Wordfence Intelligence Weekly WordPress Vulnerability Report (September 4, 2023 to September 10, 2023)

Last week, there were 107 vulnerabilities disclosed in 89 WordPress Plugins and 5 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 36 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API and webhook notifications are completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

---

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

• Form Maker by 10Web <= 1.15.19 – Unauthenticated Arbitrary File Upload
• Media Library Assistant <= 3.09 – Unauthenticated Local/Remote File Inclusion & Remote Code Execution

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

---

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status	Number of Vulnerabilities
Unpatched	44
Patched	63

---

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating	Number of Vulnerabilities
Low Severity	2
Medium Severity	89
High Severity	11
Critical Severity	5

---

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE	Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)	35
Cross-Site Request Forgery (CSRF)	31
Missing Authorization	24
Unrestricted Upload of File with Dangerous Type	3
Authorization Bypass Through User-Controlled Key	2
Deserialization of Untrusted Data	2
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)	2
External Control of File Name or Path	1
Improper Input Validation	1
Server-Side Request Forgery (SSRF)	1
Improper Privilege Management	1
Improper Neutralization of Formula Elements in a CSV File	1
Improper Encoding or Escaping of Output	1
Information Exposure	1
Improper Authorization	1

---

Researchers That Contributed to WordPress Security Last Week

Researcher Name	Number of Vulnerabilities
Rio Darmawan	11
Mika	10
Abdi Pranata	10
Rafshanzani Suhada	7
thiennv	5
yuyudhn	4
Rafie Muhammad	4
LEE SE HYOUNG	3
Le Ngoc Anh	3
NGÔ THIÊN AN	3
Nguyen Xuan Chien	3
Marco Wotschka (Wordfence Vulnerability Researcher)	2
Revan Arifio	2
Lana Codes (Wordfence Vulnerability Researcher)	2
Skalucy	2
Elliot	2
FearZzZz	2
qilin_99	2
Pepitoh	1
Shuning Xu	1
deokhunKim	1
DoYeon Park	1
spacecroupier	1
Nguyen Anh Tien	1
Debangshu Kundu	1
Arpeet Rathi	1
Ravi Dharmawan	1
Theodoros Malachias	1
Alexander Concha	1
Pedro José Navas Pérez	1
Alex Sanford	1
emad	1
Emili Castells	1
Pavitra Tiwari	1
Alex Concha	1
László Radnai	1

 

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and obtain a CVE ID through this form. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

