Wordfence Intelligence Weekly WordPress Vulnerability Report (May 29, 2023 to June 4, 2023)

Last week, there were 116 vulnerabilities disclosed in 88 WordPress Plugins and 3 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 35 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface and vulnerability API are completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

---

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

• Jetpack <= 12.1 – Authenticated (Author+) Arbitrary File Manipulation
• Formidable Forms <= 6.3 – Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation
• Wordapp <= 1.5.0 – Authorization Bypass through Use of Insufficiently Unique Cryptographic Signature
• WAF-RULE-603 – data redacted while we work with the developer to ensure the vulnerability this rule protects against gets patched.

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

---

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status	Number of Vulnerabilities
Unpatched	68
Patched	48

---

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating	Number of Vulnerabilities
Low Severity	3
Medium Severity	93
High Severity	16
Critical Severity	4

---

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE	Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)	36
Cross-Site Request Forgery (CSRF)	35
Missing Authorization	22
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)	6
Improper Input Validation	2
Improper Authorization	2
Authorization Bypass Through User-Controlled Key	2
Authentication Bypass Using an Alternate Path or Channel	2
URL Redirection to Untrusted Site (‘Open Redirect’)	1
Improper Privilege Management	1
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)	1
Insufficient Verification of Data Authenticity	1
Server-Side Request Forgery (SSRF)	1
Use of Less Trusted Source	1
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)	1
Deserialization of Untrusted Data	1
Improper Control of Generation of Code (‘Code Injection’)	1

---

Researchers That Contributed to WordPress Security Last Week

Researcher Name	Number of Vulnerabilities
Lana Codes (Wordfence Vulnerability Researcher)	22
Jonas Höbenreich	13
Mika	7
Rafie Muhammad	7
yuyudhn	6
LEE SE HYOUNG	6
thiennv	6
Alex Thomas (Wordfence Vulnerability Researcher)	4
Yuki Haruma	3
Ramuel Gall (Wordfence Vulnerability Researcher)	2
Dave Jong	2
Rafshanzani Suhada	2
Nguyen Xuan Chien	2
Rio Darmawan	2
Dongzhu Li	2
Emili Castells	2
Jerome Bruandet	2
Juampa Rodríguez	1
Le Hong Minh	1
Justiice	1
Skalucy	1
Elliot	1
40826d	1
Francesco Carlucci	1
konagash	1
TomS	1
Hamed	1
Le Ngoc Anh	1
Miguel Neto	1
TaeEun Lee	1
Vinay Kumar	1
Marco Wotschka (Wordfence Vulnerability Researcher)	1
Taihei Shimamine	1
minhtuanact	1
Mateus Machado Tesser	1

 

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and obtain a CVE ID through this form. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

