Wordfence Intelligence Weekly WordPress Vulnerability Report (July 10, 2023 to July 16, 2023)

Note: We accidentally sent out an email for this report with last weeks subject line. Due to the subject line not being very different week to week for this report, we opted to just leave it as is and not send a follow-up email. We apologize for this error on our part!

Last week, there were 69 vulnerabilities disclosed in 68 WordPress Plugins and 1 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 29 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface and vulnerability API are completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

WAF-RULE-618 – Information redacted while we work with the developer to ensure this gets patched.

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status
Number of Vulnerabilities

Unpatched
16

Patched
53

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating
Number of Vulnerabilities

Low Severity
0

Medium Severity
52

High Severity
17

Critical Severity
0

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE
Number of Vulnerabilities

Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
25

Cross-Site Request Forgery (CSRF)
14

Missing Authorization
14

Server-Side Request Forgery (SSRF)
3

Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
3

Information Exposure
3

Authorization Bypass Through User-Controlled Key
2

Unprotected Storage of Credentials
1

Incorrect Authorization
1

Use of Less Trusted Source
1

URL Redirection to Untrusted Site (‘Open Redirect’)
1

Incorrect Privilege Assignment
1

Researchers That Contributed to WordPress Security Last Week

Researcher Name
Number of Vulnerabilities

Rafie Muhammad
8

Mika
6

Lana Codes
(Wordfence Vulnerability Researcher)
5

LEE SE HYOUNG
3

Erwan LR
3

Phd
3

Alex Thomas
(Wordfence Vulnerability Researcher)
3

Abdi Pranata
3

Yuki Haruma
2

emad
2

Nguyen Xuan Chien
2

Le Hong Minh
2

Dave Jong
2

Andreas Damen
1

yuyudhn
1

Fariq Fadillah Gusti Insani
1

Nithissh S
1

Ullash Raj
1

Emili Castells
1

Rafshanzani Suhada
1

Bob Matyas
1

Ravi Dharmawan
1

Paul Goodchild
1

Skalucy
1

Cat
1

WPScanTeam
1

Kindaichi Hiro
1

Shreya Pohekar
1

Rio Darmawan
1

 

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and obtain a CVE ID through this form. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name
Software Slug

ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
armember-membership

All-In-One Security (AIOS) – Security and Firewall
all-in-one-wp-security-and-firewall

Art Direction
art-direction

Authors List
authors-list

BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin
bookingpress-appointment-booking

BuddyPress Builder for Elementor – BuddyBuilder
stax-buddy-builder

Buy Me a Coffee – Button and Widget Plugin
buymeacoffee

Checkout with Zelle on Woocommerce
wc-zelle

Coming Soon Chop Chop
cc-coming-soon

Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms
fluentform

Custom Field For WP Job Manager
custom-field-for-wp-job-manager

Custom Fields for WooCommerce
addify-custom-fields-for-woocommerce

Custom Registration Forms Builder for WooCommerce
addify-custom-registration-forms-builder

DirectoryPress – Business Directory And Classified Ad Listing
directorypress

Dovetail
dovetail

Drag & Drop Sales Funnel Builder for WordPress – WPFunnels
wpfunnels

Export and Import Users and Customers
users-customers-import-export-for-wp-woocommerce

Falang multilanguage for WordPress
falang

Forminator – Contact Form, Payment Form & Custom Form Builder
forminator

Grid Kit Premium
grid-kit-premium

HTTP Headers
http-headers

IP2Location Country Blocker
ip2location-country-blocker

Image Watermark for WooCommerce
addify-image-watermark-for-woocommerce

Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files Into Your WordPress Site
integrate-google-drive

Integration for Contact Form 7 and Salesforce
cf7-salesforce

JetFormBuilder — Dynamic Blocks Form Builder
jetformbuilder

KB Support – WordPress Help Desk
kb-support

MF Gig Calendar
mf-gig-calendar

Mail Control – Email Customizer, SMTP Deliverability, logging, open and click Tracking
mail-control

MailArchiver
mailarchiver

Media Library Assistant
media-library-assistant

OptiMonk: Popups, Personalization & A/B Testing
exit-intent-popups-by-optimonk

POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress
post-smtp

Premium Addons Pro for Elementor
premium-addons-pro

Price Calculator for WooCommerce
addify-price-calculator-for-woocommerce

Product Dynamic Pricing and Discounts for WooCommerce
addify-product-dynamic-pricing-and-discounts

