Wordfence Intelligence Weekly WordPress Vulnerability Report (January 1, 2023 to January 7, 2023)

Wordfence just launched its bug bounty program. For the first 6 months, all awarded bounties receive a 10% bonus. View the announcement to learn more now!

Last week, there were 85 vulnerabilities disclosed in 74 WordPress Plugins and 2 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 39 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 12,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

• POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.6 – Authorization Bypass via type connect-app API
• Astra Pro <= 4.3.1 – Authenticated(Contributor+) Remote Code Execution via Metabox
• Generic Object Injection
• Generic XSS in Custom Meta

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Total Vulnerabilities by CVSS Severity Last Week

Total Vulnerabilities by CWE Type Last Week

Researchers That Contributed to WordPress Security Last Week

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through this form. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

WordPress Themes with Reported Vulnerabilities Last Week

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

WooCommerce Tranzila Gateway <= 1.0.8 – Unauthenticated PHP Object Injection

LearnPress <= 4.2.5.7 – Unauthenticated SQL Injection via order_by

Taggbox <= 3.1 – Unauthenticated PHP Object Injection

WP Compress – Image Optimizer [All-In-One] <= 6.10.33 – Unauthenticated Directory Traversal via css

Gecka Terms Thumbnails <= 1.1 – Authenticated (Subscriber+) PHP Object Injection

HTML5 SoundCloud Player <= 2.8.0 – Authenticated (Author+) PHP Object Injection

Page Builder: Live Composer <= 1.5.25 – Authenticated (Author+) PHP Object Injection

HTML5 MP3 Player with Playlist Free <= 3.0.0 – Authenticated (Author+) PHP Object Injecton

Randomize <= 1.4.3 – Authenticated (Contributor+) SQL Injection

HTML5 MP3 Player with Folder Feedburner <= 2.8.0 – Authenticated (Author+) PHP Object Injection

OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 5.7.9 – Missing Authorization to Unauthenticated Directory Deletion and Cross-Site Scripting

LearnPress <= 4.2.5.7 – Command Injection

Hostinger <= 1.9.7 – Missing Authorization to Maintenance Mode Activation

ARForms <= 1.5.8 – Unauthenticated Stored Cross-Site Scripting via arf_http_referrer_url

POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 – Unauthenticated Stored Cross-Site Scripting via device

WP ERP <= 1.12.8 – Authenticated (Accounting manager+) SQL Injection

pTypeConverter <= 0.2.8.1 – Authenticated (Editor+) SQL Injection

WP-Members Membership Plugin <= 3.4.8 – Missing Authorization to Sensitive Information Exposure

Coupon Referral Program <= 1.7.2 – Sensitive Information Disclosure

Ideal Interactive Map <= 1.2.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

Page Builder: Live Composer <= 1.5.23 – Authenticated (Contributor+) Stored Cross-Site Scripting

Easy SVG Allow <= 1.0 – Authenticated (Author+) Stored Cross-Site Scripting via SVG

Orbit Fox Companion <= 2.10.26 – Authenticated (Contributor+) Stored Cross-Site Scripting via custom fields

MapPress Maps for WordPress <= 2.88.13 – Authenticated (Contributor+) Stored Cross-Site Scripting

Posts to Page <= 1.7 – Authenticated (Contributor+) Stored Cross-Site Scripting

Laybuy Payment Extension for WooCommerce <= 5.3.9 – Authenticated (Contributor+) Stored Cross-Site Scripting

3D Flipbook <= 1.15.2 – Authenticated (Contributor+) Cross-Site Scripting via Ready Function

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

Infogram <= 1.6.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

Keap Official Opt-in Forms <= 1.0.11 – Authenticated (Contributor+) Stored Cross-Site Scripting

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.2 – Authenticated (Author+) Stored Cross-Site Scripting

EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor <= 3.9.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Mapster WP Maps <= 1.2.38 – Authenticated (Contributor+) Stored Cross-Site Scripting

FooGallery Premium <= 2.3.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

Private Google Calendars <= 20231125 – Authenticated (Contributor+) Stored Cross-Site Scripting

