Wordfence Intelligence Weekly WordPress Vulnerability Report (August 21, 2023 to August 27, 2023)

Last week, there were 43 vulnerabilities disclosed in 38 WordPress Plugins and no WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 23 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API and webhook notifications are completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

---

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

• JupiterX Core <= 3.3.8 – Unauthenticated Privilege Escalation

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

---

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status	Number of Vulnerabilities
Unpatched	17
Patched	26

---

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating	Number of Vulnerabilities
Low Severity	0
Medium Severity	35
High Severity	6
Critical Severity	2

---

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE	Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)	16
Missing Authorization	13
Cross-Site Request Forgery (CSRF)	8
Unrestricted Upload of File with Dangerous Type	2
Reliance on Untrusted Inputs in a Security Decision	1
Authentication Bypass Using an Alternate Path or Channel	1
Use of Less Trusted Source	1
Improper Privilege Management	1

---

Researchers That Contributed to WordPress Security Last Week

Researcher Name	Number of Vulnerabilities
Rafshanzani Suhada	6
Abdi Pranata	3
Rio Darmawan	3
Rafie Muhammad	3
Mahesh Nagabhairava	2
Nguyen Xuan Chien	2
yuyuddn	1
Bob Matyas	1
Carlos David Garrido León	1
Skalucy	1
Nithissh S	1
Animesh Gaurav	1
Muhammad Daffa	1
konagash	1
Dipak Panchal	1
Bartłomiej Marek	1
Tomasz Swiadek	1
An Dang	1
Erwan LR	1
Mika	1
Lana Codes (Wordfence Vulnerability Researcher)	1
Dmitrii Ignatyev	1
Revan Arifio	1

 

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and obtain a CVE ID through this form. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

---

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name	Software Slug
Category Slider for WooCommerce	woo-category-slider-grid
Collapse-O-Matic	jquery-collapse-o-matic
Cookies by JM	cookies-by-jm
DX-auto-save-images	dx-auto-save-images
DoLogin Security	dologin
ElementsKit Elementor addons	elementskit-lite
FTP Access	ftp-access
FV Flowplayer Video Player	fv-wordpress-flowplayer
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager	folders
Herd Effects – fake notifications and social proof plugin	mwp-herd-effect
Hide My WP Ghost – Security Plugin	hide-my-wp
Jupiter X Core	jupiterx-core
Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages	page-builder-add
Leyka	leyka
Lock User Account	lock-user-account
Master Addons for Elementor	master-addons
MasterStudy LMS WordPress Plugin – for Online Courses and Education	masterstudy-lms-learning-management-system
Min Max Control – Min Max Quantity & Step Control for WooCommerce	woo-min-max-quantity-step-control-single
Post and Page Builder by BoldGrid – Visual Drag and Drop Editor	post-and-page-builder
Posts Like Dislike	posts-like-dislike
Premmerce User Roles	premmerce-user-roles
Push Notification for Post and BuddyPress	push-notification-for-post-and-buddypress
ReviewX – Multi-criteria Rating & Reviews for WooCommerce	reviewx
Royal Elementor Addons and Templates	royal-elementor-addons
Save as Image plugin by Pdfcrowd	save-as-image-by-pdfcrowd
Save as PDF plugin by Pdfcrowd	save-as-pdf-by-pdfcrowd
Secure Admin IP	secure-admin-ip
Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management	simple-urls
Slimstat Analytics	wp-slimstat
Sticky Social Media Icons	sticky-social-media-icons
Translate WordPress with GTranslate	gtranslate
URL Shortify – Simple, Powerful and Easy URL Shortener Plugin For WordPress	url-shortify
Vertical marquee plugin	vertical-marquee-plugin
Void Elementor Post Grid Addon for Elementor Page builder	void-elementor-post-grid-addon-for-elementor-page-builder
WP Adminify – WordPress Dashboard Customization | Custom Login | Admin Columns | Dashboard Widget | Media Library Folders	adminify
WP VK-付费内容插件（付费阅读/资料/工具软件资源管理）	wp-vk
gAppointments – Appointment booking addon for Gravity Forms	gAppointments
iThemes Sync	ithemes-sync

---

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities.

