Mark Maunder
September 30, 2013

Three new WordPress Plugin Vulnerabilities and what to do about them

  • The Plugin Complete Gallery Manager 3.3.3 contains a remotely exploitable file upload vulnerability. The vendor, Code Canyon recently released a fix. Immediately upgrade to 3.3.4 which contains a fix for this serious vulnerability.
  • A shell upload vulnerability has emerged in an older version of Lazy SEO version 1.1.9. Make sure you’re running the newest version of this plugin which is 1.4.1.
  • An SQL injection vulnerability has emerged in the NoSpamPTI plugin. This plugin is deprecated and is no longer maintained by the developer so we recommend you uninstall it and find an alternative.
As always, please keep your WordPress core, plugins and themes updated to the newest versions.

Regards,

Mark Maunder
Wordfence Founder.

Trust Your Site
to the Leader in WordPress Security

Wordfence includes an endpoint firewall, malware scanner, robust login security features, live traffic views, and more. Discover why over 5 million WordPress sites put their trust in Wordfence.

Protect Your Site

Did you enjoy this post? Share it!

LinkedIn 

Comments

No Comments

Breaking WordPress Security Research in your inbox as it happens.

Example of a news story

This site uses cookies in accordance with our Privacy Policy.