Wordfence Intelligence Weekly WordPress Vulnerability Report (September 25, 2023 to October 1, 2023)

Last week, there were 90 vulnerabilities disclosed in 68 WordPress Plugins and no WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 31 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API and webhook integration are completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Individuals and Enterprises can use the vulnerability Database API to receive a complete dump of our database of over 11,800 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

---

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

• Simple Membership <= 4.3.4 – Account Takeover via Password Reset
• Allow PHP in Posts and Pages <= 3.0.4 – Authenticated (Subscriber+) Remote Code Execution via Shortcode
• WAF-RULE-635 – data redacted while we work with the developer on a patch.

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

---

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status	Number of Vulnerabilities
Unpatched	38
Patched	52

---

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating	Number of Vulnerabilities
Low Severity	3
Medium Severity	76
High Severity	9
Critical Severity	2

---

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE	Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)	35
Cross-Site Request Forgery (CSRF)	30
Missing Authorization	6
Missing Authentication for Critical Function	3
Information Exposure	3
Improper Input Validation	3
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)	3
Authorization Bypass Through User-Controlled Key	2
Improper Control of Generation of Code (‘Code Injection’)	1
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)	1
Guessable CAPTCHA	1
Files or Directories Accessible to External Parties	1
Unrestricted Upload of File with Dangerous Type	1

---

Researchers That Contributed to WordPress Security Last Week

Researcher Name	Number of Vulnerabilities
Marco Wotschka (Wordfence Vulnerability Researcher)	13
Lana Codes (Wordfence Vulnerability Researcher)	11
Nguyen Xuan Chien	8
Rio Darmawan	7
Dmitrii Ignatyev	4
Skalucy	4
Pedro José Navas Pérez	3
NGÔ THIÊN AN	3
Abdi Pranata	3
yuyudhn	3
SeungYongLee	2
DoYeon Park	2
Ben Bidner	2
Vladislav Pokrovsky	2
Rafie Muhammad	2
qilin_99	2
Bartłomiej Marek	2
Tomasz Swiadek	2
Erwan LR	2
Alex Thomas (Wordfence Vulnerability Researcher)	1
Mika	1
Muhammad Daffa	1
Jonatas Souza Villa Flor	1
thiennv	1
Rafshanzani Suhada	1
Linwz	1
Pablo Sanchez	1
Akihiro Hashimoto	1
Dao Xuan Hieu	1
Karolis Narvilas	1
emad	1

 

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and obtain a CVE ID through this form. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

---

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name	Software Slug
Active Directory Integration / LDAP Integration	ldap-login-for-intranet-sites
ActivityPub	activitypub
Add Shortcodes Actions And Filters	add-actions-and-filters
Advanced Custom Fields: Extended	acf-extended
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net	woo-bulk-editor
Backend Localization	kau-boys-backend-localization
Best WordPress Gallery Plugin – FooGallery	foogallery
Block Plugin Update	block-specific-plugin-updates
Blocks	blocks
Booking Calendar	booking
BuddyMeet	buddymeet
Comments by Startbit	facebook-comment-by-vivacity
Contact Form	contact-form-ready
Contractor Contact Form Website to Workflow Tool	contractor-contact-form-website-to-workflow-tool
Cooked – Recipe Plugin	cooked
CopyRightPro	copyrightpro
Events Rich Snippets for Google	rich-snippets-vevents
Font Awesome Integration	font-awesome-integration
Font Awesome More Icons	font-awesome-more-icons
Instant CSS	instant-css
Keap Landing Pages	infusionsoft-landing-pages
Kv TinyMCE Editor Add Fonts	kv-tinymce-editor-fonts
Magic Action Box	magic-action-box
Mang Board WP	mangboard
Mediavine Control Panel	mediavine-control-panel
Modal Window – create popup modal window	modal-window
Modern Events Calendar Lite	modern-events-calendar-lite
Onclick show popup	onclick-show-popup
OpenHook	thesis-openhook
Options for Twenty Seventeen	options-for-twenty-seventeen
Popup contact form	popup-contact-form
Pretty Google Calendar	pretty-google-calendar
Remove slug from custom post type	remove-slug-from-custom-post-type
Schema App Structured Data	schema-app-structured-data-for-schemaorg
School Management System – WPSchoolPress	wpschoolpress
Shockingly Simple Favicon	shockingly-simple-favicon
Simple File List	simple-file-list
Simple Membership	simple-membership
Simple Posts Ticker – Easy, Lightweight & Flexible	simple-posts-ticker
Slideshow, Image Slider by 2J	2j-slideshow
Staff / Employee Business Directory for Active Directory	ldap-ad-staff-employee-directory-search
TM WooCommerce Compare & Wishlist	tm-woocommerce-compare-wishlist
Table of Contents Plus	table-of-contents-plus
The Awesome Feed – Custom Feed	wp-facebook-feed
Tiger Forms – Drag and Drop Form Builder	tiger-form
Timthumb Vulnerability Scanner	timthumb-vulnerability-scanner
Tiny Carousel Horizontal Slider	tiny-carousel-horizontal-slider
Track The Click	track-the-click
Unyson	unyson
User Activity Log Pro	user-activity-log-pro
User Avatar – Reloaded	user-avatar-reloaded
Vrm 360 3D Model Viewer	vrm360
WP Adminify – WordPress Dashboard Customization | Custom Login | Admin Columns | Dashboard Widget | Media Library Folders	adminify
WP Captcha	wp-captcha
WP Custom Admin Interface	wp-custom-admin-interface
WP GPX Maps	wp-gpx-maps
WP Hide Pages	wp-hide-pages
WP Job Openings – Job Listing, Career Page and Recruitment Plugin	wp-job-openings
WP Jump Menu	wp-jump-menu
WP Site Protector	wp-site-protector
WWM Social Share On Image Hover	wwm-social-share-on-image-hover
Welcart e-Commerce	usc-e-shop
Woocommerce ESTO	woo-esto
WordPress Gallery Plugin – NextGEN Gallery	nextgen-gallery
WordPress Online Booking and Scheduling Plugin – Bookly	bookly-responsive-appointment-booking-tool
bbp style pack	bbp-style-pack
flowpaper	flowpaper-lite-pdf-flipbook
iframe	iframe

