June WordPress Security Updates and News-Volume 1

The first half of June was a period of time with a great number of WordPress security incidents. Over 40 Plugin Vulnerabilities were detected  affecting more than 7 million websites. This is indeed a number that can not be ignored. So let us take a closer look at some of those vulnerabilities. 

WordPress Plugin Vulnerabilities

• Jetpack. With over 5 million installations this Plugin was affected by a Carousel Non-Published Page/Post Attachment Comment Leak. A patch is released in the latest version and you can find out more here. 
• MC4WP: Mailchimp for WordPress. This very popular WordPress Plugin was hit by two medium-risk vulnerabilities: an Authenticated Arbitrary Redirect and an Unauthorized Actions via CSRF. They are both patched and they can be tackled by upgrading the plugin to the next version. You can find out more about this compromise that affected over 2 million websites in this article. 
• Simple 301 Redirects by BetterLinks. This WordPress Plugin has been detected with multiple security issues affecting over 300,000 WordPress sites. The compromises were Unauthenticated Redirect Export (Critical), Unauthenticated Redirect Import (Critical), Arbitrary Plugin Installation (High), Update and Retrieve Wildcard Value (Medium), Arbitrary Plugin Activation (High). All these compromises are fixed when upgrading the plugin to the latest version. You can read more here.
• Quiz And Survey Master. Installed in over 40,000 WordPress sites this Plugin was detected with an Unauthenticated Stored Cross-Site Scripting and a Reflected Cross-Site Scripting. They are both fixed in the latest version of the plugin and here is more details about it. 
• The Plus Addons for Elementor. A series of vulnerabilities were detected in this Plugin affecting over 30,000 sites. The vulnerabilities include a Reflected Cross-Site Scripting (Medium), Open Redirect (Medium) and Arbitrary Reset Pwd Email Sending (High). For more information, you can read this. 
• Side Menu. Hit by an Authenticated SQL Injection, high-risk vulnerability this WordPress Plugin has affected over 3000 WordPress websites. A patch was released though and updating it to the latest version solves the issue. Find out more. 

Other WordPress Plugin Vulnerabilities

• WP Google Maps. Vulnerability: Authenticated Stored Cross-Site Scripting (Medium). WordPress sites affected: 400,000+
• WordPress Popular Posts. Vulnerability: Authenticated Code Injection (High). Authenticated Stored Cross-Site Scripting (Medium). WordPress sites affected: 300,000+
• FooGallery. Vulnerability: Authenticated Stored Cross-Site Scripting (Medium). WordPress sites affected: 200,000+  
• NinjaFirewall. Authenticated PHAR Deserialization (Low). WordPress sites affected: 60,000+
• Multivendor Marketplace Solution for WooCommerce. Unauthenticated Arbitrary Product Comment (Medium). WordPress sites affected: 30,000+
• Event Calendar WD. Vulnerability: Cross-Site Scripting (Medium). WordPress sites affected: 20,000+
• Fancy Product Designer. Vulnerability: Unauthenticated Arbitrary File Upload and RCE (Critical). WordPress sites affected: 2,000+
• Yes/No Chart. Vulnerability: Authenticated Blind SQL Injection (High). WordPress sites affected: 2,000+

WordPress Plugins with no patches released

At the time of publication of this article no fix or patch was relased for the following vulnerabilities. This is why you are advised to delete and remove the plugins from your websites.  

• iFlyChat. Vulnerability: Authenticated Stored Cross-Site Scripting (Medium).
• Easy Preloader. Vulnerability: Authenticated Stored Cross-Site Scripting (Medium).
• SP Project & Document Manager. Vulnerability: Authenticated Shell Upload (Medium).
• Cookie Law Bar. Vulnerability: Authenticated Stored Cross-Site Scripting. (Medium)
• Gallery From Files. Vulnerability: Reflected Cross-Site Scripting (Medium)
• Visitors. Vulnerability: Unauthenticated Stored Cross-Site Scripting. (High)
• Sendit WP Newsletter. Vulnerability: Authenticated SQL Injection. (Medium)
• All 404 Redirect to Homepage. Vulnerability: Authenticated Stored Cross-Site Scripting. (Medium)
• Gallery From Files. Vulnerability: Unauthenticated RCE. (Critical)
• WP Config File Editor. Authenticated Stored Cross-Site Scripting (Medium)

If you get a closer look at these WordPress security incidents you will realise that they all come from Plugins and Themes which have not been updated. This means that you need to take the maintenance of your WordPress site seriously. If you need help with fixing your WordPress site or you need to consult a WordPress security expert, contact WP! Republic!