WordPress Vulnerability Roundup: January 2020, Part 2
New WordPress plugin and theme vulnerabilities were disclosed during the second half of January, so we want to keep you aware. In this post, we cover recent WordPress plugin, theme and core vulnerabilities and what to do if you are running one of the vulnerable plugins or themes on your website. The WordPress Vulnerability Roundup is divided into four different categories: 1.
New WordPress plugin and theme vulnerabilities were disclosed during the second half of January, so we want to keep you aware. In this post, we cover recent WordPress plugin, theme and core vulnerabilities and what to do if you are running one of the vulnerable plugins or themes on your website.
The WordPress Vulnerability Roundup is divided into four different categories:
Code Snippets versions 2.13.3 and below have a Cross-Site Request Forgery vulnerability that can lead to a Remote Code Execution attack.
WP Database Reset versions 3.1 and below have two vulnerabilities. The first vulnerability would all an unauthenticated user to reset any database table to the initial WordPress set-up state. The second vulnerability would allow any user to grant their account administrative privileges and drop other users from the table.
Chained Quiz versions 1.1.8 and below are vulnerable to an Unauthenticated Reflected XSS attack.
Resim Ara version 3.0 and below are vulnerable to an Unauthenticated Reflected XSS attack.
Marketo Forms and Tracking version 3.2.2 and below are vulnerable to a Cross-Site Scripting attack that could lead to Cross-Site Request Forgery due to a lack of CRSF checks and sanitization.
Contextual Adminbar Color versions 0.2 and below have an Authenticated Stored Cross-Site Scripting vulnerability.
2J SlideShow versions 1.3.33 and below have authenticated arbitrary plugin deactivation vulnerability that will allow a user with minimal privileges–like a Subscriber–to disable any plugin installed on the site.
Chatbot with IBM Watson versions 0.8.20 and below includes DOM-based XSS vulnerability that will allow a remote attacker to execute JavaScript in the victim’s browser by tricking the victim into pasting HTML inside the chatbox.
WP Accessibility versions 1.6.10 and below have a minor Authenticated Stored Cross-Site Scripting vulnerability in the “Styles for Skiplinks when they have focus” section of the WP Accessibility plugin.
AccessAlly versions below 3.3.2 have an Arbitrary PHP Execution vulnerability. The vulnerability allows an attacker to execute PHP code using the Login Widget. The vulnerability has been exploited out in the wild.
Ultimate Member versions 2.1.2 and below have an Insecure Direct Object Reference that would allow an attacker to change other user’s profiles and cover photos
WP DS FAQ Plus versions 1.4.1 and below are vulnerable to a Stored Cross-Site Scripting attack.
wpCentral versions 1.4.7 and below have a Privilege Escalation vulnerability that will allow any logged in user to increase their privileges. If you allow anyone to register and create a user on your site, an attacker could create a new user with the subscriber user role and then give themselves admin privileges.
WPS Hide Login versions 1.5.4.2 and below had a vulnerability that would allow an attacker to bypass the secret login. If in 2020 you are still using a custom login URL as a security strategy, please check out our 5 Simple Rules for WordPress Login Security.
Contact Form Clean and Simple versions 4.7.0 and below have Stored Cross-Site Forgery vulnerability that would allow a user with admin capabilities to submit malicious code through the plugin’s options. The malicious code would then be executed on every page with the contact form.
Calculated Fields Form versions 1.0.353 and below have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability will allow an authenticated user with access to edit or create Calculated Fields Form content to inject javascript into input fields such as ‘field name’ and ‘form name.
Flamingo versions 2.1 and below have a CSV Injection vulnerability. The vulnerability will allow users with low-level privileges to inject OS command that will be included in the exported CSV file, which could lead to malicious code execution.
CarSpot versions 2.2.0 and below have multiple vulnerabilities, including 2 separate Authenticated Persistent Cross-Site Scripting vulnerabilities and an Insecure Direct Object Reference vulnerability.