Radio Forge Muses Player with Skins
radio-forge

Replace Word
replace-word

School Management System – WPSchoolPress
wpschoolpress

Short URL
shorten-url

Shortcode IMDB
shortcode-imdb

Social Media Icons Widget
spoontalk-social-media-icons-widget

Social Share, Social Login and Social Comments Plugin – Super Socializer
super-socializer

Spectra – WordPress Gutenberg Blocks
ultimate-addons-for-gutenberg

Terms descriptions
terms-descriptions

Twittee Text Tweet
twittee-text-tweet

User Activity Log
user-activity-log

Variation Images Gallery for WooCommerce
woo-product-variation-gallery

Variation Swatches for WooCommerce
woo-product-variation-swatches

WP Default Feature Image
wp-default-feature-image

WP Social AutoConnect
wp-fb-autoconnect

WP Testimonials
testimonial-widgets

WPAdmin AWS CDN
aws-cdn-by-wpadmin

WooCommerce Abandoned Cart Recovery
addify-abandoned-cart-recovery

WooCommerce Advanced Free Gifts
addify-free-gifts-woocommerce

WooCommerce Checkout Field Manager
addify-checkout-fields-manager

WooCommerce Custom Order Number
addify-custom-order-number

WooCommerce Gift Registry
addify-gift-registry-for-woocommerce

WooCommerce GoCardless Gateway
woocommerce-gateway-gocardless

WooCommerce Order Approval
addify-order-approval-woocommerce

WooCommerce Order Tracking
addify-order-tracking-for-woocommerce

WooCommerce Pre-Orders
woocommerce-pre-orders

WooCommerce Product Labels and Stickets
addify-product-labels-and-stickers

WooCommerce Product Stock Alert
woocommerce-product-stock-alert

WooCommerce Ship to Multiple Addresses
woocommerce-shipping-multiple-addresses

WooCommerce Warranty Requests
woocommerce-warranty

Zippy
zippy

cartflows-pro
cartflows-pro

WordPress Themes with Reported Vulnerabilities Last Week

Software Name
Software Slug

RealHomes
realhomes

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities.

JetFormBuilder <= 3.0.8 – Authenticated (Author+) Privilege Escalation

Spectra <= 2.6.6 – Authenticated (Contributor+) Server-Side Request Forgery in import_wpforms

User Activity Log <= 1.6.2 – Unauthenticated SQL Injection via username

Checkout with Zelle on Woocommerce <= 3.1 – Missing Authorization

Integrate Google Drive <= 1.1.99 – Missing Authorization via REST API Endpoints

Buy Me a Coffee – Button and Widget Plugin <= 3.7 – Missing Authorization

RealHomes <= 4.0.2 – Missing Authorization

DirectoryPress <= 3.6.2 – Missing Authorization

Export and Import Users and Customers <= 2.4.1 – Missing Authorization to Authenticated (Shop Manager) Arbitrary User Password Change

User Activity Log <= 1.6.2 – Authenticated (Administrator+) SQL Injection

Post SMTP <= 2.5.7 – Unauthenticated Stored Cross-Site Scripting via Email

Mail Control <= 0.2.8 – Unauthenticated Stored Cross-Site Scripting via Email Subject

FluentForm <= 4.3.25 – Authenticated (Administrator+) SQL Injection

Radio Forge Muses Player with Skins <= 2.5 – Reflected Cross-Site Scripting

MailArchiver <= 2.10.1 – Unauthenticated Stored Cross-Site Scripting via Email Subject

Buy Me a Coffee – Button and Widget Plugin <= 3.7 – Cross-Site Request Forgery

Integration for Contact Form 7 and Salesforce <= 1.3.3 – Open Redirect

Zippy <= 1.6.2 – Missing Authorization via adminInit

Download IP2Location Country Blocker <= 2.29.1 – Bypass via IP Spoofing

WooCommerce GoCardless Gateway <= 2.5.6 – Unauthenticated Insecure Direct Object Reference

Art Direction <= 0.2.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

Super Socializer <= 7.13.53 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

