WordPress Vulnerability Roundup: August 2019, Part 1

Several new WordPress plugin and theme vulnerabilities were disclosed during the first half of August, so we want to keep you aware. In this post, we cover recent WordPress plugin and theme vulnerabilities and what to do if you are running one of the vulnerable plugins or themes on your website. We divide the WordPress Vulnerability Roundup into four different categories:

• 1. WordPress core
• 2. WordPress Plugins
• 3. WordPress Themes
• 4. Breaches From Around the Web

* We include breaches from around the web because it is essential to also be aware of vulnerabilities outside of the WordPress ecosystem. Exploits to server software can expose sensitive data. Database breaches can expose the credentials for the users on your site, opening the door for attackers to access your site.

WordPress Core Vulnerabilities

WordPress Plugin Vulnerabilities

Several new WordPress plugin vulnerabilities have been discovered this August. Make sure to follow the suggested action below to update the plugin or completely uninstall it.

1. WP Fastest Cache

WP Fastest Cache version 0.8.9.5 and below is vulnerable to a Directory Traversal attack.

What You Should Do

2. Popup Builder

Popup Builder version 3.44 and below is vulnerable to a SQL Injection.

What You Should Do

3. Email Subscribers & Newsletters

4. Ultimate Member

Ultimate Member version 2.0.53 and below is vulnerable to a Cross-Site Scripting attack.

What You Should Do

5. Woody Ad Snippets

Woody Ad Snippets version 2.2.4 and below is vulnerable to an unauthenticated options import and stored XSS issues that could lead to Remote Code Execution exploit.

What You Should Do

6. Give

Give version 2.5.0 and below is vulnerable to a SQL Injection.

What You Should Do

7. Login or Logout Menu Item

Login or Logout Menu Item version 1.1.1 and below is vulnerable to an Unauthenticated Options Change. The exploit would allow an attacker to change the link to the login URL and redirect users to a fake login form. After a user filled the malicious login form, the attacker would have their credentials to access your site.

What You Should Do

8. CformsII

CformsII version 15.0.1 and below is vulnerable to a Cross-Site Request Forgery and HTML Injection attack.

What You Should Do

9. PPOM for WooCommerce

PPOM for WooCommerce versions 18.3 and below is vulnerable to an Authenticated Stored XSS attack.

What You Should Do

10. 301 Redirects Addon Bulk Uploader

301 Redirects Addon Bulk Uploader version 1.2.4 and below is vulnerable to an Unauthenticated Options Change. The exploit allows an unauthenticated user to redirect all pages to a malicious site.

What You Should Do

11. ND Donations

ND Donations version 1.3 and below is vulnerable to an Unauthenticated Options Change. The exploit allows an unauthenticated user to adjust several WordPress settings. This would allow the attacker to create a new user and then change the user role to Admin.

What You Should Do

12. ND Booking

ND Booking version 2.4 and below is vulnerable to an Unauthenticated Options Change. The exploit allows an unauthenticated user to adjust a number of WordPress settings and enable the attacker to create a new user and then change the user role to Admin.

What You Should Do

13. ND Learning Courses

ND Learning Courses version 4.7 and below is vulnerable to an Unauthenticated Options Change. The exploit allows an unauthenticated user to adjust several WordPress settings and would enable the attacker to create a new user and then change the user role to Admin.

What You Should Do

14. JoomSport

JoomSport version 3.3 and below is vulnerable to a SQL Injection.

What You Should Do

WordPress Themes

1. Real Estate 7

Real Estate 7 versions 2.9.0 and below is vulnerable to a Stored XSS Injection that allows an attacker to inject JavaScript and HTML on the front end of a site.

What You Should Do

How to Be Proactive About WordPress Theme & Plugin Vulnerabilities

Running outdated software is the number one reason WordPress sites are hacked. It is crucial to the security of your WordPress site that you have an update routine. You should be logging into your sites at least once a week to perform updates.