JupiterX Core <= 3.3.5 – Unauthenticated Arbitrary File Upload

---

JupiterX Core <= 3.3.8 – Unauthenticated Privilege Escalation

---

Folders <= 2.9.2 – Authenticated (Author+) Arbitrary File Upload

---

Premmerce User Roles <= 1.0.12 – Missing Authorization via role management functions

---

Master Addons for Elementor <= 2.0.3 – Missing Authorization

---

MasterStudy LMS <= 3.0.17 – Privilege Escalation

---

Simple URLs <= 117 – Unauthenticated Cross-Site Scripting

---

URL Shortify <= 1.7.5 – Unauthenticated Stored Cross-Site Scripting via Referrer Header

---

Collapse-O-Matic <= 1.8.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Simple URLs <= 117 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

FTP Access <= 1.0 – Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

---

gAppointments – Appointment booking addon for Gravity Forms <= 1.9.7 – Reflected Cross-Site Scripting

---

Min Max Control <= 4.5 – Reflected Cross-Site Scripting

---

Elements kit Elementor addons <= 2.9.1 – Missing Authorization

---

FV Flowplayer Video Player <= 7.5.37.7212 – Insufficient Input Validation to Unauthenticated Stored Cross-Site Scripting and Arbitrary Usermeta Update

---

Void Elementor Post Grid Addon for Elementor Page builder <= 2.1.10 – Missing Authorization to Review Notice Dismissal

---

Push Notification for Post and BuddyPress <= 1.63 – Missing Authorization to Unauthenticated Admin Notice Dismissal

---

Hide My WP Ghost <= 5.0.25 – CAPTCHA Bypass in brute_math_authenticate

---

Posts Like Dislike <= 1.1.1 – Missing Authorization to Authenticated (Subscriber+) Plugin Setting Reset

---

Secure Admin IP <= 2.0 – Missing Authorization via ‘saveSettings’

---

DoLogin Security <= 3.6 – IP Address Spoofing

---

Vertical Marquee Plugin <= 7.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Cookies by JM <= 1.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Slimstat Analytics <= 5.0.8 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

---

Save as PDF plugin by Pdfcrowd <= 2.16.0 – Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings

---

GTranslate <= 3.0.3 – Authenticated (Administrator+) Cross-Site Scripting via Multiple Parameters

---

WP Adminify <= 3.1.5 – Authenticated (Admin+) Stored Cross-Site Scripting

---

Save as Image plugin by Pdfcrowd <= 2.16.0 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

---

Leyka <= 3.30.3 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Landing Page Builder <= 1.5.1.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

WP VK-付费内容插件 <= 1.3.3 – Cross-Site Request Forgery via AJions

---

iThemes Sync <= 2.1.13 – Cross-Site Request Forgery and Missing Authorization via ‘hide_authenticate_notice’

---

Simple URLs <= 117 – Missing Authorization via AJAX actions

---

DX-auto-save-images <= 1.4.0 – Cross-Site Request Forgery

---

Royal Elementor Addons <= 1.3.75 – Cross-Site Request Forgery

---

Sticky Social Media Icons <= 2.0 – Missing Authorization via ajax_request_handle

---

ReviewX <= 1.6.17 – Missing Authorization in rx_coupon_from_submit

---

Herd Effects <= 5.2.3 – Cross-Site Request Forgery to Effect Deletion

---

Category Slider for WooCommerce <= 1.4.15 – Missing Authorization via notice dismissal functionality

---

Simple URLs <= 117 – Cross-Site Request Forgery via AJAX actions

---

Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.24.1 – Cross-Site Request Forgery via submitDefaultEditor

---

Slimstat Analytics <= 5.0.5.1 – Missing Authorization via delete_pageview

---

Lock User Account <= 1.0.3 – Cross-Site Request Forgery to Account Lock/Unlock

---

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us using our CVE Request form, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.