---

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name	Software Slug
Ajax Pagination and Infinite Scroll	malinky-ajax-pagination
B2BKing — Ultimate WooCommerce Wholesale and B2B Solution — Wholesale Order Form, Catalog Mode, Dynamic Pricing & More	b2bking-wholesale-for-woocommerce
BBS e-Popup	bbs-e-popup
Blog-in-Blog	blog-in-blog
Brizy – Page Builder	brizy
CRM Perks Forms – WordPress Form Builder	crm-perks-forms
CRM and Lead Management by vcita	crm-customer-relationship-management-by-vcita
Call Now Accessibility Button	accessibility-help-button
Call Now Icon Animate	call-now-icon-animate
Cart2Cart: Magento to WooCommerce Migration	cart2cart-magento-to-woocommerce-migration
Change WooCommerce Add To Cart Button Text	change-woocommerce-add-to-cart-button-text
Chilexpress woo oficial	chilexpress-oficial
Complianz – GDPR/CCPA Cookie Consent	complianz-gdpr
Conditional shipping & Advanced Flat rate shipping rates / Flexible shipping for WooCommerce shipping	advanced-free-flat-shipping-woocommerce
Constant Contact Forms	constant-contact-forms
Contact Form Builder by vcita	contact-form-with-a-meeting-scheduler-by-vcita
Contact Form and Calls To Action by vcita	lead-capturing-call-to-actions-by-vcita
Custom Login Page | Temporary Users | Rebrand Login | Login Captcha	feather-login-page
Directorist – WordPress Business Directory Plugin with Classified Ads Listings	directorist
Disable WordPress Update Notifications and auto-update Email Notifications	disable-update-notifications
Display post meta, term meta, comment meta, and user meta	display-metadata
Donation Platform for WooCommerce: Fundraising & Donation Management	wc-donation-platform
Download Monitor	download-monitor
Dynamic QR Code Generator	dynamic-qr-code-generator
Dynamic Visibility for Elementor	dynamic-visibility-for-elementor
Event Registration Calendar By vcita	event-registration-calendar-by-vcita
Extended Post Status	extended-post-status
Favorites	favorites
File Manager Advanced Shortcode WordPress	file-manager-advanced-shortcode
Floating Action Button	floating-action-button
Formidable Forms – Contact Form, Survey, Quiz, Calculator & Custom Form Builder	formidable
GDPR Cookie Consent Notice Box	cookie-consent-box
Google Fonts For WordPress	free-google-fonts
Gravityforms	gravityforms
Headless CMS	headless-cms
Interactive Image Map Plugin – Draw Attention	draw-attention
JS Job Manager	js-jobs
Jetpack – WP Security, Backup, Speed, & Growth	jetpack
Kanban Boards for WordPress	kanban
Kebo Twitter Feed	kebo-twitter-feed
LH Password Changer	lh-password-changer
LWS Hide Login	lws-hide-login
Login Configurator	login-configurator
Nested Pages	wp-nested-pages
Online Booking & Scheduling Calendar for WordPress by vcita	meeting-scheduler-by-vcita
Online Payments – Get Paid with PayPal, Square & Stripe	paypal-payment-button-by-vcita
Page Builder with Image Map by AZEXO	page-builder-by-azexo
Photo Gallery by 10Web – Mobile-Friendly Image Gallery	photo-gallery
Quick/Bulk Order Form for WooCommerce	woocommerce-bulk-order-form
ReviewX – Multi-criteria Rating & Reviews for WooCommerce	reviewx
Social Media Share Buttons & Social Sharing Icons	ultimate-social-media-icons
Social Share, Social Login and Social Comments Plugin – Super Socializer	super-socializer
SpamReferrerBlock	spamreferrerblock
TPG Redirect	tpg-redirect
TS Webfonts for さくらのレンタルサーバ	ts-webfonts-for-sakura
Telegram Bot & Channel	telegram-bot
Tutor LMS – eLearning and online course solution	tutor
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin	ultimate-member
Uncanny Toolkit for LearnDash	uncanny-learndash-toolkit
Unite Gallery Lite	unite-gallery-lite
User Email Verification for WooCommerce	woo-confirmation-email
VK Blocks	vk-blocks
WOLF – WordPress Posts Bulk Editor and Manager Professional	bulk-editor
WP Directory Kit	wpdirectorykit
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting	erp
WP Full Auto Tags Manager	wp-full-auto-tags-manager
WP Hide Post	wp-hide-post
WP Inventory Manager	wp-inventory-manager
WP Report Post	wp-report-post
WP User Switch	wp-user-switch
WP-Cache.com	wp-cachecom
WP-Cirrus	wp-cirrus
WPC Smart Wishlist for WooCommerce	woo-smart-wishlist
Web Directory Free	web-directory-free
WooCommerce Box Office	woocommerce-box-office
WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce	cartflows
Woocommerce Order address Print	woocommerce-order-address-print
WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg	groundhogg
WordPress NextGen GalleryView	wordpress-nextgen-galleryview
WordPress Online Booking and Scheduling Plugin – Bookly	bookly-responsive-appointment-booking-tool
WordPress Social Login	wordpress-social-login
Wordapp	wordapp
Worthy – VG WORT Integration für WordPress	wp-worthy
Yandex Metrica Counter	counter-yandex-metrica
bbPress Toolkit	bbp-toolkit
bbp style pack	bbp-style-pack
premium-addons-pro	premium-addons-pro
wpForo Forum	wpforo

---

WordPress Themes with Reported Vulnerabilities Last Week

Software Name	Software Slug
HashOne	hashone
Viral	viral
Viral News	viral-news

---

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities.