Houzez – Real Estate versions 1.8.3.1 and below have an Unauthenticated Cross-Site Scripting vulnerability.
- 1. WordPress core
- 2. WordPress plugins
- 3. WordPress themes
- 4. Breaches from around the web
WordPress Core Vulnerabilities
There haven’t been any disclosed WordPress vulnerabilities in January of 2020.
WordPress Plugin Vulnerabilities
Several new WordPress plugin vulnerabilities have been discovered this month so far. Make sure to follow the suggested action below to update the plugin or completely uninstall it.1. Code Snippets
Code Snippets versions 2.13.3 and below have a Cross-Site Request Forgery vulnerability that can lead to a Remote Code Execution attack.
What You Should Do
The vulnerabilities have been patched, so you should update to version 2.14.0.
2. WP Database Reset
WP Database Reset versions 3.1 and below have two vulnerabilities. The first vulnerability would all an unauthenticated user to reset any database table to the initial WordPress set-up state. The second vulnerability would allow any user to grant their account administrative privileges and drop other users from the table.
What You Should Do
The vulnerabilities have been patched, so you should update to version 3.15.
3. Chained Quiz
Chained Quiz versions 1.1.8 and below are vulnerable to an Unauthenticated Reflected XSS attack.
What You Should Do
The vulnerability has been patched, so you should update to version 1.1.8.2.
4. Resim Ara
Resim Ara version 3.0 and below are vulnerable to an Unauthenticated Reflected XSS attack.
What You Should Do
WordPress.org closed Resim Ara on January 17, 2020, so you should remove the plugin and find a replacement.
5. Marketo Forms and Tracking
Marketo Forms and Tracking version 3.2.2 and below are vulnerable to a Cross-Site Scripting attack that could lead to Cross-Site Request Forgery due to a lack of CRSF checks and sanitization.
What You Should Do
WordPress.org closed Marketo Forms and Tracking on December 11, 2019, so you should remove the plugin and find a replacement.
6. Contextual Adminbar Color
Contextual Adminbar Color versions 0.2 and below have an Authenticated Stored Cross-Site Scripting vulnerability.
What You Should Do
The vulnerability has been patched, and you should update it to version 0.3.
7. 2J SlideShow
2J SlideShow versions 1.3.33 and below have authenticated arbitrary plugin deactivation vulnerability that will allow a user with minimal privileges–like a Subscriber–to disable any plugin installed on the site.
What You Should Do
The vulnerability has been patched, and you should update it to version 1.3.40.
8. Chatbot with IBM Watson
Chatbot with IBM Watson versions 0.8.20 and below includes DOM-based XSS vulnerability that will allow a remote attacker to execute JavaScript in the victim’s browser by tricking the victim into pasting HTML inside the chatbox.
What You Should Do
The vulnerability has been patched, so you should update to version 0.8.21.
9. WP Accessibility
WP Accessibility versions 1.6.10 and below have a minor Authenticated Stored Cross-Site Scripting vulnerability in the “Styles for Skiplinks when they have focus” section of the WP Accessibility plugin.
What You Should Do
The vulnerability has been patched, so you should update to version 1.7.0.
10. AccessAlly
AccessAlly versions below 3.3.2 have an Arbitrary PHP Execution vulnerability. The vulnerability allows an attacker to execute PHP code using the Login Widget. The vulnerability has been exploited out in the wild.
What You Should Do
The vulnerability has been patched, so you should update to version 3.3.2.
11. Ultimate Member
Ultimate Member versions 2.1.2 and below have an Insecure Direct Object Reference that would allow an attacker to change other user’s profiles and cover photos
What You Should Do
The vulnerability has been patched, so you should update to version 2.1.3.
12. WP DS FAQ Plus
WP DS FAQ Plus versions 1.4.1 and below are vulnerable to a Stored Cross-Site Scripting attack.
What You Should Do
The vulnerability has been patched, so you should update to version 1.4.2.
