Wordfence Intelligence Weekly WordPress Vulnerability Report (December 18, 2023 to December 31, 2023)

Wordfence just launched its bug bounty program. For the first 6 months, all awarded bounties receive a 10% bonus. View the announcement to learn more now!

Over the last two weeks, there were 263 vulnerabilities disclosed in 217 WordPress Plugins and 3 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 42 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 12,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Two Weeks

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

• Directory Traversal via HTTP Headers

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Total Vulnerabilities by CVSS Severity Last Week

Total Vulnerabilities by CWE Type Last Week

Researchers That Contributed to WordPress Security Last Week

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through this form. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

WordPress Themes with Reported Vulnerabilities Last Week

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

BERTHA AI Plugin <= 1.11.10.7 – Unauthenticated Arbitrary File Upload

WebinarIgnition <= 3.05.0 – Missing Authorization to Unauthenticated Privilege Escalation

Piotnet Forms Plugin <= 1.0.25 – Unauthenticated Arbitrary File Upload

WP Clone <= 2.4.2 – Sensitive Information Exposure

Rencontre – Dating Site <= 3.10.1 – Unauthenticated Arbitrary File Upload

Login as User or Customer (User Switching) <= 3.8 – Authentication Bypass

Build App Online <= 1.0.19 – Account Takeover via Weak Password Reset Mechanism

Frontend Admin by DynamiApps Plugin <= 3.18.3 – Unauthenticated Arbitrary File Upload

JS Help Desk <= 2.8.1 – Unauthenticated SQL Injection via email and trackingid

Checkout Mestres WP <= 7.1.9.6 – Authentication Bypass via Password Reset

Checkout Mestres WP <= 7.1.9.6 – Missing Authorization to Unauthenticated Arbitrary Options Update

WP Frontend Profile <= 1.3.1 – Unauthenticated Privilege Escalation

WP MLM Unilevel <= 4.0 – Unauthenticated Privilege Escalation

TerraClassifieds <= 2.0.3 Unauthenticated Arbitrary File Upload

Rencontre – Dating Site <= 3.10.1 – Privilege Escalation

WP MLM <= 4.0 – Unauthenticated Arbitrary File Upload

Theme per user <= 1.0.1 – Unauthenticated PHP Object Injection

Active Products Tables for WooCommerce <= 1.0.6 – Unauthenticated PHP Object Injection

Checkout Mestres WP <= 7.1.9.6 – Unauthenticated SQL Injection

WebinarIgnition <= 3.05.0 – Unauthenticated SQL Injection

Recipe Maker For Your Food Blog from Zip Recipes <= 8.1.0 – Authenticated(Contributor+) SQL Injection

WP Mail Log Plugin <= 1.1.2 – Authenticated(Contributor+) Arbitrary File Upload

Ultimate Addons for Beaver Builder <= 1.35.14 – Authenticated(Contributor+) Privilege Escalation

ARI Stream Quiz <= 1.3.0 – Authenticated (Contributor+) PHP Object Injection

TerraClassifieds <= 2.0.3 – Cross-Site Request Forgery

Verge3D <= 4.5.2 – Authenticated(Subscriber+) Arbitrary File Upload

Rencontre – Dating Site <= 3.11.1 – Authenticated (Subscriber+) PHP Object Injection

MF Gig Calendar <=1.2.1 – Authenticated(Contributor+) SQL Injection

Job Manager & Career – Manage job board listings, and recruitments <= 1.4.4 – Cross-Site Request Forgery to PHP Object Injection

Booking Manager <= 2.1.5 – Authenticated(Contributor+) SQL Injection via Shortcode

JVM rich text icons <= 1.2.6 – Directory Traversal to Authenticated(Subscriber+) Arbitrary File Deletion

Uncode Core <= 2.8.8 – Privilege Escalation

Events Shortcodes & Templates For The Events Calendar <= 2.3.1 – Authenticated (Contributor+) SQL Injection via shortcode

