Wordfence Intelligence Weekly WordPress Vulnerability Report (Mar 13, 2023 to Mar 19, 2023)

Last week, there were 92 vulnerabilities disclosed in 76 WordPress Plugins and 7 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 34 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface and vulnerability API are completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

---

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

• UpdraftPlus 1.22.14 to 1.23.2 and UpdraftPlus (Premium) 2.22.14 to 2.23.2 – Privilege Escalation via updraft_central_ajax_handler
• WAF-RULE-565 – Data redacted while we work with the developer to ensure the vulnerability protected by this WAF rule gets patched.

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

---

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status	Number of Vulnerabilities
Unpatched	44
Patched	48

---

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating	Number of Vulnerabilities
Low Severity	0
Medium Severity	80
High Severity	11
Critical Severity	1

---

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE	Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)	37
Cross-Site Request Forgery (CSRF)	34
Missing Authorization	13
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)	3
Information Exposure	3
Server-Side Request Forgery (SSRF)	1
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)	1

---

Researchers That Contributed to WordPress Security Last Week

Researcher Name	Number of Vulnerabilities
Lana Codes	10
Rio Darmawan	7
Dave Jong	6
rezaduty	5
Mika	4
minhtuanact	3
Rafie Muhammad	3
yuyudhn	3
Rafshanzani Suhada	3
Nithissh S	3
Aman Rawat	2
Marco Wotschka	2
Cat	2
TEAM WEBoB of BoB 11th	2
Prasanna V Balaji	2
Daniel Kelley	2
Ayoub Safa	2
Muhammad Daffa	2
FearZzZz	1
Bhuvanesh Jayaprakash	1
Erwan LR	1
Etan Imanol Castro Aldrete	1
Dimas Aprilianto	1
dc11	1
Shreya Pohekar	1
Justiice	1
Nguyen Anh Tien	1
Vinay Kumar	1
Abdi Pranata	1
Brandon James Roldan	1
Pavak Tiwari	1
n0paew	1
Fariq Fadillah Gusti Insani	1
Le Ngoc Anh	1

 

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and obtain a CVE ID through this form. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