MF Gig Calendar <= 1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via event_title and event_time

Spectra <= 2.6.6 – Authenticated (Contributor+) Server-Side Request Forgery in template_importer

Buy Me a Coffee – Button and Widget Plugin <= 3.6 – Authenticated (Subscriber+) Stored Cross-Site Scripting

WooCommerce Warranty Requests <= 2.1.9 – Missing Authorization

WooCommerce Ship to Multiple Addresses <= 3.8.5 – Missing Authorization

RealHomes <= 4.0.2 – Missing Authorization

Forminator <= 1.24.1 – Reflected Cross-Site Scripting

Shortcode IMDB <= 6.0.8 – Cross-Site Request Forgery

Authors List <= 2.0.2 – Reflected Cross-Site Scripting via al_id

Grid Kit Premium < 2.2.0 – Reflected Cross-Site Scripting

WPFunnels <= 2.7.16 – Reflected Cross-Site Scripting

Media Library Assistant <= 3.07 – Reflected Cross-Site Scripting

Variation Swatches for WooCommerce <= 2.3.7 – Reflected Cross-Site Scripting

CartFlows Pro <= 1.11.11 – Reflected Cross-Site Scripting

Coming Soon Chop Chop <= 2.2.4 – Reflected Cross-Site Scripting

Variation Images Gallery for WooCommerce <= 2.3.3 – Reflected Cross-Site Scripting via style

Terms Descriptions <= 3.4.4 – Reflected Cross-Site Scripting via term_search

Twittee Text Tweet <= 1.0.8 – Reflected Cross-Site Scripting

All In One WP Security 5.1.9 – Plaintext Storage of Credentials

HTTP Headers <= 1.18.11 – Server-Side Request Forgery

WooCommerce Product Stock Alert <= 2.0.1 – Missing Authorization via API

WPSchoolPress <= 2.2.3 – Missing Authorization

WPFunnels <= 2.7.15 – Insecure Direct Object Reference

KB Support <= 1.5.88 – Missing Authorization to Sensitive Data Exposure

Falang multilanguage <= 1.3.39 – Cross-Site Request Forgery via add_language

Premium Addons PRO <= 2.9.0 – Missing Authorization

WP-FB-AutoConnect <= 4.6.1 – Cross-Site Request Forgery via jfb_admin_page

WooCommerce Product Stock Alert <= 2.0.1 – Information Disclosure

BookingPress <= 1.0.64 – Unauthenticated Sensitive Information Exposure

Premium Addons PRO <= 2.9.0 – Sensitive Information Exposure

WP Default Feature Image <= 1.0.1.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

Dovetail <= 1.2.13 – Authenticated (Administrator+) Stored Cross-Site Scripting

Short URL <= 1.6.4 – Authenticated(Admin+) Stored Cross-Site Scripting

WooCommerce Ship to Multiple Addresses <= 3.8.5 – Reflected Cross-Site Scripting

Custom Field For WP Job Manager <= 1.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

HTTP Headers <= 1.18.11 – Authenticated (Administrator+) Stored Cross-Site Scripting

WooCommerce Pre-Orders <= 2.0.2 – Cross-Site Request Forgery to Order Cancellation

BuddyBuilder – BuddyPress Builder for Elementor <= 1.7.3 – Cross-Site Request Forgery

WP Testimonials <= 1.4.2 – Cross-Site Request Forgery to Widget Deletion

KB Support <= 1.5.88 – Missing Authorization to Authenticated (Subscriber+) User Data Retrieval

Replace Word <= 2.1 – Cross-Site Request Forgery

WPAdmin AWS CDN <= 2.0.13 – Cross-Site Request Forgery

Social Media Icons Widget <= 1.6 – Cross-Site Request Forgery

ARMember <= 4.0.5 – Cross-Site Request Forgery

Exit Popups & Onsite Retargeting by OptiMonk <= 2.0.4 – Cross-Site Request Forgery

Multiple Addify Plugins <= (Various Versions) – Cross-Site Request Forgery

WooCommerce Pre-Orders <= 2.0.2 – Cross-Site Request Forgery

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us using our CVE Request form, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (July 10, 2023 to July 16, 2023) appeared first on Wordfence.