WordPress Vulnerability Roundup: July 2019, Part 2

New WordPress plugin vulnerabilities were disclosed during the last half of July, so we want to keep you aware. We divide the WordPress Vulnerability Roundup into four different categories:

• 1. WordPress core
• 2. WordPress Plugins
• 3. WordPress Themes
• 4. Breaches From Around the Web

* We include breaches from around the web because it is essential to also be aware of vulnerabilities outside of the WordPress ecosystem. Exploits to server software can expose sensitive data. Database breaches can expose the credentials for the users on your site, opening the door for attackers to access your site.

WordPress Core Vulnerabilities

WordPress Plugin Vulnerabilities

Several new WordPress plugin vulnerabilities have been discovered this July. Make sure to follow the suggested action below to update the plugin or completely uninstall it.

1. OneSignal – Web Push Notifications

OneSignal – Web Push Notifications versions 1.17.5 and below is vulnerable to a Stored XSS attack.

What You Should Do

2. All-in-One WP Migration

All-in-One WP Migration versions 6.97 and below is vulnerable to an Authenticated Stored XSS attack.

What You Should Do

3. WPS Hide Login

WPS Hide Login versions 1.5.2.2 and below has a bug that allows you to access the WordPress login page.

What You Should Do

4. Photo Gallery by 10Web

Photo Gallery by 10Web version1.5.30 and below of the plugin is vulnerable to a SQL Injection.

What You Should Do

5. Email Subscribers & Newsletters

Email Subscribers & Newsletters version 4.1.7 and below of the plugin is to a SQL Injection.

What You Should Do

6. Contact Form & SMTP Plugin for WordPress

Contact Form & SMTP Plugin for WordPress version 1.5.1 and below is vulnerable to a Cross-Site Request Forgery and HTML Injection attack.

What You Should Do

7. Everest Forms

Everest Forms version 1.4.9 and below of the plugin is vulnerable to a SQL Injection.

What You Should Do

8. Adaptive Images for WordPress

Adaptive Images for WordPress version 0.6.66 and below of the plugin is vulnerable to a Local File Inclusion and Deletion attack.

What You Should Do

9. AdRotate Banner Manager

AdRotate Banner Manager version 5.2 and below of the plugin is vulnerable to an Authenticated SQL Injection.

What You Should Do

10. Contact Form 7 Dynamic Text Extension

Contact Form 7 Dynamic Text Extension plugin version 2.0.2.1 and below is vulnerable to a Cross-Site Scripting attack.

What You Should Do

11. Blog2Social: Social Media Auto Post & Scheduler

Blog2Social: Social Media Auto Post & Scheduler version 5.5.0 and below of the plugin is vulnerable to an SQL Injection.

What You Should Do

12. Simple Membership

Simple Membership version 3.8.4 and below is vulnerable to a Cross-Site Request Forgery attack.

What You Should Do

13. Advanced Contact form 7 DB

Advanced Contact form 7 DB version 1.6.1 and below of the plugin is vulnerable to a SQL Injection.

What You Should Do

14. Coming Soon Page & Maintenance Mode

Coming Soon Page & Maintenance Mode versions 1.8.0 and below is vulnerable to an Unauthenticated Stored XSS attack.

What You Should Do

15. WordPress Ultra Simple Paypal Shopping Cart

WordPress Ultra Simple Paypal Shopping Cart version 4.4 and below is vulnerable to a Cross-Site Request Forgery and File Type Check.

What You Should Do

16. Category Specific RSS feed Subscription

Category Specific RSS feed Subscription version 4.4 and below is vulnerable to a Cross-Site Request Forgery and File Type Check.

What You Should Do

17. Appointment Hour Booking

Appointment Hour Booking plugin version 1.1.45 and below is vulnerable to a Cross-Site Scripting attack.

What You Should Do

WordPress Themes

How to Be Proactive About WordPress Theme & Plugin Vulnerabilities

Running outdated software is the number one reason WordPress sites are hacked. It is crucial to the security of your WordPress site that you have an update routine. You should be logging into your sites at least once a week to perform updates.

Automatic Updates Can Help

Automatic updates are a great choice for WordPress websites that don’t change very often. Lack of attention often leaves these sites neglected and vulnerable to attacks. Even with recommended security settings, running vulnerable software on your site can give an attacker an entry point into your site. Using the iThemes Security Pro plugin’s Version Management feature, you can enable automatic WordPress updates to ensure you are getting the latest security patches. These settings help protect your site with options to automatically update to new versions or to increase user security when the site’s software is outdated.

Version Management Update Options

• WordPress Updates –Automatically install the latest WordPress release.
• Plugin Automatic Updates – Automatically install the latest plugin updates. This should be enabled unless you actively maintain this site on a daily basis and install the updates manually shortly after they are released.
• Theme Automatic Updates – Automatically install the latest theme updates. This should be enabled unless your theme has file customizations.
• Granular Control over Plugin and Theme updates – You may have plugins/themes that you’d like to either manually update, or delay the update until the release has had time to prove stable. You can choose Custom for the opportunity to assign each plugin or theme to either update immediately (Enable), not update automatically at all (Disable) or update with a delay of a specified amount of days (Delay).

Strengthening and Alerting to Critical Issues

• Strengthen Site When Running Outdated Software – Automatically add extra protections to the site when an available update has not been installed for a month. The iThemes Security plugin will automatically enable stricter security when an update has not been installed for a month. First, it will force all users that do not have two-factor enabled to provide a login code sent to their email address before logging back in. Second, it will disable the WP File Editor (to block people from editing plugin or theme code), XML-RPC pingbacks and block multiple authentication attempts per XML-RPC request (both of which will make XML-RPC stronger against attacks without having to turn it off completely).
• Scan for Other Old WordPress Sites – This will checks for other outdated WordPress installs on your hosting account. A single outdated WordPress site with a vulnerability could allow attackers to compromise all the other sites on the same hosting account.
• Send Email Notifications – For issues that require intervention, an email is sent to admin-level users.

Breaches From Around the Web

1. Capital One Data Breach Compromises 100 Million+

Paige “Erratic” Thompson—a former AWS employee—hacked an AWS sever storing Capital One customer information. Once the hacker that is known as Erratic gained access to the server, she was able to obtain information on over 100 million Capital One Customers. Most of the data she was able to collect was non-critical, such as names, email and physical addresses. That said, we shouldn’t minimize the severity of the breach. Paige “Erratic” Thompson was able to get her hands on 1 million Canadian Social Insurance numbers, 140,000 Social Security numbers and 80,000 bank account numbers. Having someone’s name, address and Social Security number is all you need to steal their identity and start some loans in their name. The Capital One breach is just one of many breaches that could have been avoided. The AWS server was misconfigured, which allowed the hacker to access sensitive customer data. The Equifax breach that is back in the news was also preventable. All Equifax needed to do was apply a security patch that was released three months before they were attacked. There is an unfortunate lesson to be learned from the Capital One breach: If you share your personal information online, you should expect it to end up in a data breach.

A WordPress Security Plugin Can Help Secure Your Website

iThemes Security Pro, our WordPress security plugin, offers 30+ ways to secure and protect your website from common WordPress security vulnerabilities. With WordPress two-factor authentication, brute force protection, strong password enforcement and more, you can add an extra layer of security to your website. [content_upgrade cu_id=”50951″]Learn more about WordPress security with 10 key tips. Download the ebook now: A Guide to WordPress Security[content_upgrade_button]Download now[/content_upgrade_button][/content_upgrade]

Get iThemes Security