Oxygen Builder <= 4.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field

TJ Shortcodes 0.1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

oEmbed Gist <= 4.9.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

Rate Star Review <= 1.5.1 – Reflected Cross-Site Scripting

Autotitle for WordPress <= 1.0.3 – Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting

Happy Addons for Elementor <= 3.9.1.1 – Reflected Cross-Site Scripting

Ajax Search Lite <= 4.11.4 – Reflected Cross-Site Scripting

WP Plugin Lister <= 2.1.0 – Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting

POST SMTP Mailer <= 2.8.6 – Reflected Cross-Site Scripting via msg

Meris <= 1.1.2 – Reflected Cross-Site Scripting

CPT Bootstrap Carousel <= 1.12 – Reflected Cross-Site Scripting

WP SMS <= 6.5 – Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting

Weaver Xtreme <= 6.3.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.2 – Missing Authorization

Product Expiry for WooCommerce <= 2.5 – Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update

PageLayer <= 1.7.8 – Authenticated(Contributor+) Stored Cross-Site Scripting via meta fields

Constant Contact Forms <= 2.4.2 – Information Disclosure via Log Files

Wp Ultimate Review <= 2.2.5 – IP Spoofing

ActivityPub <= 1.0.5 – Missing Authorization

Product Delivery Date for WooCommerce – Lite <= 2.7.0 – Missing Authorization

WP Job Manager <= 2.0.0 – Missing Authorization

PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.13 – Cross-Site Request Forgery

Complianz | GDPR/CCPA Cookie Consent <= 6.5.5 – Authenticated(Administrator+) Stored Cross-site Scripting via settings

CformsII <= 15.0.5 – Authenticated (Administrator+) Stored Cross-Site Scripting

Ads Invalid Click Protection <= 1.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

Icegram <= 3.1.20 – Missing Authorization

WP 2FA – Two-factor authentication for WordPress <= 2.5.0 – Cross-Site Request Forgery

WP Social Bookmark Menu <= 1.2 – Cross-Site Request Forgery to Settings Update

LearnPress <= 4.2.5.7 – Insecure Direct Object Reference to Information Disclosure

Booster Plus for WooCommerce < 7.1.2 – Missing Authorization to Order Information Disclosure

WordPress Users <= 1.4 – Cross-Site Request Forgery to Settings Update

Easy Social Feed <= 6.5.2 – Missing Authorization to Settings Modification

Quiz Maker <= 6.5.1.1 – Missing Authorization

WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.3.0 – Missing Authorization to Order Export

WP Job Manager <= 2.0.0 – Cross-Site Request Forgery

Google Analytics by Monster Insights <= 8.21.0 – Missing Authorization

Site Notes <= 2.0.0 – Cross-Site Request Forgery to Admin Note Deletion

Void Contact Form 7 Widget For Elementor Page Builder <= 2.3 – Missing Authorization

WP SMS <= 6.5 – Cross-Site Request Forgery to Subscriber Deletion

LightStart – Maintenance Mode, Coming Soon and Landing Page Builder <= 2.6.8 – Missing Authorization

WooCommerce Conversion Tracking <= 2.0.11 – Missing Authorization

Depicter Slider – Responsive Image Slider, Video Slider & Post Slider <= 2.0.6 – Cross-Site Request Forgery via save

WP 2FA <= 2.5.0 – Insecure Direct Object Reference to Arbitrary Email Sending

Booster Plus for WooCommerce < 7.1.3 – Missing Authorization to Arbitrary Options Disclosure

Booster Plus for WooCommerce < 7.1.2 – Missing Authorization to Arbitrary Page/Post Deletion

WooCommerce <= 8.2.2 – Cross-Site Request Forgery

Booster Elite for WooCommerce < 7.1.2 – Missing Authorization to Order Information Disclosure

Profile Builder <= 3.10.7 – Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode

JS & CSS Script Optimizer <= 0.3.3 – Cross-Site Request Forgery

My Sticky Bar <= 2.6.6 – Cross-Site Request Forgery to Sensitive Information Exposure

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us using our CVE Request form, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (January 1, 2023 to January 7, 2023) appeared first on Wordfence.