ARMember <= 4.0.10 – Authenticated(Subscriber+) Privilege Escalation

JVM rich text icons <= 1.2.3 – Authenticated(Subscriber+) Arbitrary File Upload

BookingPress <= 1.0.72 – Authenticated (Contributor+) SQL Injection

Build App Online <= 1.0.19 – Missing Authorization Authenticated(Subscriber+) Arbitrary Options Update

Most And Least Read Posts Widget <=2.5.16 – Authenticated(Contributor+) SQL Injection via Widget settings

Uncode Core <= 2.8.8 – Authenticated (Subscriber+) Arbitrary File Deletion

Backup Migration 1.0.8 – 1.3.9 – Remote File Inclusion via content-dir

Backup Migration <= 1.3.9 – Unauthenticated Path Traversal to Arbitrary File Deletion

Everest Backup <= 2.1.9 – Sensitive Information Exposure via Log File

WP Stripe Checkout <= 1.2.2.37 – Sensitive Information Exposure via Debug Log

WC Marketplace <= 4.0.23 – Missing Authorization via mvx_save_dashpages

WebinarIgnition <= 3.05.0 – Authenticated(Subscriber+) PHP Object Injection

Local Delivery Drivers for WooCommerce <= 1.9.0 – Missing Authorization to Driver Account Takeover

Custom 404 Pro <= 3.10.0 – Unauthenticated Stored Cross-Site Scripting via logging

WooCommerce PDF Invoices <= 4.2.1 – Authenticated(Shop Manager+) Arbitrary Options Update via JSON Import

Welcart e-Commerce <= 2.9.3 – Authenticated(Editor+) SQL Injection

Backup Migration <= 1.3.9 – Authenticated (Admin+) OS Command Injection via url

Clockwork SMS Notfications <= 3.0.4 – Authenticated(Administrator+) SQL Injection

Media File Renamer <= 5.7.7 – Authenticated(Administrator+) Remote Code Execution

E2Pdf <= 1.20.23 – Authenticated(Administrator+) SQL Injection

404 Solution <= 2.34.0 – Authenticated(Administrator+) SQL Injection

Mail logging – WP Mail Catcher <= 2.1.3 – Authenticated(Administrator+) SQL Injection

WP Adminify <= 3.1.6 – Authenticated(Administrator+) SQL Injection

Page Generator <= 1.7.1 – Authenticated(Administrator+) SQL Injection

Simply Schedule Appointments <= 1.6.5.27 – Authenticated(Administrator+) SQL Injection

Pre* Party Resource Hints <= 1.8.18 – Authenticated(Administrator+) SQL Injection

Login Lockdown – Protect Login Form <= 2.06 – Authenticated(Administrator+) SQL Injection

YITH WooCommerce Product Add-Ons <= 4.3.0 – Authenticated(Shop Manager+) PHP Object Injection

Fluent Support <= 1.7.6 – Authenticated(Administrator+) SQL Injection

Automation By Autonami <= 2.6.1 – Authenticated(Administrator+) SQL Injection

Store Locator WordPress <= 1.4.14 – Authenticated(Administrator+) Directory Traversal to Arbitrary File Deletion

Squirrly SEO – Advanced Pack <= 2.3.8 – Authenticated(Administrator+) SQL Injection

GEO my WordPress <= 4.0.2 – Authenticated(Administrator+) SQL Injection

RegistrationMagic Plugin <= 5.2.4.5 – Authenticated(Administrator+) SQL Injection

WS Form LITE <= 1.9.170 – Authenticated(Administrator+) SQL Injection

GeoDirectory <= 2.3.28 – Authenticated(Administrator+) SQL Injection

Funnel Builder for WordPress by FunnelKit <= 2.14.3 – Authenticated(Administrator+) SQL Injection

Advanced Form Integration <= 1.75.0 – Authenticated(Administrator+) SQL Injection

BookIt <= 2.4.3 – Authenticated(Administrator+) SQL Injection

EnvíaloSimple <= 2.1 Unauthenticated PHP Object Injection

WooCommerce Stripe Payment Gateway <= 7.6.1 – Insecure Direct Object Reference via update_payment_intent_ajax

