Several new WordPress plugin and theme vulnerabilities were disclosed during the first half of September, so we want to keep you aware. In this post, we cover recent WordPress plugin and theme vulnerabilities and what to do if you are running one of the vulnerable plugins or themes on your website.

We divide the WordPress Vulnerability Roundup into four different categories:

  • 1. WordPress core
  • 2. WordPress Plugins
  • 3. WordPress Themes
  • 4. Breaches From Around the Web

* We include breaches from around the web because it is essential to also be aware of vulnerabilities outside of the WordPress ecosystem. Exploits to server software can expose sensitive data. Database breaches can expose the credentials for the users on your site, opening the door for attackers to access your site.

WordPress Core Vulnerabilities

WordPress version 5.2.3 was released on September 4th, 2019, to patch several potential security vulnerabilities. Here is an excerpt from the WordPress 5.2.3 release post.

Security Fixes in WordPress 5.2.3

  • Props to Simon Scannell of RIPS Technologies for finding and disclosing two issues. The first, a cross-site scripting (XSS) vulnerability found in post previews by contributors. The second was a cross-site scripting vulnerability in stored comments.
  • Props to Tim Coen for disclosing an issue where validation and sanitization of a URL could lead to an open redirect.
  • Props to Anshul Jain for disclosing reflected cross-site scripting during media uploads.
  • Props to Zhouyuan Yang of Fortinet’s FortiGuard Labs who disclosed a vulnerability that for cross-site scripting (XSS) in shortcode previews.
  • Props to Ian Dunn of the Core Security Team for finding and disclosing a case where reflected cross-site scripting could be found in the dashboard.
  • Props to Soroush Dalili (@irsdl) from NCC Group for disclosing an issue with URL sanitization that can lead to cross-site scripting (XSS) attacks.
  • In addition to the above changes, we are also updating jQuery on older versions of WordPress. This change was added in 5.2.1 and is now being brought to older versions.

WordPress Plugin Vulnerabilities

Several new WordPress plugin vulnerabilities have been discovered in September. Make sure to follow the suggested action below to update the plugin or completely uninstall it.

1. Photo Gallery by 10Web

Photo Gallery by 10Web Logo

Photo Gallery by 10Web version1.5.34 and below of the plugin is vulnerable to a SQL Injection and Cross-Site Scripting attack.

What You Should Do

The vulnerability has been patched, and you should update to version 1.5.35.

2. Advanced Access Manager

Advanced Acess Manager version 5.9.8.1 and below includes an Arbitrary File Access and Download vulnerability.

What You Should Do

The vulnerability has been patched, and you should update to version 5.9.9.

3. Event Tickets

Event Tickets Logo

Event Tickets version 4.10.7.1 and below is vulnerable to a CSV Injection.

What You Should Do

The vulnerability has been patched, and you should update to version 4.10.7.2.

4. Search Exclude

Search Exclude Logo

Search Exclude version 1.2.2 and below is vulnerable to an Arbitrary Settings Change.

What You Should Do

The vulnerability has been patched, and you should update to version 1.2.4.

5. LifterLMS

LifterLMS version 3.34.5 and below is vulnerable to an Unauthenticated Options Import vulnerability.

What You Should Do

The vulnerability has been patched, and you should update to version 1.2.4.

6. Content Upgrades

Content Upgrades version 2.0.4 and below is vulnerable to an Cross-Site Scripting vulnerability.

What You Should Do

The vulnerability has been patched, and you should update to version 2.0.5.

7. Qwizcards

Qwiz Logo

Qwizcards version 3.36 and below is vulnerable to an Unauthenticated Reflected Cross-Site Scripting attack.

What You Should Do

The vulnerability has been patched, and you should update to version 3.37.

8. Checklist

Checklist version 1.1.5 and below is vulnerable to an Unauthenticated Reflected Cross-Site Scripting attack.

What You Should Do

The vulnerability has been patched, and you should update to version 1.1.9.

9. Spryng Payments for WooCommerce

Spryng Payments for WooCommerce Logo

Spryng Payments for WooCommerce version 1.6.7 and below is vulnerable to a Cross-Site Scripting attack.

What You Should Do

Remove the plugin until an update with a patch is released.

10. Portrait-Archiv.com Photostore

Portrait-Archiv.com Photostore Logo

Portrait-Archiv.com Photostore version 5.0.4 and below is vulnerable to a Cross-Site Scripting attack.

