – Cross-Site Request Forgery via multiple functions

Product Size Chart For WooCommerce <= 1.1.5 – Cross-Site Request Forgery via get_save_option

Guest Author <= 2.3 – Authenticated Stored Cross-Site Scripting

Powr Pack <= 2.1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

Responsive Lightbox <= 2.4.5 – Authenticated (Author+) Stored Cross-Site Scripting via name

12 Step Meeting List <= 3.14.24 – Authenticated (Contributor+) Server-Side Request Forgery

WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

WP Catalogue <= 1.7.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

Ads by datafeedr.com <= 1.2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

Event post <= 5.8.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

Formzu WP <= 1.6.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via id

Accelerated Mobile Pages <= 1.0.88.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

Currency Converter Calculator <= 1.3.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

10to8 Online Appointment Booking System <= 1.0.9 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

BP Better Messages <= 2.4.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

Email Address Encoder 1.0.22 – Authenticated (Contributor+) Stored Cross-Site Scripting

Parallax Slider Block <= 1.2.4 – Authenticated (Author+) Stored Cross-Site Scripting

Credit Tracker <= 1.1.17 – Authenticated (Contributor+) Stored Cross-Site Scripting

Crypto Converter Widget <= 1.8.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

Affected Software: Crypto Converter Widget
CVE ID: CVE-2023-49150
CVSS Score: 6.4 (Medium)
Researcher/s: Ngô Thiên An (ancorn_)
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/d621869c-31f7-4243-9815-f6d1bbe469e2

Aparat <= 1.7.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

Related Post <= 2.0.53 – Authenticated (Contributor+) Stored Cross-Site Scripting

Spiffy Calendar <= 4.9.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

Multiple Plugins by Crocoblock <= (Various Versions) – Missing Authorization

File Gallery <= 1.8.5.4 – Reflected Cross-Site Scripting via post_id

affiliate-toolkit – WordPress Affiliate Plugin <= 3.4.3 – Reflected Cross-Site Scripting via keyword

NextScripts <= 4.4.2 – Reflected Cross-Site Scripting via code

Adifier (Premium Theme) < 3.1.4 – Reflected Cross-Site Scripting

JetBlocks For Elementor <= 1.3.8 – Reflected Cross Site Scripting

WP Forms Puzzle Captcha <= 4.1 – Cross-Site Request Forgery to Cross-Site Scripting

PowerPack Pro for Elementor <= 2.9.23 – Reflected Cross-Site Scripting

MyTube PlayList <= 2.0.3 – Reflected Cross-Site Scripting via addplaylistid

Seraphinite Accelerator <= 2.20.28 – Reflected Cross-Site Scripting via rt

List all posts by Authors, nested Categories and Title <= 2.7.10 – Cross-Site Scripting

BrainCert – HTML5 Virtual Classroom <= 1.30 – Reflected Cross-Site Scripting

HDW Player Plugin (Video Player & Video Gallery) <= 5.0 – Cross-Site Scripting

Forms by CaptainForm <= 2.5.3 – Reflected Cross-Site Scripting via REQUEST_URI

WP Pocket URLs <= 1.0.2 – Reflected Cross-Site Scripting

Campaign Monitor for WordPress <= 2.8.12 – Reflected Cross-Site Scripting

which template file <= 4.9.0 – Unauthenticated Cross-Site Scripting

Doofinder for WooCommerce <= 2.1.4 – Reflected Cross-Site Scripting

Innovs HR <= 1.0.3.4 – Reflected Cross-Site Scripting

Happyforms <= 1.25.9 – Reflected Cross-Site Scripting

SiteOrigin Widgets Bundle < 1.51.0 – Authenticated (Admin+) Local File Inclusion

Automatic Youtube Video Posts Plugin <= 5.2.2 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

Client Dash <= 2.2.1 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

WP Event Manager <= 3.1.39 – Authenticated (Editor+) Stored Cross-Site Scripting

Download canvasio3D Light <= 2.4.6 – Missing Authorization

Export WP Page to Static HTML/CSS <= 2.1.9 – Missing Authorization via Multiple AJAX Actions

Abandoned Cart Lite for WooCommerce <= 5.16.1 – Missing Authorization via multiple AJAX functions

Chronopost & Mondial relay pour WooCommerce – WCMultiShipping <= 2.3.7 – Incorrect Authorization

Abandoned Cart Lite for WooCommerce <= 5.16.1 – Cross-Site Request Forgery

Social Pug <= 1.20.3 – Missing Authorization via multiple admin_init actions

Enhanced Text Widget <= 1.6.2 – Missing Authorization via etw_hide_admin_notification_callback

