Wordfence Intelligence Weekly WordPress Vulnerability Report (July 10, 2023 to July 16, 2023)

Note: We accidentally sent out an email for this report with last weeks subject line. Due to the subject line not being very different week to week for this report, we opted to just leave it as is and not send a follow-up email. We apologize for this error on our part!

Last week, there were 69 vulnerabilities disclosed in 68 WordPress Plugins and 1 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 29 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface and vulnerability API are completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

---

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

• WAF-RULE-618 – Information redacted while we work with the developer to ensure this gets patched.

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

---

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status	Number of Vulnerabilities
Unpatched	16
Patched	53

---

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating	Number of Vulnerabilities
Low Severity	0
Medium Severity	52
High Severity	17
Critical Severity	0

---

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE	Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)	25
Cross-Site Request Forgery (CSRF)	14
Missing Authorization	14
Server-Side Request Forgery (SSRF)	3
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)	3
Information Exposure	3
Authorization Bypass Through User-Controlled Key	2
Unprotected Storage of Credentials	1
Incorrect Authorization	1
Use of Less Trusted Source	1
URL Redirection to Untrusted Site (‘Open Redirect’)	1
Incorrect Privilege Assignment	1

---

Researchers That Contributed to WordPress Security Last Week

Researcher Name	Number of Vulnerabilities
Rafie Muhammad	8
Mika	6
Lana Codes (Wordfence Vulnerability Researcher)	5
LEE SE HYOUNG	3
Erwan LR	3
Phd	3
Alex Thomas (Wordfence Vulnerability Researcher)	3
Abdi Pranata	3
Yuki Haruma	2
emad	2
Nguyen Xuan Chien	2
Le Hong Minh	2
Dave Jong	2
Andreas Damen	1
yuyudhn	1
Fariq Fadillah Gusti Insani	1
Nithissh S	1
Ullash Raj	1
Emili Castells	1
Rafshanzani Suhada	1
Bob Matyas	1
Ravi Dharmawan	1
Paul Goodchild	1
Skalucy	1
Cat	1
WPScanTeam	1
Kindaichi Hiro	1
Shreya Pohekar	1
Rio Darmawan	1

 

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and obtain a CVE ID through this form. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