Affiliates Manager <= 2.9.31 – Cross-Site Request Forgery via multiple AJAX actions

FunnelKit Checkout <= 3.10.3 – Unauthenticated Arbitrary Content Deletion

Piotnet Forms <= 1.0.25 – Missing Authorization via multiple AJAX actions

weForms <= 1.6.18 – Missing Authorization via export_form_entries

Sensei LMS <= 4.17.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

Schema & Structured Data for WP & AMP <= 1.23 – Authenticated (Contributor+) Stored Cross-Site Scripting

Product Code for WooCommerce <= 1.4.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

Icegram <= 3.1.19 – Authenticated (Contributor+) Stored Cross-Site Scripting via Campaign Message

Insert or Embed Articulate Content into WordPress <= 4.3000000021 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

WooCommerce Menu Extension <= 1.6.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

Active Products Tables for WooCommerce <= 1.0.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

WP Crowdfunding <= 2.1.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

Pay with Vipps for WooCommerce <= 1.14.13 – Authenticated (Contributor+) Stored Cross-Site Scripting

Colibri Page Builder <= 1.0.239 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Booking for Appointments and Events Calendar – Amelia <= 1.0.85 – Stored Cross-Site Scripting via Shortcode

My Agile Privacy <= 2.1.7 – Authenticated (Contributor+) Stored Cross-Site Scripting vis Shortcode

WP Tabs <= 2.2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

Currency Converter Widget <= 3.0.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

Colibri Page Builder <= 1.0.240 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Zoho Forms <= 3.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Advanced Access Manager <= 6.9.15 – Authenticated (Contributor+) Stored Cross-Site Scripting

WP Affiliate Disclosure <= 1.2.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via $id

Seos Contact Form <= 1.8.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

HashBar – WordPress Notification Bar <= 1.4.1 – Authenticated (Author+) Stored Cross-Site Scripting

WPCS – WordPress Currency Switcher Professional <= 1.2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

WP Remote Site Search <= 1.0.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

CURCY – Multi Currency for WooCommerce <= 2.2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

If-So Dynamic Content Personalization <= 1.6.3.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

Auto Amazon Links <= 5.3.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

Limit Login Attempts Reloaded <= 2.25.26 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Divi <= 4.23.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

iframe Shortcode <= 2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

Restaurant Reservations <= 1.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

CSS & JavaScript Toolbox <= 11.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

WordPress.com Editing Toolkit <= 3.78784 – Authenticated (Contributor+) Stored Cross-Site Scripting

BuddyPress <= 11.3.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

Stock Ticker <= 3.23.4 – Authenticated (Contributor+) Stored Cross-Site Scritping

Back Button Widget <= 1.6.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Easy Video Player <= 1.2.2.10 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

AMP for WP – Accelerated Mobile Pages <= 1.0.92 – Authenticated (Contributor+) Cross-Site Scripting via Shortcode

WP User Profile Avatar <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

Dan’s Embedder for Google Calendar <= 1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

CBX Bookmark & Favorite <= 1.7.13 – Authenticated (Contributor+) Stored Cross-Site Scripting

Easy Digital Downloads <= 3.2.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

WordPress Infinite Scroll – Ajax Load More <= 6.1.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

Themify Icons <= 2.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

Advanced Access Manager <= 6.9.18 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Simple Membership <= 4.3.8 – Reflected Cross-Site Scripting

Simple Membership <= 4.3.8 – Reflected Cross-Site Scripting Vulnerability via environment_mode

WP Google Maps <= 9.0.27 – Unauthenticated Stored Cross-Site Scripting via REST API

New User Approve <= 2.5.1 – Cross-Site Request Forgery via admin_notices

HT Mega – Absolute Addons For Elementor <= 2.3.8 – Reflected Cross-Site Scripting

Impreza <= 8.17.4 – Reflected Cross-Site Scripting

TheGem <= 5.9.1 – Reflected Cross-Site Scripting

Crowdsignal Dashboard – Polls, Surveys & more <= 3.0.11 – Reflected Cross-Site Scripting

