Wordfence Intelligence Weekly WordPress Vulnerability Report (June 26, 2023 to July 2, 2023)

Last week, there were 66 vulnerabilities disclosed in 56 WordPress Plugins and 1 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 34 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface and vulnerability API are completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

---

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

• Ultimate Member <= 2.6.6 – Privilege Escalation via Arbitrary User Meta Updates
• WP Post Author <= 3.3.0 – Privilege Escalation

 

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

---

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status	Number of Vulnerabilities
Unpatched	26
Patched	40

---

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating	Number of Vulnerabilities
Low Severity	0
Medium Severity	52
High Severity	9
Critical Severity	5

---

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE	Number of Vulnerabilities
Cross-Site Request Forgery (CSRF)	22
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)	17
Missing Authorization	8
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)	4
Authorization Bypass Through User-Controlled Key	3
Authentication Bypass Using an Alternate Path or Channel	2
Information Exposure	2
Server-Side Request Forgery (SSRF)	2
Improper Neutralization of Formula Elements in a CSV File	2
Improper Privilege Management	1
Incorrect Privilege Assignment	1
Use of Hard-coded Cryptographic Key	1
Improper Neutralization of Special Elements used in an LDAP Query (‘LDAP Injection’)	1

---

Researchers That Contributed to WordPress Security Last Week

Researcher Name	Number of Vulnerabilities
Lana Codes (Wordfence Vulnerability Researcher)	6
Cat	5
Erwan LR	4
Rafie Muhammad	4
Rafshanzani Suhada	3
Dave Jong	2
Marco Wotschka (Wordfence Vulnerability Researcher)	2
Dipak Panchal	1
NeginNrb	1
emad	1
Ravi Dharmawan	1
Justiice	1
Marc-Alexandre Montpas	1
Lukas Kinneberg	1
Kenichiro Ito	1
coogee86	1
Muhammad Daffa	1
Mika	1
Elliot	1
Chris Shultz	1
Le Ngoc Anh	1
Hoang Van Hiep	1
FearZzZz	1
Felipe Restrepo Rodriguez	1
Edison Poveda	1
yuyudhn	1
Etan Imanol Castro Aldrete	1
Abdi Pranata	1
qilin_99	1
Taurus Omar	1
Luca Greeb	1
Andreas Krüger	1
Abu Hurayra	1
Rafael B.	1

 

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and obtain a CVE ID through this form. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

