Starting from March we will be looking at the latest WordPress security updates and some interesting news from the WordPress Ecosystem. We will be taking a closer look at what has taken place and listing the most significant and noteworthy pieces of information. So let us begin.
- WordPress 5.6.2 Release is out and it is a maintenance release coming with 5 bug fixes. You can read more about the release here.
- WordPress 5.7 Beta 3 became available for testing.
According to a survey conducted by W3Techs, WordPress holds now a fascinating 40.4% of the websites available out there while maintaining a staggering 64.4% of the content management software market. This is another astonishing achievement. On February the 17th, Gutenberg 10.0 was released marking the 100th release for the Plugin that changed the entire WordPress experience and the way the users build their websites.
WordPress Plugin Vulnerabilities
- Multiple vulnerabilities in Ninja Forms. In February there were 4 severe vulnerabilities spotted. These included:
- an Authenticated SendWP plugin installation and client secret key disclosure vulnerability, installing a plugin that could be used to intercept all mail traffic.
- an Authenticated OAuth connection key disclosure vulnerability, retrieving the Ninja Form OAuth Connection Key essential for establishing a connection with the plugin’s central management dashboard
- an Administrator open redirect vulnerability, redirecting site administrators to random locations
- and a Cross-site request forgery (CSRF) vulnerability, tricking website administrators into performing an action leading to the disconnection of a site’s OAuth Connection.
These vulnerabilities were deemed severe as they could easily result in allowing hackers not only to take over a website but also to perform several malicious actions. The WordPress Ninja Forms vulnerabilities affected over a million WordPress sites and you can find out more here.
- Two vulnerabilities were found in NextGen Gallery. This very popular WordPress gallery plugin was found with two CSRF vulnerabilities which could have resulted in the attackers taking over a website. The number of sites affected by these vulnerabilities was over 800.000 and you can read more about the issue here.
- All In One WP Security & Firewall. This all-in-one security plugin was spotted with an authenticated cross-site scripting (XSS) vulnerability affecting over 900.000 WordPress websites.
- WordPress Post SMTP Mailer/Email Log. The 1.7.2 version of this plugin has a cross-site scripting vulnerability causing it to fail to sanitize user-supplied input. Read more.
- Better Search. The plugin failed to check the CSRF nonces properly when exporting and importing settings. Read more.
- Theme Editor. Multiple authenticated arbitrary file download found. For more details, you can read this.
Other plugins were also found with vulnerabilities:
- WordPress Customer Service Software & Support Ticket System: Cross-Site Scripting (XSS)
- Zebra_Form Library: Reflected cross-site scripting within the PHP library.
- Custom Banners: CSRF to Stored Cross-Site Scripting
- eCommerce Product Catalog: CSRF Nonce Bypass
- Backup Guard: Authenticated Arbitrary File Upload
- Orbit Fox by ThemeIsle: Authenticated Stored Cross-Site Scripting
- Testimonial Rotator: Authenticated Stored Cross-Site Scripting
- WP Content Plus: CSRF Nonce Bypass
- QuadMenu: Unauthenticated RCE via compiler_save
- YITH WooCommerce Gift Cards Premium: RCE via Arbitrary File Upload
- Photo Gallery by 10web: Reflected Cross-Site Scripting
- Web-Stat: API Key Disclosure
It is true that vulnerabilities and malicious threats remain an issue that WordPress site owners cannot afford to ignore. Vulnerabilities not only affect a site’s security, wellbeing and performance but also they take a toll on a brand’s reputation and authority.
If you are afraid that your WordPress website is hacked or if you need assistance in strengthening your website’s security contact WP!Republic.