---

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name	Software Slug
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup	armember-membership
All-In-One Security (AIOS) – Security and Firewall	all-in-one-wp-security-and-firewall
Art Direction	art-direction
Authors List	authors-list
BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin	bookingpress-appointment-booking
BuddyPress Builder for Elementor – BuddyBuilder	stax-buddy-builder
Buy Me a Coffee – Button and Widget Plugin	buymeacoffee
Checkout with Zelle on Woocommerce	wc-zelle
Coming Soon Chop Chop	cc-coming-soon
Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms	fluentform
Custom Field For WP Job Manager	custom-field-for-wp-job-manager
Custom Fields for WooCommerce	addify-custom-fields-for-woocommerce
Custom Registration Forms Builder for WooCommerce	addify-custom-registration-forms-builder
DirectoryPress – Business Directory And Classified Ad Listing	directorypress
Dovetail	dovetail
Drag & Drop Sales Funnel Builder for WordPress – WPFunnels	wpfunnels
Export and Import Users and Customers	users-customers-import-export-for-wp-woocommerce
Falang multilanguage for WordPress	falang
Forminator – Contact Form, Payment Form & Custom Form Builder	forminator
Grid Kit Premium	grid-kit-premium
HTTP Headers	http-headers
IP2Location Country Blocker	ip2location-country-blocker
Image Watermark for WooCommerce	addify-image-watermark-for-woocommerce
Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files Into Your WordPress Site	integrate-google-drive
Integration for Contact Form 7 and Salesforce	cf7-salesforce
JetFormBuilder — Dynamic Blocks Form Builder	jetformbuilder
KB Support – WordPress Help Desk	kb-support
MF Gig Calendar	mf-gig-calendar
Mail Control – Email Customizer, SMTP Deliverability, logging, open and click Tracking	mail-control
MailArchiver	mailarchiver
Media Library Assistant	media-library-assistant
OptiMonk: Popups, Personalization & A/B Testing	exit-intent-popups-by-optimonk
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress	post-smtp
Premium Addons Pro for Elementor	premium-addons-pro
Price Calculator for WooCommerce	addify-price-calculator-for-woocommerce
Product Dynamic Pricing and Discounts for WooCommerce	addify-product-dynamic-pricing-and-discounts
Radio Forge Muses Player with Skins	radio-forge
Replace Word	replace-word
School Management System – WPSchoolPress	wpschoolpress
Short URL	shorten-url
Shortcode IMDB	shortcode-imdb
Social Media Icons Widget	spoontalk-social-media-icons-widget
Social Share, Social Login and Social Comments Plugin – Super Socializer	super-socializer
Spectra – WordPress Gutenberg Blocks	ultimate-addons-for-gutenberg
Terms descriptions	terms-descriptions
Twittee Text Tweet	twittee-text-tweet
User Activity Log	user-activity-log
Variation Images Gallery for WooCommerce	woo-product-variation-gallery
Variation Swatches for WooCommerce	woo-product-variation-swatches
WP Default Feature Image	wp-default-feature-image
WP Social AutoConnect	wp-fb-autoconnect
WP Testimonials	testimonial-widgets
WPAdmin AWS CDN	aws-cdn-by-wpadmin
WooCommerce Abandoned Cart Recovery	addify-abandoned-cart-recovery
WooCommerce Advanced Free Gifts	addify-free-gifts-woocommerce
WooCommerce Checkout Field Manager	addify-checkout-fields-manager
WooCommerce Custom Order Number	addify-custom-order-number
WooCommerce Gift Registry	addify-gift-registry-for-woocommerce
WooCommerce GoCardless Gateway	woocommerce-gateway-gocardless
WooCommerce Order Approval	addify-order-approval-woocommerce
WooCommerce Order Tracking	addify-order-tracking-for-woocommerce
WooCommerce Pre-Orders	woocommerce-pre-orders
WooCommerce Product Labels and Stickets	addify-product-labels-and-stickers
WooCommerce Product Stock Alert	woocommerce-product-stock-alert
WooCommerce Ship to Multiple Addresses	woocommerce-shipping-multiple-addresses
WooCommerce Warranty Requests	woocommerce-warranty
Zippy	zippy
cartflows-pro	cartflows-pro

---

WordPress Themes with Reported Vulnerabilities Last Week

Software Name	Software Slug
RealHomes	realhomes

---

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities.

JetFormBuilder <= 3.0.8 – Authenticated (Author+) Privilege Escalation

---

Spectra <= 2.6.6 – Authenticated (Contributor+) Server-Side Request Forgery in import_wpforms

---

User Activity Log <= 1.6.2 – Unauthenticated SQL Injection via username

---

Checkout with Zelle on Woocommerce <= 3.1 – Missing Authorization

---

Integrate Google Drive <= 1.1.99 – Missing Authorization via REST API Endpoints

---

Buy Me a Coffee – Button and Widget Plugin <= 3.7 – Missing Authorization

---

RealHomes <= 4.0.2 – Missing Authorization

---

DirectoryPress <= 3.6.2 – Missing Authorization

---

Export and Import Users and Customers <= 2.4.1 – Missing Authorization to Authenticated (Shop Manager) Arbitrary User Password Change

---

User Activity Log <= 1.6.2 – Authenticated (Administrator+) SQL Injection

---

Post SMTP <= 2.5.7 – Unauthenticated Stored Cross-Site Scripting via Email

---

Mail Control <= 0.2.8 – Unauthenticated Stored Cross-Site Scripting via Email Subject

---

FluentForm <= 4.3.25 – Authenticated (Administrator+) SQL Injection

---

Radio Forge Muses Player with Skins <= 2.5 – Reflected Cross-Site Scripting

---

MailArchiver <= 2.10.1 – Unauthenticated Stored Cross-Site Scripting via Email Subject

---

Buy Me a Coffee – Button and Widget Plugin <= 3.7 – Cross-Site Request Forgery

---

Integration for Contact Form 7 and Salesforce <= 1.3.3 – Open Redirect

---

Zippy <= 1.6.2 – Missing Authorization via adminInit

---

Download IP2Location Country Blocker <= 2.29.1 – Bypass via IP Spoofing

---

WooCommerce GoCardless Gateway <= 2.5.6 – Unauthenticated Insecure Direct Object Reference

