Wordfence Intelligence Weekly WordPress Vulnerability Report (Apr 3, 2023 to Apr 9, 2023)

Last week, there were 97 vulnerabilities disclosed in 63 WordPress Plugins and 5 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 28 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface and vulnerability API are completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

---

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

• Front End Users <= 3.2.24 – Missing Authorization in Multiple Functions
• ACF Quick Edit Fields <= 3.2.2 – Authenticated (Contributor+) Insecure Direct Object Reference
• WP Data Access <= 5.3.7 – Authenticated (Subscriber+) Privilege Escalation
• Advanced Custom Fields <= 6.0.7 – Authenticated (Contributor+) PHP Object Injection
• HappyFiles Pro <= 1.8.1 – Missing Authorization
• WP Fastest Cache <= 1.1.2 – Missing Authorization
• Formidable Forms <= 6.1.2 – Unauthenticated PHP Object Injection
• WAF-RULE-579 – Data redacted while we work with the developer to ensure the vulnerability protected by this WAF rule gets patched.
• WAF-RULE-576 – Data redacted while we work with the developer to ensure the vulnerability protected by this WAF rule gets patched.
• WAF-RULE-577 – Data redacted while we work with the developer to ensure the vulnerability protected by this WAF rule gets patched.

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

---

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status	Number of Vulnerabilities
Unpatched	25
Patched	72

---

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating	Number of Vulnerabilities
Low Severity	0
Medium Severity	79
High Severity	14
Critical Severity	4

---

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE	Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)	37
Cross-Site Request Forgery (CSRF)	29
Missing Authorization	17
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)	6
Deserialization of Untrusted Data	3
Improper Authorization	2
Incorrect Privilege Assignment	1
Unrestricted Upload of File with Dangerous Type	1
Authorization Bypass Through User-Controlled Key	1

---

Researchers That Contributed to WordPress Security Last Week

Researcher Name	Number of Vulnerabilities
Marco Wotschka	24
Chloe Chamberland	8
Mika	7
minhtuanact	5
Lana Codes	5
yuyudhn	3
Ramuel Gall	3
MyungJu Kim	3
Rafshanzani Suhada	3
Erwan LR	3
Ameen Alkurdy	2
Rafie Muhammad	2
Simone Onofri	2
Donato Onofri	2
Rio Darmawan	2
Shreya Pohekar	2
FearZzZz	2
Nguyen Huu Do	2
Abdi Pranata	2
Elliot	1
jidle	1
xplo1t	1
Taliya Bilal	1
Dave Jong	1
Pablo Sanchez	1
Romés Akhan	1
Yogesh Verma	1
abdi paranata	1

 

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and obtain a CVE ID through this form. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

