WordPress Vulnerability News, November 2021

WordPress Vulnerability means Weakness of WordPress. In this post November WordPress vulnerability news, we will focus on WordPress vulnerable plugins and WordPress security issues discovered in October 2020 and November 2020.

The most important and crucial part of security is to stay updated with security vulnerabilities in CMS like WordPress and among others.

This is the reason why we have analyzed the susceptible plugins and the latest revealed weak point to ensure that your website runs smoothly by not using such unprotected plugins and updates for WordPress.

Your website will be safe from all security issues and vulnerabilities if you are using the WebARX web application firewall. But the best alternative method to make your website safe is to remove or update the unprotected plugins on your websites.

WordPress Vulnerability News, October 2022

WordPress + Microsoft Office 365

To access your WordPress website users can sign in with their school or corporate account with WPO365|LOGIN. Password and no username required. Plus you will be able to send emails with the help of Microsoft Graph rather than using SMTP from your website.

Vulnerability: JWT Signature Verification bypass
Resolved in version: 11.7
Total websites impacted: 1000+

This plugin not verify JWT signatures, allow authorization checks, bypass authentications, and allow attackers to form tokens.

Slider by 10Web

Slider by 10Web is an alternative method of adding responsive, fast loading, and SEO friendly sliders on your theme header, website’s posts and pages, or any other location.

This plugin is compatible with videos and images and allows both contents to add on slides. You can add different transition effects to it very easily.

Vulnerability: Multiple authenticated SQL injection
Resolved in version: 1.2.36
Total websites impacted: 50 000+

The two vulnerable functionalities of this plugin are save_slider_db and bulk_action, export_full. These two functionalities permit authorized users or admin or medium like contributor+ ‘role option’ suppose the other user is turned on to execute an attack known as SQL injections.

The declaration date of PoC was on 13th October 2020 that provides updates to users time by time.

WP Courses

WP Courses is a WordPress free plugin that can be used for LMS to manage and create courses on your website with drag and drop tools, an intuitive interface, video tutorials, and more. This plugin has more than 900+ active installations.

This plugin can be added with any other template as it will work seamlessly. It also comes with so many options that will help you to match your vision and your website design. This plugin is easy to navigate as it does not require any coding or technical knowledge.

Vulnerability: Leading to courses content disclosure because of Broken access controls
Resolved in version: 2.0.29
Total websites impacted: 20,000+

By the WordPress REST API, the issue in WP courses might make your courses available to all.

Simple:Press

To your WordPress website, the Simple: Press is forum software. With some extra features, you can start your forum easily. It is integrated into the security model and WordPress user model and it can be raised upto thousands of users.

Despite other forum plugins, the features of this plugin are created and supported by the organizations. The option is available for remove or uninstall, integrated with WordPress log in and registrations, integrate with member subscriptions plugins, and more.

Vulnerability: Leading to RCE because of Broken access control
Resolved in version: 6.6.1
Total websites affected: 600+

The broken access control issue in the Simple: Press plugin has been fixed which was affecting the 6.6.0 version and below.

XCloner Plugin

This plugin will help you to restore and backup your WordPress website.

Vulnerability: Cross-site request forgery
Resolved in version: 4.2.13
Total websites affected: 30,000+

Website backups can be sent to Google Drive, SFTP, Amazon, Dropbox, Backblaze, and some other locations. Automatically or manually you can create backups with a scheduler which is a build-in of XCloner’s.

Different safety features are provided by XCloner such as XCloner will create themes, core, plugins, languages files backup just before WordPress core’s automatic updates, themes, plugins, or language files. People who look for a secure website and privacy should choose XCloner.

Drag and Drop Multiple File Upload – contact form 7

This plugin is easy to use and straightforward extension specially for contact form 7. This plugin will permit users to add different files with the help of drag and drop features. One can also add a common browse file of the web form.

The features of this plugin are restricted to the number of files upload, restrict file size for every field, mobile responsive, supportive with any browser, support multiple language, cool progress bar, drag and drop feature, file size validation, file type validation, and so on.