13. wpCentral
wpCentral versions 1.4.7 and below have a Privilege Escalation vulnerability that will allow any logged in user to increase their privileges. If you allow anyone to register and create a user on your site, an attacker could create a new user with the subscriber user role and then give themselves admin privileges.
What You Should Do
The vulnerability has been patched, so you should update to version 1.4.8.
14. WPS Hide Login
WPS Hide Login versions 1.5.4.2 and below had a vulnerability that would allow an attacker to bypass the secret login. If in 2020 you are still using a custom login URL as a security strategy, please check out our 5 Simple Rules for WordPress Login Security.
What You Should Do
The vulnerability has been patched, so you should update to version 1.5.5.
15. Contact Form Clean and Simple
Contact Form Clean and Simple versions 4.7.0 and below have Stored Cross-Site Forgery vulnerability that would allow a user with admin capabilities to submit malicious code through the plugin’s options. The malicious code would then be executed on every page with the contact form.
What You Should Do
WordPress.org closed Contact Form Clean and Simple on January 23, 2020, so you should remove the plugin and find a replacement.
16. Calculated Fields Form
Calculated Fields Form versions 1.0.353 and below have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability will allow an authenticated user with access to edit or create Calculated Fields Form content to inject javascript into input fields such as ‘field name’ and ‘form name.
What You Should Do
The vulnerability has been patched, so you should update to version 1.0.354.
17. Flamingo
Flamingo versions 2.1 and below have a CSV Injection vulnerability. The vulnerability will allow users with low-level privileges to inject OS command that will be included in the exported CSV file, which could lead to malicious code execution.
What You Should Do
The vulnerability has been patched, so you should update to version 2.1.1.
WordPress Themes
1. CarSpot
CarSpot versions 2.2.0 and below have multiple vulnerabilities, including 2 separate Authenticated Persistent Cross-Site Scripting vulnerabilities and an Insecure Direct Object Reference vulnerability.
What You Should Do
The vulnerability has been patched, so you should update to version 2.2.1.
2. Houzez – Real Estate
Houzez – Real Estate versions 1.8.3.1 and below have an Unauthenticated Cross-Site Scripting vulnerability.
What You Should Do
The vulnerability has been patched, so you should update to version 1.8.4.
How to Be Proactive About WordPress Theme & Plugin Vulnerabilities
Running outdated software is the number one reason WordPress sites are hacked. It is crucial to the security of your WordPress site that you have an update routine. You should be logging into your sites at least once a week to perform updates.
iThemes Sync is our central dashboard to help you manage multiple WordPress sites. From the Sync dashboard, you can view available updates for all your sites and then update plugins, themes, and WordPress core with one click. You can also get daily email notifications when a new version update is available.
Try Sync FREE for 30 daysLearn more
Zoom fixed a flaw that could open meetings to hackers. Every Zoom meeting is assigned a randomly generated 9-10 digit meeting ID. Check Point security researchers were able to correctly guess some meetings IDs and successfully join some Zoom calls.
Check Point disclosed the vulnerability to Zoom fixed the flaw by making replacing randomized generation of meeting ID numbers with a cryptographically strong ID, added more digits to meeting ID numbers, and made password requirements the default option changed scheduled
How Automatic Updates Can Help
Automatic updates are a great choice for WordPress websites that don’t change very often. Lack of attention often leaves these sites neglected and vulnerable to attacks. Even with recommended security settings, running vulnerable software on your site can give an attacker an entry point into your site. Using the iThemes Security Pro plugin’s Version Management feature, you can enable automatic WordPress updates to ensure you are getting the latest security patches. These settings help protect your site with options to automatically update to new versions or to increase user security when the site’s software is outdated.
Version Management Update Options
- WordPress Updates –Automatically install the latest WordPress release.
- Plugin Automatic Updates – Automatically install the latest plugin updates. This should be enabled unless you actively maintain this site on a daily basis and install the updates manually shortly after they are released.