---

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name	Software Slug
Advanced Custom Fields (ACF)	advanced-custom-fields
Ajax Search Lite	ajax-search-lite
Ajax Search Pro	ajax-search-pro
Albo Pretorio On line	albo-pretorio-on-line
Appointment and Event Booking Calendar for WordPress – Amelia	ameliabooking
Call Now Accessibility Button	accessibility-help-button
Cancel order request / Return order / Repeat Order / Reorder for WooCommerce	cancel-order-request-woocommerce
Comment Reply Notification	comment-reply-notification
Comments Ratings	comments-ratings
Connections Business Directory	connections
CopySafe Web Protection	wp-copysafe-web
Cryptocurrency All-in-One	cryptocurrency-prices
Dynamics 365 Integration	integration-dynamics
Easy Sign Up	easy-sign-up
Email Subscription Popup	email-subscribe
Fancy Product Designer	fancy-product-designer
Formidable Forms – Contact Form, Survey, Quiz, Calculator & Custom Form Builder	formidable
Front End Users	front-end-only-users
HT Builder – WordPress Theme Builder for Elementor	ht-builder
Hustle – Email Marketing, Lead Generation, Optins, Popups	wordpress-popup
IFrame Shortcode	flynsarmy-iframe-shortcode
IMPress Listings	wp-listings
Libsyn Publisher Hub	libsyn-podcasting
Limit Login Attempts	limit-login-attempts
Magic Post Thumbnail	magic-post-thumbnail
MapPress Maps for WordPress	mappress-google-maps-for-wordpress
Maps Widget for Google Maps	google-maps-widget
MasterStudy LMS WordPress Plugin – for Online Courses and Education	masterstudy-lms-learning-management-system
MyCryptoCheckout – Bitcoin, Ethereum, and 175+ altcoins for WooCommerce	mycryptocheckout
Optin Forms – Simple List Building Plugin for WordPress	optin-forms
PHP Compatibility Checker	php-compatibility-checker
PixTypes	pixtypes
Product Catalog Simple	post-type-x
Product Enquiry for WooCommerce, WooCommerce product catalog	enquiry-quotation-for-woocommerce
Product Feed PRO for WooCommerce	woo-product-feed-pro
Product page shipping calculator for WooCommerce	product-page-shipping-calculator-for-woocommerce
PropertyHive	propertyhive
Random Text	randomtext
SEOPress – On-site SEO	wp-seopress
SMTP Mailing Queue	smtp-mailing-queue
Simple Job Board	simple-job-board
SimpleModal Contact Form (SMCF)	simplemodal-contact-form-smcf
Site Reviews	site-reviews
Sp*tify Play Button for WordPress	spotify-play-button-for-wordpress
Spreadshop Plugin	spreadshop
StagTools	stagtools
Steveas WP Live Chat Shoutbox	wp-shoutbox-live-chat
Superb Social Media Share Buttons and Follow Buttons for WordPress	superb-social-share-and-follow-buttons
Tiny carousel horizontal slider plus	tiny-carousel-horizontal-slider-plus
Transbank Webpay REST	transbank-webpay-plus-rest
User Registration – Custom Registration Form, Login Form And User Profile For WordPress	user-registration
WCFM Marketplace – Best Multivendor Marketplace for WooCommerce	wc-multivendor-marketplace
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace	wc-multivendor-membership
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible	wc-frontend-manager
WP Data Access	wp-data-access
WP FEvents Book	wp-fevents-book
WP Fastest Cache	wp-fastest-cache
WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager	insert-headers-and-footers
YourChannel: Everything you want in a YouTube plugin.	yourchannel
ZYREX POPUP	popup-zyrex
amr ical events lists	amr-ical-events-list
qTranslate X Cleanup and WPML Import	qtranslate-to-wpml-export
tencentcloud-cos	tencentcloud-cos

---

WordPress Themes with Reported Vulnerabilities Last Week

Software Name	Software Slug
Houzez	houzez
The7 — Website and eCommerce Builder for WordPress	dt-the7
TheRoof	theroof
Weaver Xtreme	weaver-xtreme
outdoor	outdoor

---

Vulnerability Details

WCFM Membership <= 2.10.0 – Unauthenticated Privilege Escalation

---

Houzez <= 2.8.2 – Unauthenticated SQL Injection

---

Formidable Forms <= 6.1.2 – Unauthenticated PHP Object Injection

---

Steveas WP Live Chat Shoutbox <= 1.4.2 – Unauthenticated SQL Injection

---

WCFM Marketplace <= 3.4.11 – Missing Authorization

---

MapPress Maps for WordPress <= 2.85.4 – Authenticated (Contributor+) SQL Injection via get_maps

---

Advanced Custom Fields <= 6.0.7 – Authenticated (Contributor+) PHP Object Injection

---

Fancy Product Designer <= 4.6.9 – Insufficient Authorization to Arbitrary Options Update via fpd_update_options

---

WP Data Access <= 5.3.7 – Authenticated (Subscriber+) Privilege Escalation

---

WCFM Membership <= 2.10.0 – Missing Authorization

---

CopySafe Web Protection <= 3.13 – Unauthenticated Stored Cross-Site Scripting

---

Magic Post Thumbnail <= 4.1.10 – Unauthenticated Stored Cross-Site Scripting

---

Steveas WP Live Chat Shoutbox <= 1.4.2 – Unauthenticated Stored Cross-Site Scripting