Wordapp <= 1.5.0 – Authorization Bypass through Use of Insufficiently Unique Cryptographic Signature

---

Tutor LMS <= 2.1.10 – Unauthenticated SQL Injection

---

Gravity Forms <= 2.7.3 – Unauthenticated PHP Object Injection

---

File Manager Advanced Shortcode WordPress <= 2.3.2 – Unauthenticated Arbitrary File Upload to Remote Code Execution via Shortcode

---

Directorist <= 7.5.4 – Authenticated (Subscriber+) Arbitrary User Password Reset to Privilege Escalation

---

Feather Login Page 1.0.7 – 1.1.1 – Cross-Site Request Forgery to Privilege Escalation

---

Tutor LMS <= 2.2.0 – Authenticated (Student+) SQL Injection

---

ReviewX <= 1.6.13 – Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation

---

Tutor LMS <= 2.1.10 – Authenticated (Tutor Instructor+) SQL Injection

---

wpForo Forum <= 2.1.7 – Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents

---

Web Directory Free <= 1.6.7 – Authenticated (Contributor+) SQL Injection via post_id

---

WP User Switch <= 1.0.2 – Authenticated (Subscriber+) Authentication Bypass via Cookie

---

Feather Login Page 1.0.7 – 1.1.1 – Missing Authorization to Authentication Bypass and Privilege Escalation

---

User Email Verification for WooCommerce <= 3.5.0 – Authentication Bypass

---

bbPress Toolkit <= 1.0.12 – Cross-Site Scripting

---

Online Booking & Scheduling Calendar for WordPress by vcita <= 4.2.10 – Unauthenticated Stored Cross-Site Scripting

---

WP Report Post <= 2.1.2 – Authenticated (Editor+) SQL Injection

---

Groundhogg <= 2.7.10.3 – Authenticated (Administrator+) SQL Injection

---

Blog-in-Blog <= 1.1.1 – Authenticated (Editor+) Local File Inclusion via Shortcode

---

Cart2Cart: Magento to WooCommerce Migration <= 2.0.0 – Missing Authorization via setToken

---

Headless CMS <= 2.0.3 – Missing Authorization

---

Jetpack <= 12.1 – Authenticated (Author+) Arbitrary File Manipulation

---

B2BKing <= 4.6.00 – Missing Authorization to Authenticated(Subscriber+) Price Modification

---

Directorist <= 7.5.4 – Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion in listing_task

---

Uncanny Toolkit for LearnDash <= 3.6.4.3 – Missing Authorization via review-banner-visibility REST route

---

Formidable Forms <= 6.3 – Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation

---

Contact Form Builder by vcita <= 4.9.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Event Registration Calendar By vcita <= 1.3.1 & Online Payments – Get Paid with PayPal, Square & Stripe <= 3.9.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Page Builder by AZEXO <= 1.27.133 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

WooCommerce Box Office <= 1.1.50 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Contact Form and Calls To Action by vcita <= 2.6.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Favorites <= 2.3.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

Display post meta, term meta, comment meta, and user meta <= 0.4.1 – Authenticated(Contributor+) Stored Cross-Site Scripting

---

CRM and Lead Management by vcita <= 2.6.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Page Builder by AZEXO <= 1.27.133 – Cross-Site Request Forgery to Post Creation/Modification/Deletion

---

Chilexpress woo oficial <= 1.2.9 – Reflected Cross-Site Scripting

---

CRM and Lead Management by vcita <= 2.6.2 – Cross-Site Request Forgery to Stored Cross-Site Scripting