---

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name	Software Slug
Admin side data storage for Contact Form 7	admin-side-data-storage-for-contact-form-7
Auto Rename Media On Upload	auto-rename-media-on-upload
Backup Bank: WordPress Backup Plugin	wp-backup-bank
Be POPIA Compliant	be-popia-compliant
Branda – White Label WordPress, Custom Login Page Customizer	branda-white-labeling
Bulk Resize Media	bulk-resize-media
CF7 Invisible reCAPTCHA	cf7-invisible-recaptcha
CMS Press	cms-press
Calendar Event Multi View	cp-multi-view-calendar
Chronoforms	chronoforms
Contact Form 7 Redirect & Thank You Page	cf7-redirect-thank-you-page
Contact Form 7 – PayPal & Stripe Add-on	contact-form-7-paypal-add-on
Contact Form Email	contact-form-to-email
Custom Options Plus	custom-options-plus
Customify – Intuitive Website Styling	customify
Data Tables Generator by Supsystic	data-tables-generator-by-supsystic
Drag and Drop Multiple File Upload PRO – Contact Form 7 Standard	drag-n-drop-upload-cf7-pro
Dynamics 365 Integration	integration-dynamics
Easy Event calendar	easy-event-calendar
Ecwid Ecommerce Shopping Cart	ecwid-shopping-cart
Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files	embed-any-document
Event Manager and Tickets Selling Plugin for WooCommerce	mage-eventpress
Exxp	exxp-wp
Fluid Checkout for WooCommerce – Lite	fluid-checkout
Force First and Last Name as Display Name	force-first-last
Google XML Sitemap for Images	google-image-sitemap
Google XML Sitemap for Videos	xml-sitemaps-for-videos
HT Feed	ht-instagram
Hotel Booking Lite	motopress-hotel-booking-lite
Import External Images	import-external-images
Klaviyo	klaviyo
LOGIN AND REGISTRATION ATTEMPTS LIMIT	login-attempts-limit-wp
Modern Events Calendar Lite	modern-events-calendar-lite
Modern Footnotes	modern-footnotes
Open RDW kenteken voertuiginformatie	open-rdw-kenteken-voertuiginformatie
PB SEO Friendly Images	pb-seo-friendly-images
PhonePe Payment Solutions	phonepe-payment-solutions
Photo Gallery, Images, Slider in Rbs Image Gallery	robo-gallery
Popup Maker – Popup for opt-ins, lead gen, & more	popup-maker
Print Invoice & Delivery Notes for WooCommerce	woocommerce-delivery-notes
RapidLoad Power-Up for Autoptimize	unusedcss
Redirection	redirect-redirection
Return and Warranty Management System for WooCommerce	wc-return-warrranty
Reusable Blocks Extended	reusable-blocks-extended
SEO Plugin by Squirrly SEO	squirrly-seo
SMTP2GO – Email Made Easy	smtp2go
Shopping Cart & eCommerce Store	wp-easycart
Site Reviews	site-reviews
Slide Anything – Responsive Content / HTML Slider and Carousel	slide-anything
Slideshow Gallery LITE	slideshow-gallery
Solidres – Hotel booking plugin for WordPress	solidres
Store Locator for WordPress with Google Maps – LotsOfLocales	store-locator
Surbma | GDPR Proof Cookie Consent & Notice Bar	surbma-gdpr-proof-google-analytics
Tags Cloud Manager	tags-cloud-manager
UpdraftPlus WordPress Backup Plugin	updraftplus
User Role by BestWebSoft – Add and Customize Roles and Capabilities in WordPress	user-role
WH Testimonials	wh-testimonials
WP Basic Elements	wp-basic-elements
WP Express Checkout (Accept PayPal Payments Easily)	wp-express-checkout
WP Job Portal – A Complete Job Board	wp-job-portal
WP Popup Banners	wp-popup-banners
WP Shortcode by MyThemeShop	wp-shortcode
WP Simple Events	wp-simple-events
WSB Brands	wsb-brands
Website Monetization by MageNet	website-monetization-by-magenet
WooCommerce Weight Based Shipping	weight-based-shipping-for-woocommerce
WordPress Console	wordpress-console
WordPress Email Marketing Plugin – WP Email Capture	wp-email-capture
WordPress Mortgage Calculator Estatik	estatik-mortgage-calculator
WordPress Online Booking and Scheduling Plugin – Bookly	bookly-responsive-appointment-booking-tool
WordPress Plugin for Google Maps – WP MAPS	wp-google-map-plugin
WordPress Simple Shopping Cart	wordpress-simple-paypal-shopping-cart
WordPress WP-Advanced-Search	wp-advanced-search
Yandex.News Feed by Teplitsa	yandexnews-feed-by-teplitsa
eCommerce Product Catalog Plugin for WordPress	ecommerce-product-catalog
wpml	wpml

---

WordPress Themes with Reported Vulnerabilities Last Week

Software Name	Software Slug
Brilliance	brilliance
Chankhe	chankhe
Mediciti Lite	mediciti-lite
NewsMag	newsmag
Real Estate Directory	real-estate-directory
Regina Lite	regina-lite
intrepidity	intrepidity

---

Vulnerability Details

Be POPIA Compliant <= 1.2.0 – Unauthenticated SQL Injection

---

Intrepidity <= 1.5.1 – Cross-Site Request Forgery via mytheme_add_admin

---

UpdraftPlus 1.22.14 to 1.23.2 and UpdraftPlus (Premium) 2.22.14 to 2.23.2 – Privilege Escalation via updraft_central_ajax_handler

---

WP Popup Banners <= 1.2.5 – Authenticated (Subscriber+) SQL Injection

---

User Role by BestWebSoft <= 1.6.6 – Cross-Site Request Forgery to Privilege Escalation

---

WordPress Email Marketing Plugin – WP Email Capture <= 3.10 – Missing Authorization to Email Capture List Download

---

Admin side data storage for Contact Form 7 <= 1.1.1 – Unauthenticated Stored Cross-Site Scripting

---

Tags Cloud Manager <= 1.0.0 – Unauthenticated Stored Cross-Site Scripting

---

Shopping Cart & eCommerce Store <= 5.4.2 – Authenticated (Admin+) Local File Inclusion via import_file_url