Google Photos Gallery with Shortcodes <= 4.0.2 – Reflected Cross-Site Scripting

Uncode Core <= 2.8.6 – Reflected Cross-Site Scripting

HTML Forms <= 1.3.28 – Authenticated (Administrator+) Cross-Site Scripting

NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.5 – Authenticated (Admin+) SQL Injection

ZeroBounce Email Verification & Validation <= 1.0.11 – Authenticated (Administrator+) Stored Cross-Site Scripting

Stylish Price List <= 7.0.17 – Missing Authorization

JSM file_get_contents() Shortcode <= 2.7.0 – Authenticated (Contributor+) Server-Side Request Forgery via Shortcode

Simple Staff List <= 2.2.4 – Missing Authorization via ajax_flush_rewrite_rules and staff_member_export

ARI Stream Quiz <= 1.2.32 – Cross-Site Request Forgery

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

Happy Addons for Elementor <= 3.9.1.1 – Server Side Request Forgery (SSRF)

Molongui <= 4.7.3 – Missing Authorization

FOX – Currency Switcher Professional for WooCommerce <= 1.4.1.6 – Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

Doofinder for WooCommerce <= 2.0.33 – Missing Authorization via multiple AJAX actions

Business Directory Plugin <= 6.3.9 – Missing Authorization via dispatch

Essential Blocks for Gutenberg <= 4.2.0 – Incorrect Authorization Checks

WooCommerce Warranty Requests <= 2.2.7 – Missing Authorization

Block IPs for Gravity Forms <= 1.0.1 – Cross-Site Request Forgery

WP Optin Wheel <= 1.4.2 – Sensitive Information Exposure via Log File

Rate my Post – WP Rating System <= 3.4.2 – IP Address Spoofing

Customer Reviews for WooCommerce <= 5.38.1 – Missing Authorization via CR_Manual

Poll Maker <= 4.8.0 – Missing Authorization

Paid Memberships Pro <= 2.12.5 – Missing Authorization via API

AI Power: Complete AI Pack – Powered by GPT-4 <= 1.8.1 – Missing Authorization to Sensitive Data Exposure

Database Cleaner <= 0.9.8 – Sensitive Information Exposure via Log File

Beaver Builder – WordPress Page Builder <= 2.7.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

RegistrationMagic <= 5.2.5.0 – IP Spoofing

MC4WP <= 4.9.9 – Missing Authorization via listen

Product Catalog Simple <= 1.7.6 – Sensitive Information Exposure via Product CSV

Uncanny Automator <= 5.1.0.2 – Sensitive Information Exposure via Log File

LA-Studio Element Kit for Elementor <= 1.1.5 – Missing Authorization

WooCommerce Canada Post Shipping <= 2.8.3 – Missing Authorization

Branda <= 3.4.14 – IP Address Spoofing

Send Users Email <= 1.4.3 – Sensitive Information Exposure via Error Logs

User Feedback <= 1.0.10 – Missing Authorization

WooPayments – Fully Integrated Solution Built and Supported by Woo <= 6.6.2 – Unauthenticated Insecure Direct Object Reference

404 Solution <= 2.33.0 – Sensitive Information Exposure via Log File

WP User Profile Avatar <= 1.0.0 – Authenticated (Author+) Insecure Direct Object Reference to Avatar Deletion/Update

Awesome Support <= 6.1.5 – Missing Authorization via wpas_load_reply_history

RegistrationMagic <= 5.2.5.0 – Form Submission Limit Bypass

Quiz And Survey Master <= 8.1.16 – Missing Authorization

Defender Security <= 4.1.0 – Sensitive Information Exposure via Log File

Metform Elementor Contact Form Builder <= 3.4.0 – Missing Authorization via submit

Affiliates Manager <= 2.9.30 – Sensitive Information Exposure via Log File

Conversios.io <= 6.5.0 – Missing Authorization

eCommerce Product Catalog <= 3.3.26 – Sensitive Information Exposure via CSV Files

