Wordfence Intelligence Weekly WordPress Vulnerability Report (June 26, 2023 to July 2, 2023)

Last week, there were 66 vulnerabilities disclosed in 56 WordPress Plugins and 1 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 34 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface and vulnerability API are completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

Ultimate Member <= 2.6.6 – Privilege Escalation via Arbitrary User Meta Updates
WP Post Author <= 3.3.0 – Privilege Escalation

 

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status
Number of Vulnerabilities

Unpatched
26

Patched
40

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating
Number of Vulnerabilities

Low Severity
0

Medium Severity
52

High Severity
9

Critical Severity
5

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE
Number of Vulnerabilities

Cross-Site Request Forgery (CSRF)
22

Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
17

Missing Authorization
8

Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
4

Authorization Bypass Through User-Controlled Key
3

Authentication Bypass Using an Alternate Path or Channel
2

Information Exposure
2

Server-Side Request Forgery (SSRF)
2

Improper Neutralization of Formula Elements in a CSV File
2

Improper Privilege Management
1

Incorrect Privilege Assignment
1

Use of Hard-coded Cryptographic Key
1

Improper Neutralization of Special Elements used in an LDAP Query (‘LDAP Injection’)
1

Researchers That Contributed to WordPress Security Last Week

Researcher Name
Number of Vulnerabilities

Lana Codes
(Wordfence Vulnerability Researcher)
6

Cat
5

Erwan LR
4

Rafie Muhammad
4

Rafshanzani Suhada
3

Dave Jong
2

Marco Wotschka
(Wordfence Vulnerability Researcher)
2

Dipak Panchal
1

NeginNrb
1

emad
1

Ravi Dharmawan
1

Justiice
1

Marc-Alexandre Montpas
1

Lukas Kinneberg
1

Kenichiro Ito
1

coogee86
1

Muhammad Daffa
1

Mika
1

Elliot
1

Chris Shultz
1

Le Ngoc Anh
1

Hoang Van Hiep
1

FearZzZz
1

Felipe Restrepo Rodriguez
1

Edison Poveda
1

yuyudhn
1

Etan Imanol Castro Aldrete
1

Abdi Pranata
1

qilin_99
1

Taurus Omar
1

Luca Greeb
1

Andreas Krüger
1

Abu Hurayra
1

Rafael B.
1

 

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and obtain a CVE ID through this form. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name
Software Slug

AN_GradeBook
an-gradebook

ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
armember-membership

Active Directory Integration / LDAP Integration
ldap-login-for-intranet-sites

ApplyOnline – Application Form Builder and Manager
apply-online

Autochat Automatic Conversation
auyautochat-for-wp

AutomateWoo
automatewoo

Booked – Appointment Booking for WordPress
booked

Caldera Forms Google Sheets Connector
gsheetconnector-caldera-forms

Catalyst Connect Zoho CRM Client Portal
catalyst-connect-client-portal

Duplicate Post Page Menu & Custom Post Type
duplicate-post-page-menu-custom-post-type

Easy Accordion FAQ and Knowledge Base Software for WordPress
knowledge-center

Editorial Calendar
editorial-calendar

Email download link
email-download-link

EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor
embedpress

Enhanced Text Widget
enhanced-text-widget

Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty
chaty

Form Builder | Create Responsive Contact Forms
contact-form-add

Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor
front-editor

Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite
image-map-pro-lite

Image Regenerate & Select Crop
image-regenerate-select-crop

Layer Slider
slider-slideshow

LearnDash LMS
sfwd-lms

LiquidPoll – Advanced Polls for Creators and Brands
wp-poll

Login Configurator
login-configurator

Login/Signup Popup ( Inline Form + Woocommerce )
easy-login-woocommerce

My Content Management
my-content-management

NEX-Forms – Ultimate Form Builder – Contact forms and much more
nex-forms-express-wp-form-builder

