Last week, our friends at Sucuri alerted us as well as many other popular WordPress plugins (including WordPress SEO, Jetpack, All in One SEO, Gravity Forms, Ninja Forms, WP-Ecommerce, WP Touch and others) about an important security issue affecting our iThemes Exchange plugin, several Exchange add-ons and several Builder themes.
Because the issue discovered affects so many popular WordPress plugins, Sucuri, working with the WordPress Security Team, led a highly coordinated update and disclosure effort to minimize vulnerability and allow time to get updates done.
Today we’re releasing important security patches for our iThemes Exchange plugin, several Exchange add-ons and several Builder themes. More details follow below, but the short version of this post is simple: update to the latest versions of these plugins and themes immediately.
Plugins & Themes Updated Today
|PRODUCT||LATEST VERSION NUMBER|
|2Checkout Add-on for iThemes Exchange||1.1.0|
|Authorize.net Add-on for iThemes Exchange||1.1.0|
|Custom URL Tracking Add-on for iThemes Exchange||1.1.0|
|Easy Canadian Sales Taxes Add-on for iThemes Exchange||1.1.0|
|Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange||1.2.0|
|Easy US Sales Taxes Add-on for iThemes Exchange||1.1.0|
|Invoices Add-on for iThemes Exchange||1.4.0|
|Manual Purchases Add-on for iThemes Exchange||1.1.0|
|Membership Add-on for iThemes Exchange||1.3.0|
|PayPal Pro Add-on for iThemes Exchange||1.1.0|
|Stripe Add-on for iThemes Exchange||1.2.0|
|Table Rate Shipping Add-on for iThemes Exchange||1.1.0|
|Builder Theme Depot||5.0.30|
|Builder Theme Market||5.1.27|
|Builder Style Manager||0.7.7|
What Did We Fix?
The main issue we’re fixing with this release is the wrong usage of add_query_arg and remove_query_arg functions used in these plugins and themes.
Update Your Plugins & Themes To the Latest Versions
If you’re using any of the products listed in the table above, you should immediately update to the latest versions.
There are three easy ways to update:
- Update immediately now from the Sync Dashboard
- Update directly from the WordPress dashboard for licensed sites
- Download the latest version from the iThemes Member Panel