360 Javascript Viewer <= 1.7.11 – Missing Authorization

Yet Another Stars Rating <= 3.4.3 – Missing Authorization via init

PageLayer <= 1.7.7 – Cross-Site Request Forgery via pagelayer_load_plugin

Participants Database <= 2.5.5 – Missing Authorization

WP Retina 2x <= 6.4.5 – Sensitive Information Exposure

WP Forms Puzzle Captcha <= 4.1 – Captcha Bypass

Media File Renamer <= 5.6.9 – Sensitive Information Exposure via Log File

Aruba HiSpeed Cache <= 2.0.6 – Sensitive Information Exposure via Log File

Button Generator – easily Button Builder <= 2.3.8 – Missing Authorization

Restricted Site Access <= 7.4.1 – IP Spoofing to Protection Mechanism Bypass

Importify <= 1.0.4 – Unauthenticated Sensitive Information Exposure

Swift Performance Lite <= 2.3.6.14 – Missing Authorization to Unauthenticated Settings Export

Gift Up 2.21.3 – Cross-Site Request Forgery via consume_post

teachPress <= 9.0.4 – Cross-Site Request Forgery

Coming soon and Maintenance mode <= 3.7.3 – IP Address Spoofing via get_real_ip

JetElements For Elementor <= 2.6.13 – Missing Authorization to Unauthenticated Arbitrary Attachment Download

BigCommerce <= 5.0.6 – Unauthenticated Sensitive Information Exposure

JetFormBuilder <= 3.1.4 – Unauthenticated Content Injection

Antispam Bee <= 2.11.3 – IP Address Spoofing via get_client_ip

KP Fastest Tawk.to Chat <= 1.1.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

GDPR Cookie Consent by Supsystic <= 2.1.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

Molongui <= 4.6.19 – Authenticated (Administrator+) Stored Cross-Site Scripting

Chart Builder <= 1.9.6 – Authenticated (Admin+) Stored Cross-Site Scripting

SoundCloud Shortcode <= 3.1.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

Social Share Buttons & Analytics Plugin – GetSocial.io <= 4.3.12 – Authenticated (Administrator+) Stored Cross-Site Scripting

Simple Long Form <= 2.2.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

Track Geolocation Of Users Using Contact Form 7 <= 1.4 – Authenticated (Administrator+) Stored Cross-Site Scripting

BSK Forms Blacklist <= 3.6.3 – Authenticated (Admin+) Stored Cross-Site Scripting

Multiple Post Passwords <= 1.1.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

Site Offline <= 1.5.6 – Authenticated (Administrator+) Stored Cross-Site Scripting

Evergreen Content Poster <= 1.3.6.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

Nested Pages <= 3.2.6 – Authenticated (Administrator+) Stored Cross-Site Scripting

Multiple Plugins by Crocoblock <= (Various Versions) – Cross-Site Request Forgery

teachPress <= 9.0.5 – Cross-Site Request Forgery via delete_database()

Qode Essential Addons <= 1.5.2 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation

WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 – Insecure Direct Object Reference to Information Disclosure

IdeaPush <= 8.53 – Missing Authorization

Quotes for WooCommerce <= 2.0.1 – Missing Authorization

Quotes for WooCommerce <= 2.0.1 – Cross-Site Request Forgery

RegistrationMagic <= 5.2.2.6 – Cross-Site Request Forgery

Debug Log Manager <= 2.2.0 – Cross-Site Request Forgery

LadiApp <= 4.3 – Missing Authorization

Ocean Extra <= 2.2.2 – Cross-Site Request Forgery to Arbitrary Plugin Activation

SpeedyCache <= 1.1.2 – Missing Authorization via speedycache_create_test_cache

Button Generator – easily Button Builder <= 2.3.8 – Cross-Site Request Forgery

Add to Cart Text Changer and Customize Button, Add Custom Icon <= 2.0 – Cross-Site Request Forgery via wactc_text_form

GoDaddy Email Marketing <= 1.4.3 – Missing Authorization

SchedulePress <= 5.0.4 – Insufficient Authorization to Authenticated (Contributor+) Arbitrary Post Modifications

Ecwid Ecommerce Shopping Cart <= 6.12.4 – Cross-Site Request Forgery

AdFoxly – Ad Manager, AdSense Ads & Ads.txt <= 1.8.5 – Cross-Site Request Forgery

Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates <= 3.0.4 – Cross-Site Request Forgery via process_bulk_action

Razorpay for WooCommerce <= 4.5.6 – Cross-Site Request Forgery

Delete Post Revisions In WordPress <= 4.6 – Cross-Site Request Forgery

Razorpay for WooCommerce <= 4.5.6 – Missing Authorization

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us using our CVE Request form, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (November 27, 2023 to December 3, 2023) appeared first on Wordfence.