---

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name	Software Slug
AcyMailing – Newsletter & mailing automation for WordPress	acymailing
All in One B2B for WooCommerce	all-in-one-b2b-for-woocommerce
Analytify – Google Analytics Dashboard For WordPress (GA4 made easy)	wp-analytify
Auto Amazon Links – Amazon Associates Affiliate Plugin	amazon-auto-links
Automatic YouTube Gallery	automatic-youtube-gallery
Back To The Top Button	back-to-the-top-button
BackupBliss – Backup Migration Staging	backup-backup
BitPay Checkout for WooCommerce	bitpay-checkout-for-woocommerce
Bulk NoIndex & NoFollow Toolkit	bulk-noindex-nofollow-toolkit-by-mad-fish
CP Blocks	cp-blocks
Carousel Slider	carousel-slider
Click To Tweet	click-to-tweet
Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms	fluentform
Cookie Notice & Consent	cookie-notice-consent
Customizable WordPress Gallery Plugin – Modula Image Gallery	modula-best-grid-gallery
Directorist – WordPress Business Directory Plugin with Classified Ads Listings	directorist
Duplicate Post Page Menu & Custom Post Type	duplicate-post-page-menu-custom-post-type
EWWW Image Optimizer	ewww-image-optimizer
Easy Form by AYS	easy-form
Easy WP Cleaner	easy-wp-cleaner
Email posts to subscribers	email-posts-to-subscribers
EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor	embedpress
Export Import Menus	export-import-menus
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder	form-maker
Goods Catalog	goods-catalog
Hide admin notices – Admin Notification Center	wp-admin-notification-center
Insert Estimated Reading Time	insert-estimated-reading-time
Laposta Signup Basic	laposta-signup-basic
Laposta Signup Embed	laposta-signup-embed
Leadster	leadster-marketing-conversacional
Live News	live-news-lite
Locations	locations
MailMunch – Grow your Email List	mailmunch
Media Library Assistant	media-library-assistant
My Account Page Editor	my-account-page-editor
MyCryptoCheckout – Bitcoin, Ethereum, and 100+ altcoins for WooCommerce	mycryptocheckout
Notice Bar	notice-bar
Order Delivery Date for WP e-Commerce	order-delivery-date
Outbound Link Manager	outbound-link-manager
POEditor	poeditor
Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress	wp-user-avatar
PeproDev CF7 Database	pepro-cf7-database
Poll Maker – Best WordPress Poll Plugin	poll-maker
Premium Starter Templates	astra-pro-sites
RSVPMaker	rsvpmaker
Realbig For WordPress	realbig-media
Regpack	regpack
Rescue Shortcodes	rescue-shortcodes
Restrict – membership, site, content and user access restrictions for WordPress	restricted-content
SAML Single Sign On – SSO Login Standard	miniorange-saml-20-single-sign-on
SIS Handball	sis-handball
SendPress Newsletters	sendpress
Simple Download Counter	simple-download-counter
Simple Membership	simple-membership
Slider Pro	sliderpro
Social Share, Social Login and Social Comments Plugin – Super Socializer	super-socializer
Staff / Employee Business Directory for Active Directory	ldap-ad-staff-employee-directory-search
StagTools	stagtools
Starter Templates — Elementor, WordPress & Beaver Builder Templates	astra-sites
Stock Quotes List	stock-quotes-list
Sunshine Photo Cart	sunshine-photo-cart
Swifty Bar, sticky bar by WPGens	swifty-bar
TelSender – Сontact form 7, Events, Wpforms and wooccommerce to telegram bot	telsender
Tilda Publishing	tilda-publishing
Travel Map	travelmap-blog
UniConsent CMP for GDPR CPRA GPP TCF	uniconsent-cmp
Use Memcached	use-memcached
User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds	userfeedback-lite
User Submitted Posts – Enable Users to Submit Posts from the Front End	user-submitted-posts
VS Contact Form	very-simple-contact-form
WP Accessibility Helper (WAH)	wp-accessibility-helper
WP Crowdfunding	wp-crowdfunding
WP Custom Post Template	wp-custom-post-template
WP Directory Kit	wpdirectorykit
WP Gallery Metabox	wp-gallery-metabox
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts	wedevs-project-manager
WP iCal Availability	wp-ical-availability
WP-dTree	wp-dtree-30
WRC Pricing Tables – WordPress Responsive CSS3 Pricing Tables	wrc-pricing-tables
WiserNotify Social Proof & FOMO Notification, WooCommerce Sales Popup, Review Popups, Notification Bars & Urgency Widgets	wiser-notify
WooCommerce PensoPay	woo-pensopay
Woocommerce Support System	wc-support-system
WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds	another-wordpress-classifieds-plugin
WordPress File Sharing Plugin	user-private-files
WordPress Social Login	wordpress-social-login
iFolders – Ultimate Folder Manager for Media, Pages, Posts & etc	ifolders
rtMedia for WordPress, BuddyPress and bbPress	buddypress-media
wordpress publish post email notification	publish-post-email-notification
wpCentral	wp-central

---

WordPress Themes with Reported Vulnerabilities Last Week

Software Name	Software Slug
Attorney	attorney
Flatsome	flatsome
Raise Mag	raise-mag
Wishful Blog	wishful-blog
Woodmart	woodmart

---

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities.

