WordPress Vulnerability Roundup: November 2019, Part 1

WordPress Themes

1. Zoner – Real Estate Theme

Zoner Real Estate Theme version 4.1.1 and below a Persistent Cross-Site Scripting and Insecure Direct Object Reference vulnerabilities.

What You Should Do

How to Be Proactive About WordPress Theme & Plugin Vulnerabilities

Running outdated software is the number one reason WordPress sites are hacked. It is crucial to the security of your WordPress site that you have an update routine. You should be logging into your sites at least once a week to perform updates.

Automatic Updates Can Help

Automatic updates are a great choice for WordPress websites that don’t change very often. Lack of attention often leaves these sites neglected and vulnerable to attacks. Even with recommended security settings, running vulnerable software on your site can give an attacker an entry point into your site. Using the iThemes Security Pro plugin’s Version Management feature, you can enable automatic WordPress updates to ensure you are getting the latest security patches. These settings help protect your site with options to automatically update to new versions or to increase user security when the site’s software is outdated.

Version Management Update Options

• WordPress Updates –Automatically install the latest WordPress release.
• Plugin Automatic Updates – Automatically install the latest plugin updates. This should be enabled unless you actively maintain this site on a daily basis and install the updates manually shortly after they are released.
• Theme Automatic Updates – Automatically install the latest theme updates. This should be enabled unless your theme has file customizations.
• Granular Control over Plugin and Theme updates – You may have plugins/themes that you’d like to either manually update, or delay the update until the release has had time to prove stable. You can choose Custom for the opportunity to assign each plugin or theme to either update immediately (Enable), not update automatically at all (Disable) or update with a delay of a specified amount of days (Delay).

Strengthening and Alerting to Critical Issues

• Strengthen Site When Running Outdated Software – Automatically add extra protections to the site when an available update has not been installed for a month. The iThemes Security plugin will automatically enable stricter security when an update has not been installed for a month. First, it will force all users that do not have two-factor enabled to provide a login code sent to their email address before logging back in. Second, it will disable the WP File Editor (to block people from editing plugin or theme code), XML-RPC pingbacks, and block multiple authentication attempts per XML-RPC request (both of which will make XML-RPC stronger against attacks without having to turn it off completely).
• Scan for Other Old WordPress Sites – This will checks for other outdated WordPress installs on your hosting account. A single outdated WordPress site with a vulnerability could allow attackers to compromise all the other sites on the same hosting account.
• Send Email Notifications – For issues that require intervention, an email is sent to admin-level users.

Breaches From Around the Web

1. WordPress Users Infect Own Sites With Pirated Plugins & Themes

According to WordFence, there has been an uptick in the WP-VCD malvertising campaign. This particular malware is quite nasty as it is very difficult to remove from an infected site completely, and it can spread to other WordPress sites on the server. The most frustrating part for site owners that have been affected by the WP-VCD malware is that they infected their own site. Site owners who have installed free and pirated versions of paid plugins and themes, got a little more than they bargained for. The pirated software included malicious code that created a back door with a welcome mat for the WP-VCD virus. On day 1 of the iThemes WordPress Disaster Week, we covered how to prevent a security disaster. One of the significant things that we covered was limiting PHP exploit opportunities by only installing software from trusted sources. Having a site infected with malware is always made worse when you know that it could have and should have been prevented.

A WordPress Security Plugin Can Help Secure Your Website

iThemes Security Pro, our WordPress security plugin, offers 30+ ways to secure and protect your website from common WordPress security vulnerabilities. With WordPress two-factor authentication, brute force protection, strong password enforcement, and more, you can add an extra layer of security to your website. [content_upgrade cu_id=”51030″]Get simple tips for better WordPress security. Download the new ebook: WordPress Security Pocket Guide[content_upgrade_button]Download now[/content_upgrade_button][/content_upgrade]

Get iThemes Security Pro