---

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name	Software Slug
AN_GradeBook	an-gradebook
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup	armember-membership
Active Directory Integration / LDAP Integration	ldap-login-for-intranet-sites
ApplyOnline – Application Form Builder and Manager	apply-online
Autochat Automatic Conversation	auyautochat-for-wp
AutomateWoo	automatewoo
Booked – Appointment Booking for WordPress	booked
Caldera Forms Google Sheets Connector	gsheetconnector-caldera-forms
Catalyst Connect Zoho CRM Client Portal	catalyst-connect-client-portal
Duplicate Post Page Menu & Custom Post Type	duplicate-post-page-menu-custom-post-type
Easy Accordion FAQ and Knowledge Base Software for WordPress	knowledge-center
Editorial Calendar	editorial-calendar
Email download link	email-download-link
EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor	embedpress
Enhanced Text Widget	enhanced-text-widget
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty	chaty
Form Builder | Create Responsive Contact Forms	contact-form-add
Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor	front-editor
Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite	image-map-pro-lite
Image Regenerate & Select Crop	image-regenerate-select-crop
Layer Slider	slider-slideshow
LearnDash LMS	sfwd-lms
LiquidPoll – Advanced Polls for Creators and Brands	wp-poll
Login Configurator	login-configurator
Login/Signup Popup ( Inline Form + Woocommerce )	easy-login-woocommerce
My Content Management	my-content-management
NEX-Forms – Ultimate Form Builder – Contact forms and much more	nex-forms-express-wp-form-builder
NOO Timetable	noo-timetable
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress	post-smtp
Poll Maker – Best WordPress Poll Plugin	poll-maker
Post Hit Counter	post-hit-counter
Post to CSV by BestWebSoft	post-to-csv
Quiz Expert – Easy Quiz Maker, Exam and Test Manager	quiz-expert
Request a Quote	request-a-quote
SP Project & Document Manager	sp-client-document-manager
SW Product Bundles	sw-product-bundles
Salon booking system	salon-booking-system
Short URL	shorten-url
Subscribe2 – Form, Email Subscribers & Newsletters	subscribe2
TrustProfile and reviews for WordPress	trustprofile
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin	ultimate-member
WP Abstracts	wp-abstracts-manuscripts-manager
WP Job Board	wpjobboard
WP Post Author – The Ideal Author Box for WordPress Posts, Co-Authors and Guest Authors with Author Login and Registration Form Builder	wp-post-author
WP Social AutoConnect	wp-fb-autoconnect
WPFactory Helper	wpcodefactory-helper
WPGraphQL	wp-graphql
Waitlist Woocommerce ( Back in stock notifier )	waitlist-woocommerce
Web3 – Crypto wallet Login & NFT token gating	web3-authentication
WebwinkelKeur: Webshop keurmerk & reviews for WordPress	webwinkelkeur
WooCommerce Google Sheet Connector	wc-gsheetconnector
WooCommerce Pre-Orders	woocommerce-pre-orders
WooCommerce Ship to Multiple Addresses	woocommerce-shipping-multiple-addresses
Woocommerce Order Barcodes	woocommerce-order-barcodes
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)	miniorange-login-openid
houzez-crm	houzez-crm

---

WordPress Themes with Reported Vulnerabilities Last Week

Software Name	Software Slug
The7 — Website and eCommerce Builder for WordPress	dt-the7

---

Vulnerability Details

WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 – Authentication Bypass

---

WP Post Author <= 3.2.3 – Privilege Escalation

---

Ultimate Member <= 2.6.6 – Privilege Escalation via Arbitrary User Meta Updates

---

WPJobBoard <= 5.9.0 – Unauthenticated SQL Injection

---

Web3 – Crypto wallet Login & NFT token gating <= 2.6.0 – Authentication Bypass

---

LearnDash LMS <= 4.6.0 – Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change

---

Houzez CRM <= 1.3.3 – Authenticated (Subscriber+) SQL Injection

---

AN_GradeBook <= 5.0.1 – Authenticated (Subscriber+) SQL Injection

---

SP Project & Document Manager <= 4.67 – Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change

---

Short URL <= 1.6.4 – Authenticated (Subscriber+) SQL Injection

---

Form Builder <= 1.9.9.0 – Unauthenticated CSV Injection

---

Active Directory Integration / LDAP Integration <= 4.1.5 – Authenticated (Subscrber+) LDAP Injection

---

Post to CSV by BestWebSoft <= 1.4.0 – Authenticated (Author+) CSV Injection

---

Autochat Automatic Conversation <= 1.1.7 – Unauthenticated Stored Cross-Site Scripting

---

Email download link <= 3.7 – Unauthenticated Sensitive Information Exposure

---

POST SMTP Mailer <= 2.5.6 – Cross-Site Request Forgery to Account Compromise

---

Booked <= 2.4 – Unauthenticated Sensitive Information Exposure

---

Image Regenerate & Select Crop <= 7.1.0 – Missing Authorization on multiple AJAX actions

---

AutomateWoo <= 5.7.5 – Missing Authorization

---

Image Regenerate & Select Crop <= 7.1.0 – Cross-Site Request Forgery on multiple AJAX actions

---

Front User Submit | Front Editor <= 3.8.4 – Authenticated (Subscriber+) Stored Cross-Site Scripting

---

NOO Timetable <= 2.1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite <= 1.0.0 – Missing Authorization to Stored Cross-Site Scripting