Media Library Assistant <= 3.09 – Unauthenticated Local/Remote File Inclusion & Remote Code Execution

---

RSVPMaker <= 10.6.6 – Unauthenticated PHP Object Injection

---

All in One B2B for WooCommerce <= 1.0.3 – Unauthenticated Privilege Escalation

---

Flatsome <= 3.17.5 – Unauthenticated PHP Object Injection

---

Form Maker by 10Web <= 1.15.19 – Unauthenticated Arbitrary File Upload

---

WP Project Manager <= 2.6.0 – Authenticated (Subscriber+) SQL Injection

---

Export Import Menus <= 1.8.0 – Authenticated (Contributor+) Arbitrary File Upload

---

My Account Page Editor <= 1.3.1 – Authenticated (Subscriber+) Arbitrary File Upload

---

ProfilePress <= 4.13.2 – Limited Privilege Escalation via ‘acceptable_defined_roles’

---

Woocommerce Support System <= 1.2.0 – Missing Authorization

---

Woocommerce Support System <= 1.2.0 – Authenticated (Administrator+) SQL Injection via ‘orderby’

---

Travel Map <= 1.0.1 – Unauthenticated Cross-Site Scripting

---

Click To Tweet <= 2.0.14 – Unauthenticated Cross-Site Scripting

---

PeproDev CF7 Database <= 1.7.0 – Unauthenticated Stored Cross-Site Scripting via form submission

---

Simple Membership <= 4.3.5 – Reflected Cross-Site Scripting

---

User Feedback <= 1.0.7 – Unauthenticated Stored Cross-Site Scripting

---

All in One B2B for WooCommerce <= 1.0.3 – Cross-Site Request Forgery

---

Auto Amazon Links <= 5.3.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via style

---

Goods Catalog <= 2.4.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Rescue Shortcodes <= 2.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Starter Templates <= 3.2.4 – Authenticated (Contributor+) Server-Side Request Forgery

---

Simple Download Counter <= 1.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

User Submitted Posts <= 20230901 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

WordPress Social Login <= 3.0.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20230811 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

Notice Bar <= 3.1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Locations <= 4.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Attorney <= 3 – Reflected Cross-Site Scripting

---

Restrict <= 2.2.4 – Reflected Cross-Site Scripting

---

WooCommerce PensoPay <= 6.3.1 – Reflected Cross-Site Scripting via ‘pensopay_action’

---

WoodMart <= 7.2.4 – Reflected Cross-Site Scripting

---

AcyMailing SMTP Newsletter <= 8.6.2 – Reflected Cross-Site Scripting

---

Stagtools <= 2.3.7 – Reflected Cross-Site Scripting

---

Poll Maker <= 4.7.0 – Reflected Cross-Site Scripting

---

Wishful Blog <= 2.0.1 & Raise Mag <= 1.0.7 – Unauthenticated Cross-Site Scripting

---

Stock Quotes List <= 2.9.9 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Tilda Publishing <= 0.3.21 – Missing Authorization

---

Staff / Employee Business Directory for Active Directory <= 1.2.1 – Insufficient Escaping of Stored LDAP Values

---

Easy WP Cleaner <= 1.9 – Cross-Site Request Forgery

---

Contact Form for Plugin by Fluent Forms <= 5.0.8 – Insecure Direct Object Reference

---

Sunshine Photo Cart <= 3.0.5 – Insecure Direct Object Reference to Order Manipulation

---

TelSender <= 1.14.7 – Missing Authorization

---

WP Directory Kit <= 1.2.6 – Missing Authorization

---

Email posts to subscribers <= 6.2 – Missing Authorization to Sensitive Information Exposure

---

WRC Pricing Tables <= 2.3.7 – Missing Authorization

---

WiserNotify Social Proof <= 2.5 – Missing Authorization

---

EWWW Image Optimizer <= 7.2.0 – Sensitive Information Exposure

---

VS Contact Form <= 13.9 – Missing Authorization

---

BitPay Checkout for WooCommerce <= 4.1.0 – Missing Authorization

---

UniConsent Cookie Consent CMP for GDPR / CCPA <= 1.4.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

WordPress File Sharing Plugin <= 2.0.3 – Authenticated (Admin+) Stored Cross-Site Scripting

---

Insert Estimated Reading Time <= 1.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Cookie Notice & Consent 1.6.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

SendPress Newsletters <= 1.22.3.31 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Swifty Bar, sticky bar by WPGens <= 1.2.10 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

wordpress publish post email notification <= 1.0.2.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

iFolders <= 1.5.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Order Delivery Date for WP e-Commerce <= 1.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Email posts to subscribers <= 6.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Back To The Top Button <= 2.1.5 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Regpack <= 0.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Backup Migration <= 1.2.9 – Cross-Site Request Forgery