---

Art Direction <= 0.2.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Super Socializer <= 7.13.53 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

MF Gig Calendar <= 1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via event_title and event_time

---

Spectra <= 2.6.6 – Authenticated (Contributor+) Server-Side Request Forgery in template_importer

---

Buy Me a Coffee – Button and Widget Plugin <= 3.6 – Authenticated (Subscriber+) Stored Cross-Site Scripting

---

WooCommerce Warranty Requests <= 2.1.9 – Missing Authorization

---

WooCommerce Ship to Multiple Addresses <= 3.8.5 – Missing Authorization

---

RealHomes <= 4.0.2 – Missing Authorization

---

Forminator <= 1.24.1 – Reflected Cross-Site Scripting

---

Shortcode IMDB <= 6.0.8 – Cross-Site Request Forgery

---

Authors List <= 2.0.2 – Reflected Cross-Site Scripting via al_id

---

Grid Kit Premium < 2.2.0 – Reflected Cross-Site Scripting

---

WPFunnels <= 2.7.16 – Reflected Cross-Site Scripting

---

Media Library Assistant <= 3.07 – Reflected Cross-Site Scripting

---

Variation Swatches for WooCommerce <= 2.3.7 – Reflected Cross-Site Scripting

---

CartFlows Pro <= 1.11.11 – Reflected Cross-Site Scripting

---

Coming Soon Chop Chop <= 2.2.4 – Reflected Cross-Site Scripting

---

Variation Images Gallery for WooCommerce <= 2.3.3 – Reflected Cross-Site Scripting via style

---

Terms Descriptions <= 3.4.4 – Reflected Cross-Site Scripting via term_search

---

Twittee Text Tweet <= 1.0.8 – Reflected Cross-Site Scripting

---

All In One WP Security 5.1.9 – Plaintext Storage of Credentials

---

HTTP Headers <= 1.18.11 – Server-Side Request Forgery

---

WooCommerce Product Stock Alert <= 2.0.1 – Missing Authorization via API

---

WPSchoolPress <= 2.2.3 – Missing Authorization

---

WPFunnels <= 2.7.15 – Insecure Direct Object Reference

---

KB Support <= 1.5.88 – Missing Authorization to Sensitive Data Exposure

---

Falang multilanguage <= 1.3.39 – Cross-Site Request Forgery via add_language

---

Premium Addons PRO <= 2.9.0 – Missing Authorization

---

WP-FB-AutoConnect <= 4.6.1 – Cross-Site Request Forgery via jfb_admin_page

---

WooCommerce Product Stock Alert <= 2.0.1 – Information Disclosure

---

BookingPress <= 1.0.64 – Unauthenticated Sensitive Information Exposure

---

Premium Addons PRO <= 2.9.0 – Sensitive Information Exposure

---

WP Default Feature Image <= 1.0.1.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Dovetail <= 1.2.13 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Short URL <= 1.6.4 – Authenticated(Admin+) Stored Cross-Site Scripting

---

WooCommerce Ship to Multiple Addresses <= 3.8.5 – Reflected Cross-Site Scripting

---

Custom Field For WP Job Manager <= 1.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

HTTP Headers <= 1.18.11 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

WooCommerce Pre-Orders <= 2.0.2 – Cross-Site Request Forgery to Order Cancellation

---

BuddyBuilder – BuddyPress Builder for Elementor <= 1.7.3 – Cross-Site Request Forgery

---

WP Testimonials <= 1.4.2 – Cross-Site Request Forgery to Widget Deletion

---

KB Support <= 1.5.88 – Missing Authorization to Authenticated (Subscriber+) User Data Retrieval

---

Replace Word <= 2.1 – Cross-Site Request Forgery

---

WPAdmin AWS CDN <= 2.0.13 – Cross-Site Request Forgery

---

Social Media Icons Widget <= 1.6 – Cross-Site Request Forgery

---

ARMember <= 4.0.5 – Cross-Site Request Forgery

---

Exit Popups & Onsite Retargeting by OptiMonk <= 2.0.4 – Cross-Site Request Forgery

---

Multiple Addify Plugins <= (Various Versions) – Cross-Site Request Forgery

---

WooCommerce Pre-Orders <= 2.0.2 – Cross-Site Request Forgery

---

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us using our CVE Request form, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.