NOO Timetable
noo-timetable

POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress
post-smtp

Poll Maker – Best WordPress Poll Plugin
poll-maker

Post Hit Counter
post-hit-counter

Post to CSV by BestWebSoft
post-to-csv

Quiz Expert – Easy Quiz Maker, Exam and Test Manager
quiz-expert

Request a Quote
request-a-quote

SP Project & Document Manager
sp-client-document-manager

SW Product Bundles
sw-product-bundles

Salon booking system
salon-booking-system

Short URL
shorten-url

Subscribe2 – Form, Email Subscribers & Newsletters
subscribe2

TrustProfile and reviews for WordPress
trustprofile

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
ultimate-member

WP Abstracts
wp-abstracts-manuscripts-manager

WP Job Board
wpjobboard

WP Post Author – The Ideal Author Box for WordPress Posts, Co-Authors and Guest Authors with Author Login and Registration Form Builder
wp-post-author

WP Social AutoConnect
wp-fb-autoconnect

WPFactory Helper
wpcodefactory-helper

WPGraphQL
wp-graphql

Waitlist Woocommerce ( Back in stock notifier )
waitlist-woocommerce

Web3 – Crypto wallet Login & NFT token gating
web3-authentication

WebwinkelKeur: Webshop keurmerk & reviews for WordPress
webwinkelkeur

WooCommerce Google Sheet Connector
wc-gsheetconnector

WooCommerce Pre-Orders
woocommerce-pre-orders

WooCommerce Ship to Multiple Addresses
woocommerce-shipping-multiple-addresses

Woocommerce Order Barcodes
woocommerce-order-barcodes

WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)
miniorange-login-openid

houzez-crm
houzez-crm

WordPress Themes with Reported Vulnerabilities Last Week

Software Name
Software Slug

The7 — Website and eCommerce Builder for WordPress
dt-the7

Vulnerability Details

WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 – Authentication Bypass

WP Post Author <= 3.2.3 – Privilege Escalation

Ultimate Member <= 2.6.6 – Privilege Escalation via Arbitrary User Meta Updates

WPJobBoard <= 5.9.0 – Unauthenticated SQL Injection

Web3 – Crypto wallet Login & NFT token gating <= 2.6.0 – Authentication Bypass

LearnDash LMS <= 4.6.0 – Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change

Houzez CRM <= 1.3.3 – Authenticated (Subscriber+) SQL Injection

AN_GradeBook <= 5.0.1 – Authenticated (Subscriber+) SQL Injection

SP Project & Document Manager <= 4.67 – Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change

Short URL <= 1.6.4 – Authenticated (Subscriber+) SQL Injection

Form Builder <= 1.9.9.0 – Unauthenticated CSV Injection

Active Directory Integration / LDAP Integration <= 4.1.5 – Authenticated (Subscrber+) LDAP Injection

Post to CSV by BestWebSoft <= 1.4.0 – Authenticated (Author+) CSV Injection

Autochat Automatic Conversation <= 1.1.7 – Unauthenticated Stored Cross-Site Scripting

Email download link <= 3.7 – Unauthenticated Sensitive Information Exposure

POST SMTP Mailer <= 2.5.6 – Cross-Site Request Forgery to Account Compromise

Booked <= 2.4 – Unauthenticated Sensitive Information Exposure

Image Regenerate & Select Crop <= 7.1.0 – Missing Authorization on multiple AJAX actions

AutomateWoo <= 5.7.5 – Missing Authorization

Image Regenerate & Select Crop <= 7.1.0 – Cross-Site Request Forgery on multiple AJAX actions

Front User Submit | Front Editor <= 3.8.4 – Authenticated (Subscriber+) Stored Cross-Site Scripting

NOO Timetable <= 2.1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite <= 1.0.0 – Missing Authorization to Stored Cross-Site Scripting

Layer Slider <= 1.1.9.7 – Authenticated (Contributor+) Stored Cross-Site Scripting

Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite <= 1.0.0 – Cross-Site Request Forgery to Stored Cross-Site Scripting