What You Should Do

Remove the plugin until an update with a patch is released.

11. ECPay Logistics for WooCommerce

ECPay Logistics for WooCommerce

ECPay Logistics for WooCommerce version 1.2.181030 and below is vulnerable to a Cross-Site Scripting attack.

What You Should Do

Remove the plugin until an update with a patch is released.

12. Ellipsis Human Presence Technology

Ellipsis Human Presence Technology version 2.0.8 and below is vulnerable to an Unauthenticated Reflected Cross-Site Scripting attack.

What You Should Do

Remove the plugin until an update with a patch is released.

13. SlickQuiz

SlickQuiz Logo

SlickQuiz version 1.6.7 and below is vulnerable to a Cross-Site Scripting and SQL Injection attack.

What You Should Do

Remove the plugin until an update with a patch is released.

WordPress Themes

No WordPress Theme vulnerabilities were disclosed in the second half of August 2019.

How to Be Proactive About WordPress Theme & Plugin Vulnerabilities

Running outdated software is the number one reason WordPress sites are hacked. It is crucial to the security of your WordPress site that you have an update routine. You should be logging into your sites at least once a week to perform updates.

Automatic Updates Can Help

Automatic updates are a great choice for WordPress websites that don’t change very often. Lack of attention often leaves these sites neglected and vulnerable to attacks. Even with recommended security settings, running vulnerable software on your site can give an attacker an entry point into your site.

Using the iThemes Security Pro plugin’s Version Management feature, you can enable automatic WordPress updates to ensure you are getting the latest security patches. These settings help protect your site with options to automatically update to new versions or to increase user security when the site’s software is outdated.

Version Management Update Options
  • WordPress Updates –Automatically install the latest WordPress release.
  • Plugin Automatic Updates – Automatically install the latest plugin updates. This should be enabled unless you actively maintain this site on a daily basis and install the updates manually shortly after they are released.
  • Theme Automatic Updates – Automatically install the latest theme updates. This should be enabled unless your theme has file customizations.
  • Granular Control over Plugin and Theme updates – You may have plugins/themes that you’d like to either manually update, or delay the update until the release has had time to prove stable. You can choose Custom for the opportunity to assign each plugin or theme to either update immediately (Enable), not update automatically at all (Disable) or update with a delay of a specified amount of days (Delay).

Strengthening and Alerting to Critical Issues
  • Strengthen Site When Running Outdated Software – Automatically add extra protections to the site when an available update has not been installed for a month. The iThemes Security plugin will automatically enable stricter security when an update has not been installed for a month. First, it will force all users that do not have two-factor enabled to provide a login code sent to their email address before logging back in. Second, it will disable the WP File Editor (to block people from editing plugin or theme code), XML-RPC pingbacks and block multiple authentication attempts per XML-RPC request (both of which will make XML-RPC stronger against attacks without having to turn it off completely).
  • Scan for Other Old WordPress Sites – This will checks for other outdated WordPress installs on your hosting account. A single outdated WordPress site with a vulnerability could allow attackers to compromise all the other sites on the same hosting account.
  • Send Email Notifications – For issues that require intervention, an email is sent to admin-level users.

Breaches From Around the Web

1. Jack Dorsey’s Twitter Account Was Hacked

Twitter Logo

Jack Dorsey, Twitter CEO, was a victim to a SIM swap attack. A SIM Swap is when an attacker works with your cell phone provider to port your telephone to a different phone. After taking over your phone number, the malicious actor can then receive your SMS two-factor codes.

After the Chuckling Squad hacker group took control of Dorsey’s cell phone number, they were able to use Cloudhopper to send the tweets. Cloudhopper is a company that was previously acquired by Twitter to make it easier for people to tweet via text message.

2. phpMyAdmin Vulnerability

phpMyAdmin Logo

PHP version 4.9.0.1 is vulnerable to a new Cross-Site Request Forgery attack, and it is a Zero-day. The vulnerability will allow an attacker to trigger CSRF attack against a phpMyAdmin user deleting any server in the Setup page.

Be sure to update phpMyAdmin after a security patch is released.

——————————————————————————————————————————————-

The post WordPress Vulnerability Roundup: September 2019, Part 1 appeared first on iThemes.

Facebook Comments
Spread the love

Posted by News Monkey