---

Transbank Webpay REST <= 1.6.6 – Authenticated (Administrator+) SQL Injection via orderby

---

Albo Pretorio Online <= 4.6.1 – Unauthenticated Stored Cross-Site Scripting

---

Limit Login Attempts <= 1.7.1 – Unauthenticated Stored Cross-Site Scripting

---

Zyrex Popup <= 1.1 – Authenticated (Admin+) Arbitrary File Upload

---

Ajax Search Lite <= 4.11 – Reflected Cross-Site Scripting

---

SEOPress <= 6.5.0.2 – Authenticated (Administrator+) PHP Object Injection

---

Amr Ical Events Lists <= 6.6 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

YourChannel <= 1.2.3 – Missing Authorization to Plugin Settings Reset

---

YourChannel <= 1.2.3 – Missing Authorization to Plugin Cache Reset

---

Front End Users <= 3.2.24 – Missing Authorization to Unauthenticated Registered User Deletion

---

WP FEvents Book <= 0.46 – Authenticated (Subscriber+) Stored Cross-Site Scripting

---

IFrame Shortcode <= 1.0.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

Stagtools <= 2.3.6 – Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode

---

Weaver Xtreme Theme <= 5.0.7 – Authenticated(Contributor+) Stored Cross-Site Scripting via Display Name

---

Cryptocurrency All-in-One <= 3.0.19 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Easy Sign Up <= 3.4.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

WCFM Membership <= 2.10.0 – Cross-Site Request Forgery

---

WCFM Marketplace <= 3.4.12 – Cross-Site Request Forgery

---

Fancy Product Designer <= 4.6.9 – Insufficient Authorization on Mulitple AJAX Actions

---

WCFM Frontend Manager <= 6.5.13 – Cross-Site Request Forgery

---

WCFM Frontend Manager <= 6.6.0 – Missing Authorization

---

WP FEvents Book <= 0.46 – Authenticated (Subscriber+) Insecure Direct Object Reference to Booking Manipulation

---

The7 <= 11.6.0 – Reflected Cross-Site Scripting

---

TheRoof <= 1.0.3 – Reflected Cross-Site Scripting

---

Product Catalog Simple <= 1.6.17 – Reflected Cross-Site Scripting

---

MyCryptoCheckout <= 2.123 – Reflected Cross-Site Scripting via url

---

Amelia <= 1.0.75 – Unauthenticated Reflected Cross-Site Scripting via ‘code’

---

PropertyHive <= 1.5.46 – Reflected Cross-Site Scripting via ‘merge_ids’

---

Ajax Search Pro <= 4.26.1 – Reflected Cross-Site Scripting

---

Outdoor <= 3.9.6 – Reflected Cross-Site Scripting

---

YourChannel <= 1.2.3 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

YourChannel <= 1.2.3 – Cross-Site Request Forgery to Plugin Channel Reset

---

YourChannel <= 1.2.3 – Cross-Site Request Forgery to Plugin Settings Change

---

Random Text <= 0.3.0 – Authenticated (Subscriber+) SQL Injection

---

Connections Business Directory <= 10.4.36 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

IMPress Listings <= 2.6.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Listing Fields

---

YourChannel <= 1.2.3 – Cross-Site Request Forgery to Plugin Language Translation Reset

---

User Registration <= 2.3.2.1 – Missing Authorization via send_test_email

---

Libsyn Publisher Hub <= 1.3.2 – Sensitive Information Exposure

---

Email Subscription Popup <= 1.2.16 – Reflected Cross-Site Scripting

---

WPCode <= 2.0.8 – Cross-Site Request Forgery

---

Tiny carousel horizontal slider plus <= 3.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

SMTP Mailing Queue <= 1.4.7 – Authenticated (Admin+) Stored Cross-Site Scripting

---

Sp*tify Play Button for WordPress <= 2.07 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Optin Forms <= 1.3.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Call Now Accessibility Button <= 1.1 – Authenticated (Administrator+) Cross-Site Scripting