WPFactory Helper <= 1.5.2 – Reflected Cross-Site Scripting via item_slug

WooCommerce Pre-Orders <= 2.0.1 – Reflected Cross-Site Scripting

Login Configurator <= 2.1 – Reflected Cross-Site Scripting

WPGraphQL <= 1.14.5 – Authenticated (Editor+) Server-Side Request Forgery

Waitlist Woocommerce ( Back in stock notifier ) <= 2.5.2 – Cross-Site Request Forgery via reset_settings

Editorial Calendar <= 3.7.12 – Authenticated (Contributor+) Insecure Direct Object Reference

Salon Booking System <= 8.4.6 – Cross-Site Request Forgery to Admin Role Change to Customer, User Meta Update via save_customer

EmbedPress <= 3.7.3 – Sensitive Information Exposure

NEX-Forms – Ultimate Form Builder <= 8.4.3 – Authenticated Stored Cross-Site Scripting via Form Name

Poll Maker <= 4.6.2 – Authenticated (Admin+) Server-Side Request Forgery

Floating Chat Widget – Chaty <= 3.1.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

SP Project & Document Manager <= 4.67 – Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings

Knowledge Center <= 2.7 – Authenticated (Admin+) Cross-Site Scripting

Catalyst Connect Zoho CRM Client Portal <= 2.0.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

My Content Management <= 1.7.6 – Authenticated (Administrator+) Stored Cross-Site Scripting

ApplyOnline – Application Form Builder and Manager <= 2.5 – Authenticated (Administrator+) Stored Cross-Site Scripting

Short URL <= 1.6.4 – Authenticated(Admin+) Stored Cross-Site Scripting

ARMember <= 4.0.4 – Authenticated (Administrator+) Stored Cross-Site Scripting

NOO Timetable <= 2.1.3 – Cross-Site Request Forgery

Waitlist Woocommerce ( Back in stock notifier ) <= 2.5.2 – Cross-Site Request Forgery to Settings Reset

TrustProfile <= 3.24 – Cross-Site Request Forgery

Quiz Expert – Easy Quiz Maker, Exam and Test Manager <= 1.5.0 – Cross-Site Request Forgery

Login/Signup Popup <= 2.3 – Cross-Site Request Forgery to Settings Reset

Post Hit Counter <= 1.3.2 – Missing Authorization

Duplicate Post Page Menu & Custom Post Type <= 2.3.1 – Missing Authorization

The7 <= 11.6.0 – Cross-Site Request Forgery

WP Social AutoConnect <= 4.6.1 – Cross-Site Request Forgery via jfb_admin_page

Enhanced Text Widget <= 1.5.7 – Missing Authorization

Subscribe2 <= 10.40 – Cross-Site Request Forgery

Request a Quote <= 2.3.10 – Cross-Site Request Forgery

WebwinkelKeur <= 3.24 – Cross-Site Request Forgery

AutomateWoo <= 5.7.5 – Cross-Site Request Forgery

LiquidPoll – Advanced Polls for Creators and Brands <= 3.3.68 – Missing Authorization via activate_addon

SW Product Bundles <= 2.0.15 – Missing Authorization

POST SMTP Mailer <= 2.5.6 – Cross-Site Request Forgery to Arbitrary Log Deletion

Caldera Forms Google Sheets Connector <= 1.2 – Cross-Site Request Forgery

WooCommerce Ship to Multiple Addresses <= 3.8.5 – Cross-Site Request Forgery

Subscribe2 <= 10.40 – Missing Authorization

WP Abstracts <= 2.6.2 – Cross-Site Request Forgery

WooCommerce Order Barcodes <= 1.6.4 – Cross-Site Request Forgery

WooCommerce Google Sheet Connector <= 1.3.4 – Cross-Site Request Forgery

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us using our CVE Request form, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (June 26, 2023 to July 2, 2023) appeared first on Wordfence.