---

Layer Slider <= 1.1.9.7 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite <= 1.0.0 – Cross-Site Request Forgery to Stored Cross-Site Scripting

---

WPFactory Helper <= 1.5.2 – Reflected Cross-Site Scripting via item_slug

---

WooCommerce Pre-Orders <= 2.0.1 – Reflected Cross-Site Scripting

---

Login Configurator <= 2.1 – Reflected Cross-Site Scripting

---

WPGraphQL <= 1.14.5 – Authenticated (Editor+) Server-Side Request Forgery

---

Waitlist Woocommerce ( Back in stock notifier ) <= 2.5.2 – Cross-Site Request Forgery via reset_settings

---

Editorial Calendar <= 3.7.12 – Authenticated (Contributor+) Insecure Direct Object Reference

---

Salon Booking System <= 8.4.6 – Cross-Site Request Forgery to Admin Role Change to Customer, User Meta Update via save_customer

---

EmbedPress <= 3.7.3 – Sensitive Information Exposure

---

NEX-Forms – Ultimate Form Builder <= 8.4.3 – Authenticated Stored Cross-Site Scripting via Form Name

---

Poll Maker <= 4.6.2 – Authenticated (Admin+) Server-Side Request Forgery

---

Floating Chat Widget – Chaty <= 3.1.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

SP Project & Document Manager <= 4.67 – Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings

---

Knowledge Center <= 2.7 – Authenticated (Admin+) Cross-Site Scripting

---

Catalyst Connect Zoho CRM Client Portal <= 2.0.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

My Content Management <= 1.7.6 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

ApplyOnline – Application Form Builder and Manager <= 2.5 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Short URL <= 1.6.4 – Authenticated(Admin+) Stored Cross-Site Scripting

---

ARMember <= 4.0.4 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

NOO Timetable <= 2.1.3 – Cross-Site Request Forgery

---

Waitlist Woocommerce ( Back in stock notifier ) <= 2.5.2 – Cross-Site Request Forgery to Settings Reset

---

TrustProfile <= 3.24 – Cross-Site Request Forgery

---

Quiz Expert – Easy Quiz Maker, Exam and Test Manager <= 1.5.0 – Cross-Site Request Forgery

---

Login/Signup Popup <= 2.3 – Cross-Site Request Forgery to Settings Reset

---

Post Hit Counter <= 1.3.2 – Missing Authorization

---

Duplicate Post Page Menu & Custom Post Type <= 2.3.1 – Missing Authorization

---

The7 <= 11.6.0 – Cross-Site Request Forgery

---

WP Social AutoConnect <= 4.6.1 – Cross-Site Request Forgery via jfb_admin_page

---

Enhanced Text Widget <= 1.5.7 – Missing Authorization

---

Subscribe2 <= 10.40 – Cross-Site Request Forgery

---

Request a Quote <= 2.3.10 – Cross-Site Request Forgery

---

WebwinkelKeur <= 3.24 – Cross-Site Request Forgery

---

AutomateWoo <= 5.7.5 – Cross-Site Request Forgery

---

LiquidPoll – Advanced Polls for Creators and Brands <= 3.3.68 – Missing Authorization via activate_addon

---

SW Product Bundles <= 2.0.15 – Missing Authorization

---

POST SMTP Mailer <= 2.5.6 – Cross-Site Request Forgery to Arbitrary Log Deletion

---

Caldera Forms Google Sheets Connector <= 1.2 – Cross-Site Request Forgery

---

WooCommerce Ship to Multiple Addresses <= 3.8.5 – Cross-Site Request Forgery

---

Subscribe2 <= 10.40 – Missing Authorization

---

WP Abstracts <= 2.6.2 – Cross-Site Request Forgery

---

WooCommerce Order Barcodes <= 1.6.4 – Cross-Site Request Forgery

---

WooCommerce Google Sheet Connector <= 1.3.4 – Cross-Site Request Forgery

---

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us using our CVE Request form, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.