Several new WordPress plugin and theme vulnerabilities were disclosed during the last half of August, so we want to keep you aware. In this post, we cover recent WordPress plugin and theme vulnerabilities and what to do if you are running one of the vulnerable plugins or themes on your website.

We divide the WordPress Vulnerability Roundup into four different categories:

  • 1. WordPress core
  • 2. WordPress Plugins
  • 3. WordPress Themes
  • 4. Breaches From Around the Web

* We include breaches from around the web because it is essential to also be aware of vulnerabilities outside of the WordPress ecosystem. Exploits to server software can expose sensitive data. Database breaches can expose the credentials for the users on your site, opening the door for attackers to access your site.

WordPress Core Vulnerabilities

No WordPress vulnerabilities were disclosed in August of 2019.

WordPress Plugin Vulnerabilities

Several new WordPress plugin vulnerabilities have been discovered this August. Make sure to follow the suggested action below to update the plugin or completely uninstall it.

1. Nextgen Gallery

Nextgen Gallery version 3.2.10 and below is vulnerable to a SQL Injection.

What You Should Do

The vulnerability has been patched, and you should update to version 3.2.11.

2. Easy Forms for Mailchimp

Easy Forms for Mailchimp Logo

Easy Forms for Mailchimp version 6.5.2 and below is vulnerable to a Code Injection.

What You Should Do

The vulnerability has been patched, and you should update to version 6.5.3.

3. WP Social Feed Gallery

WP Social Feed Gallery Logo

WP Social Feed Gallery version 2.4.7 and below is missing proper authorization checks. The vulnerability could allow low-level users to perform a Cross-Site Forgery attack.

What You Should Do

The vulnerability has been patched, and you should update to version 2.4.8.

4. Social LikeBox & Feed

Social Likebox and Feed Logo

Social LikeBox & Feed version 2.8.4 and below is vulnerable to a Cross-Site Request Forgery and Scripting attack.

What You Should Do

The vulnerability has been patched, and you should update to version 2.8.5.

5. Variation Swatches for WooCommerce

Variation Swatches for WooCommerce Logo

Variation Swatches for WooCommerce version 1.0.61 and below is vulnerable to a Cross-Site Request Scripting attack.

What You Should Do

The vulnerability has been patched, and you should update to version 1.0.62.

6. WP SVG Icons

WP SVG Logo

WP SVG Icons version 3.2.2 and below is vulnerable to a Cross-Site Request Forgery leading to Remote Code Execution attack.

What You Should Do

The vulnerability has been patched, and you should update to version 3.2.3.

7. Bold Page Builder

Bold Page Builder Logo

Bold Page Builder version 2.3.1 and below is vulnerable to an Improper Privilege Management attack. The vulnerability allows unauthenticated users to perform tasks that should be limited to Admin users.

What You Should Do

The vulnerability has been patched, and you should update to version 2.3.2.

8. Import Export WordPress Users

Import Export WordPress User Logo

Import Export WordPress Users version 1.3.1 and below is vulnerable to a CSV Injection.

What You Should Do

The vulnerability has been patched, and you should update to version 1.3.2

9. UserPro

User Pro Logo

UserPro version 4.9.33 and below is vulnerable to a Cross-Site Scripting attack.

What You Should Do

Remove the plugin until an update with a patch is released.

10. WP Private Content Plus

WP Private Content Pro Logo

WP Private Content Plus version 1.31 and below is vulnerable to an Unauthenticated Options Change attack.

What You Should Do

The vulnerability has been patched, and you should update to version 2.0.
As of September 3rd, the plugin is closed in the wp.org repository pending review.

11. Shapepress DSGVO

Shapepress DSGVO Logo

Shapepress DSGVO version 2.2.19 and below is vulnerable to a Cross-Site Scripting and Forgery attack.

What You Should Do

The vulnerability has been patched, and you should update to version 2.2.20.

12. WooCommerce Product Feed

WooCommerce Product Feed version 3.1.14 and below is vulnerable to a Cross-Site Scripting attack.

What You Should Do

The vulnerability has been patched, and you should update to version 3.1.15.