---

Event Registration Calendar By vcita <= 1.3.1 & Online Payments – Get Paid with PayPal, Square & Stripe <= 3.9.1 – Cross-Site Request Forgery to Stored Cross-Site Scripting

---

Contact Form and Calls To Action by vcita <= 2.6.4 – Cross-Site Request Forgery to Stored Cross-Site Scripting

---

Woocommerce Order address Print <= 3.2 – Reflected Cross-Site Scripting

---

Page Builder by AZEXO <= 1.27.133 – Cross-Site Request Forgery to Stored Cross-Site Scripting via azh_save

---

bbp style pack <= 5.5.5 – Reflected Cross-Site Scripting

---

Contact Form Builder by vcita <= 4.9.1 – Cross-Site Request Forgery to Stored Cross-Site Scripting

---

Social Share, Social Login and Social Comments <= 7.13.51 – Reflected Cross-Site Scripting

---

Dynamic QR Code Generator <= 0.0.5 – Reflected Cross-Site Scripting

---

WP Directory Kit <= 1.2.3 – Reflected Cross-Site Scripting via ‘search’

---

BBS e-Popup <= 2.4.5 – Reflected Cross-Site Scripting

---

Premium Addons PRO <= 2.8.24 – Reflected Cross-Site Scripting

---

Google Fonts For WordPress <= 3.0.0 – Reflected Cross-Site Scripting

---

Login Configurator <= 2.1 – Reflected Cross-Site Scripting

---

WP ERP <= 1.12.3 – Reflected Cross-Site Scripting

---

Blog-in-Blog <= 1.1.1 – Authenticated (Editor+) Stored Cross-Site Scripting via Shortcode

---

Quick/Bulk Order Form for WooCommerce <= 3.5.7 – Authenticated (Shop manager+) Stored Cross-Site Scripting

---

Download Monitor <= 4.8.1 – Authenticated (Admin+) Server-Side Request Forgery

---

JS Job Manager <= 2.0.0 – Cross-Site Request Forgery via multiple functions

---

Groundhogg <= 2.7.10.3 – Cross-Site Request Forgery

---

Online Booking & Scheduling Calendar for WordPress by vcita <= 4.2.10 – Missing Authorization to Settings Update and Media Upload

---

Dynamic Visibility for Elementor <= 5.0.5 – Missing Authorization to Authenticated(Subscriber+) Post Visibility Modification

---

Feather Login Page 1.0.7 – 1.1.1 – Missing Authorization to Non-Arbitrary User Deletion

---

Online Booking & Scheduling Calendar for WordPress by vcita <= 4.2.10 – Missing Authorization to Account Logout

---

Worthy – VG WORT Integration für WordPress <= 1.6.5-6497609 – Cross-Site Request Forgery

---

Extended Post Status <= 1.0.19 – Missing Authorization via wp_insert_post_data

---

Change WooCommerce Add To Cart Button Text <= 1.3 – Missing Authorization via rexvs_settings_submit

---

Page Builder by AZEXO <= 1.27.133 – Missing Authorization to Post Creation

---

WordPress Social Login <= 3.0.4 – Reflected Cross-Site Scripting

---

Online Booking & Scheduling Calendar for WordPress by vcita <= 4.2.10 – Cross-Site Request Forgery to Account Logout

---

Online Booking & Scheduling Calendar for WordPress by vcita <= 4.2.10 – Missing Authorization on REST-API

---

WooCommerce Box Office <= 1.1.51 – Missing Authorization

---

Call Now Accessibility Button <= 1.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Yandex Metrica Counter <= 1.4.3 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Unite Gallery Lite <= 1.7.60 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Download SpamReferrerBlock <= 2.22 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Telegram Bot & Channel <= 3.6.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Kanban Boards for WordPress <= 2.5.20 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Call Now Icon Animate <= 0.1.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

WordPress Social Login <= 3.0.4 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Bulk Order Form for WooCommerce <= 3.5.7 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