Vulnerability: Unverified remote code execution
Resolved in version: 1.3.5.5
Total websites affected: 20,000+

This tool makes use of dangerous file extension’s blacklist that does not permit you to upload. However, the extensions .phpt and .phar was not on the blacklist that can not be utilized to add arbitrary PHP code.

Some more 25+ WordPress plugins were discovered with vulnerabilities to CSRF attacks some of them are

• Paid Membership Pro
• Coupon Creator
• Funner Builders
• Radio Buttons for Taxonomies
• Cool Timeline
• Easy Testimonials
• Dokan
• RSS Aggregator by Feedly
• WP Hotel Booking
• WP Project Manager and Many more.

Related Post:Best Error Free WordPress Themes for Projects to Choose From for Your Next Website

WordPress Vulnerability News, November 2020

GDPR CCPA Compliance Support

It is also known as the Ninja GDPR compliance plugin for WordPress users.

Vulnerability: unofficial injection on PHP object
Resolved in version: 2.4
Total websites impacted: 1000+

GDPR CCPA Compliance support plugin has more than 1000 active installations It has solved an unsafe deserialization vulnerability impacting version 2.1 and below that might get to unofficial PHP object injection. On November 17, 2020. The PoC will be shown to update users with all information.

Welcart e-Commerce

WelCart is free to use. It has more than 20,000 active installations and available in 3 different languages i.e. English (US), Japanese, and Vietnamese. On October 9, 2020, the vulnerability was discovered in this plugin.

Vulnerability: Unofficial injection on PHP object
Resolved in version: 1.9.36
Total websites impacted: 20,000+

WordPress users can use the Welcart plugin to build a shopping website with a different customer account area. It does not use the same cookie which is used by WordPress. It uses its own.

This helps you to track user sessions. Using this plugin you will be able to sell any type of products including subscription-based products, digital products as well as a physical products. There is no limit specified to the number of item photos, products, and categories.

AccessPress Social Icons

You will be able to create different social icons and add a link to your valid social media accounts directly from the website. It has more than 40,000+ active installations and supports WordPress version 4.5 and higher.

Vulnerability: Authenticated SQL injection
Resolved in version: 1.8.1
Total websites impacted: 40 000+

Its widget attribute has not been disinfected by this plugin, it permits accounts with post permission for example author to execute SQL injections.

Very easily a non-technical person can also link up to social profiles on the website. You can create and personalize the icons beautifully on your own. 12 various designed sets are provided that can be used to select icons.

The main features of this plugin are easy integration, tools tips, more styles, real-time live preview, responsive, interactive, own layouts, and more.

WordPress

The WordPress version 5.5.2 was released on October 29, 2020. This version was introduced to fix the problems affected by WordPress version 5.5 including reflected XSS vulnerability. Also, it has fixed some issues of regressions that was discovered in version 5.5

Vulnerability: Reflected XSS
Resolved in version: 5.5.2
Total websites impacted: N/A

On every WordPress user account and user’s website, this issue is susceptible. The assaulter might fool an unaware user to click on an infected link or visit the website which is booby-trapped. The level of victimization for this issue is medium because it needs some sort of social engineering.

SW Ajax WooCommerce Search

SW Ajax WooCommerce Search is a WordPress plugin for WooCommerce that has an Ajax search feature.

Vulnerability: Unofficial reflected XFS & XSS
Resolved in version: 1.2.8
Total websites impacted: N/A

Conclusion:
November WordPress vulnerability news – Number of WordPress websites are getting infected and hacked every day. Some figures shows that more than 30,000 websites are getting affected daily with several kinds of malware.

Each open website on the internet is resource available for everyone and this is the main reason why the most of the websites are targeted.

It is crucial to know the fact that as soon as you live your business online it becomes available as a public. Thus it becomes easily targeted.

To avoid adding vulnerable plugin on your website it is important to keep your plugins and websites up to date. You can enable automatic updates if it is possible.

If you are using the plugins mentioned above then it is high time to update it with newly version else your website will get affected badly.