FastDup <= 2.1.7 – Sensitive Information Exposure via Log File

All-in-one Floating Contact Form – My Sticky Elements <= 2.1.3 – Missing Authorization

WooCommerce Warranty Requests <= 2.2.7 – Missing Authorization

Everest Forms <= 2.0.3 – Unauthorized Form Submission via Disabled Forms

BuddyBoss Theme <= 2.4.60 – Missing Authorization

Easy Digital Downloads <= 3.1.5 – Missing Authorization

Image Source Control <= 2.17.0 – Sensitive Information Exposure via Log File

WooCommerce Product Vendors <= 2.2.2 – Missing Authorization

Malware Scanner <= 4.7.1 – IP Spoofing

WooCommerce Product Vendors <= 2.2.1 – Missing Authorization

iFrame <= 4.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via srcdoc

Enable Media Replace <= 4.1.4 – Reflected Cross-Site Scripting

Menu Image, Icons made easy <= 3.10 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

Ultimate Dashboard <= 3.7.11 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

Accredible Certificates & Open Badges <= 1.4.8 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

Photo Gallery by 10Web <= 1.8.18 – Authenticated (Administrator+) Stored Cross-Site Scripting via Widget

Everest Forms <= 2.0.4.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

WP Review Slider <= 12.7 – Authenticated (Administrator+) Stored Cross-Site Scripting

WP Chat App <= 3.4.4 – Authenticated (Administrator+) Stored Cross-Site Scripting

weForms – Easy Drag & Drop Contact Form Builder For WordPress <= 1.6.17 – Authenticated (Admin+) Stored Cross-Site Scripting

Brave Popup Builder <= 0.6.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

Sticky Chat Widget <= 1.1.8 – Authenticated (Administrator+) Stored Cross-Site Scripting

Event Management Tickets Booking <= 1.3.2 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

Multi Step Form <= 1.7.13 – Authenticated (Administrator+) Stored Cross-Site Scripting

Custom Post Carousels with Owl <= 1.4.6 – Authenticated (Editor+) Stored Cross-Site Scripting

CRM Perks Forms <= 1.1.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

Simple Counter <= 1.0.2 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

WP Edit Username <= 1.0.5 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

Loan Repayment Calculator and Application Form <= 2.9.3 – Authenticated (Admin+) Stored Cross-Site Scripting

WooCommerce Easy Duplicate Product <= 0.3.0.7 – Missing Authorization via wedp_duplicate_product_action

EnvíaloSimple <= 2.1 – Cross-Site Request Forgery

Simple Job Board <= 2.10.6 – Cross-Site Request Forgery

Webba Booking <= 4.5.33 – Cross-Site Request Forgery

Spam protection, AntiSpam, FireWall by CleanTalk <= 6.20 – Cross-Site Request Forgery via apbct_settings__update_account_email

Custom Twitter Feeds (Tweets Widget) <= 2.1.2 – Cross-Site Request Forgery

Republish Old Posts <= 1.21 – Cross-Site Request Forgery via rop_options_page

Advanced Access Manager <= 6.9.18 – Authenticated (Author+) Open Redirect

Floating Button <= 6.0 – Cross-Site Request Forgery via process_bulk_action

Rise Blocks – A Complete Gutenberg Page Builder <= 3.1 – Cross-Site Request Forgery

WP Simple Booking Calendar <= 2.0.8.4 – Cross-Site Request Forgery

Icegram <= 3.1.18 – Cross-Site Request Forgery via save_campaign_preview

White Label <= 2.9.0 – Cross-Site Request Forgery via white_label_reset_wl_admins

Ultimate Addons for Beaver Builder <= 1.35.13 – Authenticated(Contributor+) Directory Traversal to Arbitrary File Download

HUSKY – Products Filter for WooCommerce (formerly WOOF) <= 1.3.4.3 – Cross-Site Request Forgery

Duplicator <= 1.5.7 – Cross-Site Request Forgery via views/tools/diagnostics/information.php