CRM Perks Forms <= 1.1.1 – Authenticated (Admin+) Stored Cross-Site Scripting

---

GDPR Cookie Consent Notice Box <= 1.1.6 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

TS Webfonts for さくらのレンタルサーバ <= 3.1.0 – Cross-Site Request Forgery

---

NextGen GalleryView <= 0.5.5 – Cross-Site Request Forgery

---

WP Report Post <= 2.1.2 – Cross-Site Request Forgery

---

Ajax Pagination and Infinite Scroll <= 2.0.1 – Cross-Site Request Forgery

---

VK Blocks <= 1.57.0.5 – Authenticated(Contributor+) Settings Update

---

Floating Action Button <= <=1.2.1 – Cross-Site Request Forgery

---

Photo Gallery <= 1.8.15 – Missing Authorization

---

Multiple Themes (Various Versions) – Missing Authorization to Arbitrary Plugin Activation

---

Draw Attention <= 2.0.11 – Missing Authorization to Arbitrary Post Featured Image Modification

---

LH Password Changer <= 1.55 – Cross-Site Request Forgery

---

Social Media & Share Icons <= 2.8.1 – Missing Authorization via handle_installation

---

Advanced Flat rate shipping Woocommerce <= 1.6.4.4 – Cross-Site Request Forgery via enableDisable and deletePost

---

Donation Platform for WooCommerce: Fundraising & Donation Management <= 1.2.9 – Cross-Site Request Forgery to Survey Submission

---

WP Hide Post <= 2.0.10 – Cross-Site Request Forgery via save_bulk_edit_data

---

WP Full Auto Tags Manager <= 2.2 – Cross-Site Request Forgery

---

WPC Smart Wishlist for WooCommerce <= 4.6.7 – Cross-Site Request Forgery via wishlist_add and wishlist_remove

---

Disable WordPress Update Notifications <= 2.3.3 – Cross-Site Request Forgery

---

Uncanny Toolkit for LearnDash <= 3.6.4.3 – Open Redirect

---

WP-Cirrus <= 0.6.11 – Cross-Site Request Forgery

---

LWS Hide Login <= 2.1.5 – Cross-Site Request Forgery

---

Constant Contact Forms <= 1.14.0 – Missing Authorization via constant_contact_optin_ajax_handler

---

bbPress Toolkit <= 1.0.12 – Cross-Site Request Forgery

---

WP Inventory Manager <= 2.1.0.13 – Cross-Site Request Forgery via delete_item

---

Ultimate Member <= 2.6.0 – Cross-Site Request Forgery to Form Duplication

---

WOLF <= 1.0.7 – Cross-Site Request Forgery via create_profile

---

Complianz | GDPR/CCPA Cookie Consent <= 6.4.5 – Cross-Site Request Forgery

---

VK Blocks <= 1.57.0.5 – Authenticated(Contributor+) Settings Update

---

B2BKing <= 4.6.00 – Missing Authorization to Authenticated(Subscriber+) Information Disclosure

---

Multiple Themes (Various Versions) – Cross-Site Request Forgery to Arbitrary Plugin Activation

---

Kebo Twitter Feed <= 1.5.12 – Cross-Site Request Forgery via kebo_twitter_menu_render

---

SpamReferrerBlock <= 2.22 – Cross-Site Request Forgery

---

TPG Redirect <= 1.0.6 – Cross-Site Request Forgery

---

WP-Cache.com <= 1.1.1 – Cross-Site Request Forgery

---

Bookly <= 21.7 – Authenticated (Admin+) Stored Cross-Site Scripting

---

Nested Pages <= 3.2.3 – Missing Authorization to Authenticated (Editor+) Plugin Settings Reset

---

Brizy Page Builder <= 2.4.18 – IP Address Spoofing to Protection Mechanism Bypass

---

CartFlows <= 1.11.11 – Insecure Direct Object Reference to Arbitrary Post Deletion

---

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us using our CVE Request form, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.