---

Site Reviews <= 6.7.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Cancel order request WooCommerce <= 1.3.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Product Enquiry for WooCommerce <= 2.2.12 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

SimpleModal Contact Form (SMCF) <= 1.2.9 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Maps Widget for Google Maps <= 4.24 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Hustle <= 7.6.4 = Authenticated (Administrator+) Stored Cross-Site Scripting

---

Product page shipping calculator for WooCommerce <= 1.3.20 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Dynamics 365 Integration <= 1.3.13 – Missing Authorization via init

---

WP Fastest Cache <= 1.1.2 – Cross-Site Request Forgery via ‘wpfc_preload_single_save_settings_callback’

---

WP Fastest Cache <= 1.1.2 – Cross-Site Request Forgery via ‘wpfc_clear_cache_of_allsites_callback’

---

WP Fastest Cache <= 1.1.2 – Cross-Site Request Forgery via ‘wpfc_start_cdn_integration_ajax_request_callback’

---

WP Fastest Cache <= 1.1.2 – Cross-Site Request Forgery via ‘wpfc_preload_single_callback’

---

MasterStudy LMS WordPress Plugin <= 2.9.34 – Missing Authorization via wp_ajax_stm_wpcfto_get_settings

---

WP Fastest Cache <= 1.1.2 – Missing Authorization in ‘wpfc_purgecache_varnish_callback’

---

Comment Reply Notification <= 1.4 – Cross-Site Request Forgery

---

PixTypes <= 1.4.14 – Cross-Site Request Forgery

---

Comments Ratings <= 1.1.6 – Cross-Site Request Forgery

---

PHP Compatibility Checker <= 1.5.2 – Cross-Site Request Forgery

---

qTranslate X Cleanup and WPML Import <= 3.0.1 – Cross-Site Request Forgery via clean_ajx

---

WP Fastest Cache <= 1.1.2 – Cross-Site Request Forgery via ‘wpfc_remove_cdn_integration_ajax_request_callback’

---

WP Fastest Cache <= 1.1.2 – Cross-Site Request Forgery via ‘deleteCssAndJsCacheToolbar’

---

WP Fastest Cache <= 1.1.2 – Missing Authorization in ‘wpfc_preload_single_callback’

---

Spreadshop Plugin <= 1.6.5 – Cross-Site Request Forgery

---

tencentcloud-cos <= 1.0.7 – Missing Authorization via AJAX actions

---

Simple Job Board <= 2.10.3 – Cross-Site Request Forgery via sjb_save_settings_section

---

WP Fastest Cache <= 1.1.2 – Cross-Site Request Forgery via ‘wpfc_pause_cdn_integration_ajax_request_callback’

---

WP Fastest Cache <= 1.1.2 – Cross-Site Request Forgery via ‘wpfc_toolbar_save_settings_callback’

---

WP Fastest Cache <= 1.1.2 – Missing Authorization in ‘deleteCssAndJsCacheToolbar’

---

WP Fastest Cache <= 1.1.2 – Cross-Site Request Forgery via ‘deleteCacheToolbar’

---

WP Fastest Cache <= 1.1.2 – Missing Authorization in ‘wpfc_clear_cache_of_allsites_callback’

---

qTranslate X Cleanup and WPML Import <= 3.0.1 – Missing Authorization via clean_ajx

---

YourChannel <= 1.2.3 – Cross-Site Request Forgery to Plugin Language Translation Update

---

Product Feed PRO for WooCommerce <= 12.4.4 – Cross-Site Request Forgery

---

WP Fastest Cache <= 1.1.2 – Cross-Site Request Forgery via ‘wpfc_purgecache_varnish_callback’

---

Superb Social Media Share Buttons and Follow Buttons <= 1.1.3 – Missing Authorization via spbsmAjax

---

HT Builder <= 1.2.9 – Cross-Site Request Forgery via plugin_activation

---

Superb Social Media Share Buttons and Follow Buttons <= 1.1.3 – Cross-Site Request Forgery via spbsmAjax

---

Front End Users <= 3.2.24 – Cross-Site Request Forgery

---

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us using our CVE Request form, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.