Quiz And Survey Master <= 8.1.18 – Cross-Site Request Forgery

Thrive Automator <= 1.17 – Cross-Site Request Forgery

Spam protection, AntiSpam, FireWall by CleanTalk <= 6.20 – Cross-Site Request Forgery

WPC Product Bundles for WooCommerce <= 7.3.1 – Cross-Site Request Forgery

GPT3 AI Content Writer <= 1.8.12 – Cross-Site Request Forgery

Apollo13 Framework Extensions <= 1.9.1 – Cross-Site Request Forgery

WooCommerce Ship to Multiple Addresses <= 3.8.9 – Missing Authorization

WooCommerce PDF Invoice Builder <= 1.2.101 – Cross-Site Request Forgery

Paid Member Subscriptions <= 2.10.4 – Cross-Site Request Forgery via ajax_add_log_entry

HT Mega <= 2.3.3 – Cross-Site Request Forgery via Several Functions

FunnelKit Checkout <= 3.10.3 – Authenticated(Subscriber+) Missing Authorization to Arbitrary Plugin Activation

ProfileGrid <= 5.6.6 – Missing Authorization

Dynamic Content for Elementor < 2.12.5 – Cross-Site Request Forgery

Product Filter by WBW <= 2.5.0 – Missing Authorization via getListForTbl

Export Media URLs <= 1.0 – Cross-Site Request Forgery

Calculated Fields Form <= 1.2.28 – Authenticated (Contributor+) Open Redirect via Shortcode

Inline Image Upload for BBPress <= 1.1.18 – Cross-Site Request Forgery via hm_bbpui_admin_page

WooCommerce Shipping Per Product <= 2.5.4 – Missing Authorization

Easy PayPal Buy Now Button <= 1.8.1 – Cross-Site Request Forgery

BulkGate SMS Plugin for WooCommerce <= 3.0.2 – Missing Authorization via Multiple AJAX Actions

FunnelKit Checkout <= 3.10.3 – Authenticated(Subscriber+) Missing Authorization to Settings Change

Booster Elite for WooCommerce <= 7.1.2 – Authenticated(Subscriber+) Content Injection

MStore API <= 4.10.1 – Cross-Site Request Forgery

Add Any Extension to Pages <= 1.4 – Cross-Site Request Forgery via aaetp_options_page

Sirv <= 7.1.2 – Missing Authorization via sirv_disconnect

Integrate Google Drive <= 1.3.3 – Missing Authorization via save_settings

Anti Hacker <= 4.34 – Cross-Site Request Forgery via antihacker_ajax_scan

NEX-Forms – Ultimate Form Builder <= 8.5.2 – Cross-Site Request Forgery

Split Test For Elementor <= 1.6.9 – Cross-Site Request Forgery

GS Logo Slider <= 3.5.1 – Cross-Site Request Forgery

WP Job Portal <= 2.0.6 – Cross-Site Request Forgery

ProjectHuddle Client Site <= 1.0.34 – Missing Authorization via ph_child_ajax_notice_handler

Slider by Soliloquy <= 2.7.2 – Missing Authorization

Awesome Support <= 6.1.5 – Cross-Site Request Forgery

Advanced Category Template <= 0.1 – Cross-Site Request Forgery

NitroPack <= 1.10.2 – Cross-Site Request Forgery

Crowdsignal Dashboard – Polls, Surveys & more <= 3.0.11 – Cross-Site Request Forgery via update_rating

Strong Testimonials <= 3.1.10 – Cross-Site Request Forgery

Eazy Plugin Manager <= 4.1.2 – Missing Authorization via update_options

Ultimate Addons for WPBakery <= 3.19.17 – Cross-Site Request Forgery

Product Table by WBW <= 1.8.6 – Cross-Site Request Forgery via saveGroup

Customize My Account for WooCommerce <= 1.8.3 – Cross-Site Request Forgery via restore_my_account_tabs

Product Feed Manager <= 7.3.15 – Authenticated (Admin+) Directory Traversal

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us using our CVE Request form, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (December 18, 2023 to December 31, 2023) appeared first on Wordfence.