---

WH Testimonials <= 3.0.0 – Unauthenticated Stored Cross-Site Scripting

---

Bookly <= 21.5 – Unauthenticated Stored Cross-Site Scripting via Name

---

Return and Warranty Management System for WooCommerce <= 1.2.3 – Unauthenticated Stored Cross-Site Scripting

---

Slideshow Gallery LITE <= 1.7.6 – Authenticated(Admin+) SQL Injection

---

Exxp <= 2.6.8 – Authenticated (Subscriber+) Stored Cross-Site Scripting

---

Slide Anything <= 2.4.7 – Authenticated (Author+) Stored Cross-Site Scripting

---

Surbma | GDPR Proof Cookie Consent & Notice Bar <= 17.5.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Robo Gallery <= 3.2.12 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes

---

Ecwid Shopping Cart <= 6.11.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files <= 2.7.1 – Authenticated (Author+) Stored Cross-Site Scripting via SVG files

---

WP Job Portal <= 1.1.9 – Authenticated (Subscriber+) Stored Cross-Site Scripting

---

RapidLoad Power-Up for Autoptimize <= 1.7.1 – Cross-Site Request Forgery

---

SEO Plugin by Squirrly SEO <= 12.1.20 – Missing Authorization

---

Data Tables Generator by Supsystic <= 1.10.25 – Missing Authorization

---

Open RDW kenteken voertuiginformatie <= 2.0.14 – Reflected Cross-Site Scripting via open_data_rdw_kenteken

---

Solidres <= 0.9.4 – Reflected Cross-Site Scripting

---

SEO Plugin by Squirrly SEO <= 12.1.20 – Reflected Cross-Site Scripting via ‘page’ and ‘tab’

---

WordPress Mortgage Calculator Estatik <= 2.0.7 – Reflected Cross-Site Scripting

---

Drag and Drop Multiple File Upload PRO – Contact Form 7 Standard <= 2.11.0 – Reflected Cross-Site Scripting

---

WPML <= 4.6.1 – Cross-Site Scripting

---

Brilliance <= 1.3.1 – Reflected Cross-Site Scripting

---

Mediciti Lite <= 1.3.0 – Reflected Cross-Site Scripting

---

Dynamics 365 Integration <= 1.3.12 – Missing Authorization via wp_ajax_wpcrm_log & wp_ajax_wpcrm_log_verbosity

---

Force First and Last Name as Display Name <= 1.2 – Cross-Site Request Forgery

---

WP Google Map Plugin <= 4.4.2 – Cross-Site Request Forgery via delete()

---

Redirect Redirection <= 1.1.4 – Cross-Site Request Forgery to Plugin De-Installation

---

Regina Lite <= 2.0.7 – Reflected Cross-Site Scripting

---

WooCommerce Weight Based Shipping <= 5.4.1 – Cross-Site Request Forgery leading to Plugin Settings Changes

---

Site Reviews <= 6.5.1 – Missing Authorization

---

Newsmag <= 2.4.4 – Reflected Cross-Site Scripting

---

WordPress Email Marketing Plugin – WP Email Capture <= 3.10 – Information Exposure via wp_email_capture_options_process

---

Popup Maker <= 1.17.1 – Sensitive Data Exposure via debug log file

---

Backup Bank: WordPress Backup Plugin <= 4.0.28 – Missing Authorization via post_user_feedback_backup_bank

---

WP Simple Shopping Cart <= 4.6.3 – Information Disclosure

---

WordPress Console <= 0.3.9 – Missing Authorization via reload.php

---

PhonePe Payment Solutions <= 1.0.15 – Authenticated (Subscriber+) Server-Side Request Forgery

---

Auto Rename Media On Upload <= 1.0.5 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

eCommerce Product Catalog plugin for WordPress <= 3.3.8 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

WP Simple Events <= 1.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Easy Event calendar <= 1.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Yandex.News Feed by Teplitsa <= 1.12.5 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

SMTP2GO <= 1.4.2 – Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings

---

WSB Brands <= 1.1.8 – Authenticated (Administrator+) Stored Cross-Site Scripting via $logo

---

PB SEO Friendly Images <= 4.0.5 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