Automatic Updates Can Help

Automatic updates are a great choice for WordPress websites that don’t change very often. Lack of attention often leaves these sites neglected and vulnerable to attacks. Even with recommended security settings, running vulnerable software on your site can give an attacker an entry point into your site. Using the iThemes Security Pro plugin’s Version Management feature, you can enable automatic WordPress updates to ensure you are getting the latest security patches. These settings help protect your site with options to automatically update to new versions or to increase user security when the site’s software is outdated.

Version Management Update Options

• WordPress Updates –Automatically install the latest WordPress release.
• Plugin Automatic Updates – Automatically install the latest plugin updates. This should be enabled unless you actively maintain this site on a daily basis and install the updates manually shortly after they are released.
• Theme Automatic Updates – Automatically install the latest theme updates. This should be enabled unless your theme has file customizations.
• Granular Control over Plugin and Theme updates – You may have plugins/themes that you’d like to either manually update, or delay the update until the release has had time to prove stable. You can choose Custom for the opportunity to assign each plugin or theme to either update immediately (Enable), not update automatically at all (Disable) or update with a delay of a specified amount of days (Delay).

Strengthening and Alerting to Critical Issues

• Strengthen Site When Running Outdated Software – Automatically add extra protections to the site when an available update has not been installed for a month. The iThemes Security plugin will automatically enable stricter security when an update has not been installed for a month. First, it will force all users that do not have two-factor enabled to provide a login code sent to their email address before logging back in. Second, it will disable the WP File Editor (to block people from editing plugin or theme code), XML-RPC pingbacks and block multiple authentication attempts per XML-RPC request (both of which will make XML-RPC stronger against attacks without having to turn it off completely).
• Scan for Other Old WordPress Sites – This will checks for other outdated WordPress installs on your hosting account. A single outdated WordPress site with a vulnerability could allow attackers to compromise all the other sites on the same hosting account.
• Send Email Notifications – For issues that require intervention, an email is sent to admin-level users.

Breaches From Around the Web

1. Suprema’s Biostar 2 Insecurely Stores 27.8 Million Biometrics Credentials

Suprema’s Biostar 2 is a security platform that is used to secure commercial buildings. Security researchers Noam Rotem, Ran Locar, and vpnMentor discovered the unencrypted database containing sensitive information about companies and their employees. After breaching the database, the researches were able to find employees personal information, usernames and passwords. vpnMentor also mentions that their team got their hands on over a million facial and fingerprint records. It is worth mentioning that it is unknown if any malicious actors were able to access the poorly secured database. Suprema is a world top 50 security manufacturer, and they should have known better than to secure sensitive information unencrypted.

2. Paige “erratic” Thompson Update

In the last vulnerability roundup, we covered the Capital One database breach and the suspected culprit Paige “erratic” Thompson. The U.S. Attorney’s Office in Seattle said that in server found in erratic’s bedroom, stored stolen data from over 30 more companies. The U.S. Attorney’s Office didn’t disclose the names of the companies. We will keep an eye on this story and will update you if the names of the companies are made public.

3. Microsoft Bluetooth Vulnerability

Microsoft’s August security patch included a fix for an Encryption Key Negotiation of Bluetooth Vulnerability. The exploit makes it easier for an attacker to brute force the Bluetooth session and the decrypt the traffic between devices. Be sure to apply the August security patch.

A WordPress Security Plugin Can Help Secure Your Website

iThemes Security Pro, our WordPress security plugin, offers 30+ ways to secure and protect your website from common WordPress security vulnerabilities. With WordPress two-factor authentication, brute force protection, strong password enforcement, and more, you can add an extra layer of security to your website. [content_upgrade cu_id=”50951″]Learn more about WordPress security with 10 key tips. Download the ebook now: A Guide to WordPress Security[content_upgrade_button]Download now[/content_upgrade_button][/content_upgrade]

Get iThemes Security