13. Pie Register

Pie Register Logo

Pie Register version 3.1.1 and below is vulnerable to a SQL Injection.

What You Should Do

The vulnerability has been patched, and you should update to version 3.1.2.

14. Easy Property Listings

Easy Property Listings Logo

Easy Property Listings version 3.3.5 and below is vulnerable to a Cross-Site Scripting attack.

What You Should Do

The vulnerability has been patched, and you should update to version 3.4.

15. HandL UTM Grabber

HandL UTM Grabber Logo

HandL UTM Grabber version 2.6.4 and below is vulnerable to a Cross-Site Forgery attack.

What You Should Do

The vulnerability has been patched, and you should update to version 2.6.5.

16. Web Librarian

Web Librarian version 3.5.2 and below is vulnerable to a SQL Injection.

What You Should Do

The vulnerability has been patched, and you should update to version 3.5.5.

WordPress Themes

No WordPress Theme vulnerabilities were disclosed in the second half of August 2019.

How to Be Proactive About WordPress Theme & Plugin Vulnerabilities

Running outdated software is the number one reason WordPress sites are hacked. It is crucial to the security of your WordPress site that you have an update routine. You should be logging into your sites at least once a week to perform updates.

Automatic Updates Can Help

Automatic updates are a great choice for WordPress websites that don’t change very often. Lack of attention often leaves these sites neglected and vulnerable to attacks. Even with recommended security settings, running vulnerable software on your site can give an attacker an entry point into your site.

Using the iThemes Security Pro plugin’s Version Management feature, you can enable automatic WordPress updates to ensure you are getting the latest security patches. These settings help protect your site with options to automatically update to new versions or to increase user security when the site’s software is outdated.

Version Management Update Options
  • WordPress Updates –Automatically install the latest WordPress release.
  • Plugin Automatic Updates – Automatically install the latest plugin updates. This should be enabled unless you actively maintain this site on a daily basis and install the updates manually shortly after they are released.
  • Theme Automatic Updates – Automatically install the latest theme updates. This should be enabled unless your theme has file customizations.
  • Granular Control over Plugin and Theme updates – You may have plugins/themes that you’d like to either manually update, or delay the update until the release has had time to prove stable. You can choose Custom for the opportunity to assign each plugin or theme to either update immediately (Enable), not update automatically at all (Disable) or update with a delay of a specified amount of days (Delay).

Strengthening and Alerting to Critical Issues
  • Strengthen Site When Running Outdated Software – Automatically add extra protections to the site when an available update has not been installed for a month. The iThemes Security plugin will automatically enable stricter security when an update has not been installed for a month. First, it will force all users that do not have two-factor enabled to provide a login code sent to their email address before logging back in. Second, it will disable the WP File Editor (to block people from editing plugin or theme code), XML-RPC pingbacks and block multiple authentication attempts per XML-RPC request (both of which will make XML-RPC stronger against attacks without having to turn it off completely).
  • Scan for Other Old WordPress Sites – This will checks for other outdated WordPress installs on your hosting account. A single outdated WordPress site with a vulnerability could allow attackers to compromise all the other sites on the same hosting account.
  • Send Email Notifications – For issues that require intervention, an email is sent to admin-level users.

Breaches From Around the Web

1. npm Removes Password Stealing Package

npm logo

npm is the default package manager—a tool used to install, update, configure, and remove software—of Node.js. npm announced the removal of bb-builderfrom the repository after cathing it deploying a Windows executable that sent sensitive information to a remote server.

npm recommends removing the package and rotating any security keys stored on the device that had the package installed. Furthermore, they caution that removing the package may not remove all of the malicious software.

2. Major Vulnerability Discovered in Pre-Installed Lenovo Software

Lenovo Logo

The Lenovo Solution Center version 03.12.003, could allow logs file to be written to non-standard locations, leading to privilege escalation. The Lenovo Solution Center has been deprecated since April of 2018. Lenovo mitigation recommendation is to remove the Solution Center and migrate to Lenovo Vantage or Lenovo Diagnostics in April 2019.

The post WordPress Vulnerability Roundup: August 2019, Part 2 appeared first on iThemes.

Facebook Comments
Spread the love

Posted by News Monkey