CMS Press <= 0.2.3 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Modern Footnotes <= 1.4.15 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Solidres <= 0.9.4 – Authenticated (Admin+) Stored Cross-Site Scripting

---

WP Express Checkout <= 2.2.8 – Authenticated (Admin+) Stored Cross-Site Scripting via pec_coupon

---

Branda – White Label WordPress <= 3.4.8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

---

Klaviyo <= 3.0.7 - Authenticated (Administrator+) Stored Cross-Site Scripting

---

Modern Events Calendar lite <= 5.16.2 - Authenticated (Admin+) Stored Cross-Site Scripting

---

Slideshow Gallery LITE <= 1.7.6 - Cross-Site Request Forgery via admin_galleries

---

Google XML Sitemap for Images <= 2.1.3 - Cross-Site Request Forgery via image_sitemap_generate

---

Slideshow Gallery LITE <= 1.7.6 - Cross-Site Request Forgery via admin_slides

---

Real Estate Directory <= 1.0.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation

---

LOGIN AND REGISTRATION ATTEMPTS LIMIT <= 2.1 - Cross-Site Request Forgery

---

Chronoforms <= 7.0.9 - Cross-Site Request Forgery

---

Real Estate Directory <= 1.0.5 - Cross-Site Request Forgery via rdm_activate_plugin

---

CP Multi View Event Calendar <= 1.4.10 - Missing Authentication leading to Authenticated (Subscriber+) Private Form Submission

---

Customify <= 2.10.4 - Cross-Site Request Forgery to Settings Update

---

Fluid Checkout for WooCommerce – Lite <= 2.3.1 - Cross-Site Request Forgery via dismiss_notice

---

Website Monetization by MageNet <= 1.0.29.1 - Cross-Site Request Forgery via admin_magenet_settings

---

Bulk Resize Media <= 1.1 - Cross-Site Request Forgery via bulk_resize_resize_image

---

Import External Images <= 1.4 - Cross-Site Request Forgery via [placeholder]

---

Reusable Blocks Extended <= 0.9 - Cross-Site Request Forgery via reblex_reusable_screen_block_pattern_registration

---

WP Shortcode by MyThemeShop <= 1.4.16 - Cross-Site Request Forgery

---

WP Basic Elements <= 5.2.15 - Cross-Site Request Forgery via wpbe_save_settings

---

Dynamics 365 Integration <= 1.3.12 - Cross-Site Request Forgery via wp_ajax_wpcrm_log

---

Hotel Booking Lite <= 4.6.0 - Cross-Site Request Forgery to Settings Update

---

CF7 Invisible reCAPTCHA <= 1.3.3 - Cross-Site Request Forgery via vsz_cf7_invisible_recaptcha_page

---

HT Feed <= 1.2.7 - Cross-Site Request Forgery leading to Limited Plugin Activation

---

Contact Form Email <= 1.3.31 - Missing Authorization to Feedback Submission

---

Custom Options Plus <= 1.8.1 - Cross-Site Request Forgery via custom_options_plus_adm

---

Store Locator <= 3.98.7 - Cross-Site Request Forgery to Settings Update

---

Dynamics 365 Integration <= 1.3.12 - Cross-Site Request Forgery via wp_ajax_wpcrm_log_verbosity

---

Contact Form 7 Redirect & Thank You Page <= 1.0.3 - Cross-Site Request Forgery via cf7rl_admin_table

---

WP-Advanced-Search <= 3.3.8 - Cross-Site Request Forgery leading to Plugin Settings Updates

---

Event Manager for WooCommerce <= 3.7.7 - Cross-Site Request Forgery leading to Uninstall Form Submission

---

Contact Form 7 – PayPal & Stripe Add-on <= 1.9.3 - Cross-Site Request Forgery

---

WP Basic Elements <= 5.2.15 - Missing Authorization to Plugin Settings Update via wpbe_save_settings

---

Print Invoice & Delivery Notes for WooCommerce <= 4.7.2 - Cross-Site Request Forgery via ts_reset_tracking_setting

---

Chankhe <= 1.0.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation

---

Google XML Sitemap for Videos <= 2.6.1 - Cross-Site Request Forgery via video_sitemap_generate

---

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us using our CVE Request form, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.