- Theme Automatic Updates – Automatically install the latest theme updates. This should be enabled unless your theme has file customizations.
- Granular Control over Plugin and Theme updates – You may have plugins/themes that you’d like to either manually update, or delay the update until the release has had time to prove stable. You can choose Custom for the opportunity to assign each plugin or theme to either update immediately (Enable), not update automatically at all (Disable) or update with a delay of a specified amount of days (Delay).
Strengthening and Alerting to Critical Issues
- Strengthen Site When Running Outdated Software – Automatically add extra protections to the site when an available update has not been installed for a month. The iThemes Security plugin will automatically enable stricter security when an update has not been installed for a month. First, it will force all users that do not have two-factor enabled to provide a login code sent to their email address before logging back in. Second, it will disable the WP File Editor (to block people from editing plugin or theme code), XML-RPC pingbacks, and block multiple authentication attempts per XML-RPC request (both of which will make XML-RPC stronger against attacks without having to turn it off completely).
- Scan for Other Old WordPress Sites – This will checks for other outdated WordPress installs on your hosting account. A single outdated WordPress site with a vulnerability could allow attackers to compromise all the other sites on the same hosting account.
- Send Email Notifications – For issues that require intervention, an email is sent to admin-level users.
Managing Multiple WP Sites? Update Plugins, Themes & WP Core Across Multiple Sites at Once from the iThemes Sync Dashboard
iThemes Sync is our central dashboard to help you manage multiple WordPress sites. From the Sync dashboard, you can view available updates for all your sites and then update plugins, themes, and WordPress core with one click. You can also get daily email notifications when a new version update is available.
Try Sync FREE for 30 daysLearn more
Breaches From Around the Web
We include breaches from around the web because it is essential to also be aware of vulnerabilities outside of the WordPress ecosystem. Exploits to server software can expose sensitive data. Database breaches can expose the credentials for the users on your site, opening the door for attackers to access your site.1. Zoom
Zoom fixed a flaw that could open meetings to hackers. Every Zoom meeting is assigned a randomly generated 9-10 digit meeting ID. Check Point security researchers were able to correctly guess some meetings IDs and successfully join some Zoom calls.
Check Point disclosed the vulnerability to Zoom fixed the flaw by making replacing randomized generation of meeting ID numbers with a cryptographically strong ID, added more digits to meeting ID numbers, and made password requirements the default option changed scheduled
A WordPress Security Plugin Can Help Secure Your Website
iThemes Security Pro, our WordPress security plugin, offers 30+ ways to secure and protect your website from common WordPress security vulnerabilities. With WordPress, two-factor authentication, brute force protection, strong password enforcement, and more, you can add an extra layer of security to your website. [content_upgrade cu_id=”50951″]Learn more about WordPress security with 10 key tips. Download the ebook now: A Guide to WordPress Security[content_upgrade_button]Download now[/content_upgrade_button][/content_upgrade]Get iThemes Security
Join us for the next Solid Academy Webinar!
Free weekly webinars that will help you master WordPress and increase your business's bottom line.
What is a WordPress Phishing Attack?
Learn how to identify and prevent phishing attacks on WordPress websites.
Kiki SheldonWebsite Protection: 5 Ways to Keep Your Website Safe
Robust website protection is the shield that stands between your business and relentless cyber attacks. Prioritizing website protection enables businesses to fortify defenses to safeguard their online presence and preserve the trust of their customers in the face of ever-evolving cybersecurity threats.
Kiki Sheldon23 Ideas To Grow Your WordPress Business in 2023
WordPress is the most popular website-building platform worldwide, trusted by numerous brands. WordPress enables you to build a user-friendly and highly reliable site, together with tools and plugins to enhance your marketing and work like a lead magnet. All these features make WordPress the platform chosen by more than 43% of businesses globally.
SolidWP Editorial TeamSign up now — Get SolidWP updates and valuable content straight to your inbox
Sign up
Placeholder text
Placeholder text
Get started with confidence — risk free, guaranteed