---

Automatic YouTube Gallery <= 2.3.3 – Missing Authorization via AJAX actions

---

rtMedia for WordPress, BuddyPress and bbPress <= 4.6.14 – Missing Authorization via export_settings

---

Super Socializer <= 7.13.54 – Missing Authorization

---

Laposta Signup Embed <= 1.1.0 – Missing Authorization

---

CP Blocks <= 1.0.20 – Cross-Site Request Forgery to Settings Update

---

Leadster <= 1.1.2 – Cross-Site Request Forgery

---

EmbedPress <= 3.8.3 – Cross-Site Request Forgery

---

Live News <= 1.06 – Cross-Site Request Forgery

---

WP Gallery Metabox <= 1.0.0 – Cross-Site Request Forgery

---

wpCentral <= 1.5.7 – Cross-Site Request Forgery

---

Laposta Signup Embed <= 1.1.0 – Cross-Site Request Forgery

---

POEditor <= 0.9.4 – Cross-Site Request Forgery

---

Carousel Slider <= 2.2.2 – Missing Authorization

---

SIS Handball <= 1.0.45 – Cross-Site Request Forgery

---

Bulk NoIndex & NoFollow Toolkit <= 1.5 – Missing Authorization

---

rtMedia for WordPress, BuddyPress and bbPress <= 4.6.14 – Missing Authorization to Settings Update

---

WP-dTree <= 4.4.5 – Cross-Site Request Forgery

---

Realbig <= 1.0.2 – Cross-Site Request Forgery

---

Order Delivery Date for WP e-Commerce <= 1.2 – Cross-Site Request Forgery

---

Click To Tweet <= 2.0.14 – Missing Authorization

---

Outbound Link Manager <= 1.2 – Cross-Site Request Forgery

---

Analytify Dashboard <= 5.1.0 – Missing Authorization to Opt-In

---

AWP Classifieds <= 4.3 – Cross-Site Request Forgery

---

Use Memcached <= 1.0.5 – Cross-Site Request Forgery

---

WP Custom Post Template <= 1.0 – Cross-Site Request Forgery

---

Laposta Signup Basic <= 1.4.1 – Missing Authorization

---

WP Accessibility Helper (WAH) <= 0.6.2.4 – Missing Authorization via AJAX action

---

Hide admin notices – Admin Notification Center <= 2.3.2 – Cross-Site Request Forgery

---

WP iCal Availability <= 1.0.3 – Cross-Site Request Forgery

---

Super Socializer <= 7.13.54 – Cross-Site Request Forgery

---

rtMedia for WordPress, BuddyPress and bbPress <= 4.6.14 – Missing Authorization to Sensitive Information Exposure

---

SAML SP Single Sign On <= 5.0.4 – Missing Authorization to notice dismissal

---

WP Crowdfunding <= 2.1.4 – Missing Authorization via settings_reset

---

Laposta Signup Basic <= 1.4.1 – Cross-Site Request Forgery

---

Duplicate Post Page Menu & Custom Post Type <= 2.3.1 – Missing Authorization to Post Duplication

---

ProfilePress <= 4.13.1 Cross-Site Request Forgery via ‘admin_notice’

---

WP Crowdfunding <= 2.1.5 – Cross-Site Request Forgery

---

MyCryptoCheckout <= 2.125 – Cross-Site Request Forgery

---

Starter Templates <= 3.2.5 – Incorrect Authorization

---

Easy Form by AYS <= 1.3.8 – Cross-Site Request Forgery

---

MailMunch – Grow your Email List <= 3.1.2 – Cross-Site Request Forgery

---

Slider Pro <= 4.8.6 – Missing Authorization via AJAX actions

---

SendPress Newsletters <= 1.22.3.31 – Cross-Site Request Forgery

---

Directorist <= 7.7.1 – CSV Injection

---

Modula <= 2.7.4 – Incomplete Authorization via ‘save_image’ and ‘save_images’

---

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us using our CVE Request form, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.