---

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

OpenHook <= 4.3.0 – Authenticated (Subscriber+) Remote Code Execution via Shortcode

---

Simple File List <= 6.1.8 – Unauthenticated Arbitrary File Deletion

---

Events Rich Snippets for Google <= 1.8 – Cross-Site Request Forgery to Arbitrary Options Update

---

Welcart e-Commerce <= 2.8.21 – Authenticated(Editor+) Arbitrary File Upload

---

Track The Click <= 0.3.11 – Authenticated (Author+) SQL Injection via ‘stats’ REST Endpoint

---

Simple Membership <= 4.3.4 – Account Takeover via Password Reset

---

Active Directory Integration / LDAP Integration <= 4.1.9 – Sensitive Information Exposure

---

Simple Membership <= 4.3.4 – Privilege escalation via Registration

---

FooGallery <= 2.2.44 – Reflected Cross-Site Scripting

---

User Activity Log Pro <= 2.3.3 – Unauthenticated Stored Cross-Site Scripting via User-Agent header

---

WPSchoolPress <= 2.2.4 – Authenticated(Teacher+) SQL Injection via ClassID

---

Bookly <= 22.3.1 – Authenticated(Administrator+) SQL Injection

---

NextGEN Gallery <= 3.37 – Authenticated (Admininistrator+) Arbitrary File Read and Deletion in gallery_edit

---

ActivityPub <= 0.17.0 – Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Post Content Exposure

---

Booking Calendar <= 9.7.3.3 – Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode

---

Font Awesome More Icons <= 3.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

bbp style pack <= 5.6.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

flowpaper <= 2.0.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

iframe <= 4.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘iframe’ Shortcode

---

ActivityPub <= 0.17.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content

---

Modal Window <= 5.3.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

Slideshow, Image Slider by 2J <= 1.3.54 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Comments by Startbit <= 1.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

The Awesome Feed – Custom Feed <= 2.2.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

BuddyMeet <= 2.2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

Cooked <= 1.7.13 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

ActivityPub <= 0.17.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via User Metadata

---

TM WooCommerce Compare & Wishlist <= 1.1.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

Pretty Google Calendar <= 1.5.1 – Authenticated(Contributor+) Stored Cross-Site Scripting via pretty_google_calendar shortcode

---

Font Awesome Integration <= 5.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

User Avatar – Reloaded <= 1.2.1 – Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode

---

Magic Action Box <= 2.17.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

Advanced Custom Fields: Extended <= 0.8.9.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

Options for Twenty Seventeen <= 2.5.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

Simple Posts Ticker <= 1.1.5 – Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode

---

Tiger Forms <= 2.0.0 – Reflected Cross-Site Scripting

---

Contractor Contact Form Website to Workflow Tool <= 4.0.0 – Reflected Cross-Site Scripting

---

BEAR <= 1.1.3.3 – Cross-Site Request Forgery to Product Deletion

---

BEAR <= 1.1.3.3 – Missing Authorization to Product Deletion

---

BEAR <= 1.1.3.3 – Cross-Site Request Forgery to Product Deletion

---

Block Plugin Update <= 3.3 – Cross-Site Request Forgery via bspu_plugin_select.php

---

Schema App Structured Data <= 1.22.3 – Missing Authorization via page_init

---

CopyRightPro <= 2.1 – Cross-Site Request Forgery

---

User Activity Log Pro <= 2.3.3 – Tracking Bypass via IP Spoofing

---

WP Captcha <= 2.0.0 – CAPTCHA Bypass

---

WP Jump Menu <= 3.6.4 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Popup contact form <= 7.1 – Authenticated (Admin+) Stored Cross-Site Scripting

---

Blocks <= 1.6.41 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Simple Posts Ticker <= 1.1.5 – Authenticated(Administrator+) Stored Cross-Site Scripting

---

WP Adminify <= 3.1.6 – Authenticated (Admin+) Stored Cross-Site Scripting

---

Popup contact form <= 7.1 – Authenticated (Admin+) Stored Cross-Site Scripting

---

WWM Social Share On Image Hover <= 2.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Tiny Carousel Horizontal Slider <= 8.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Onclick Show Popup <= 8.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Modern Events Calendar lite < 7.1.0 – Authenticated (Admin+) Stored Cross-Site Scripting

---

Keap Landing Pages <= 1.4.2 – Cross-Site Request Forgery

---

BEAR <= 1.1.3.3 – Cross-Site Request Forgery to Product Manipulation

---

BEAR <= 1.1.3.3 – Missing Authorization to Product Manipulation

---

Instant CSS <= 1.2.1 – Cross-Site Request Forgery

---

BEAR <= 1.1.3.3 – Cross-Site Request Forgery to Product Manipulation

---

Unyson <= 2.7.28 – Missing Authorization

---

BEAR <= 1.1.3.3 – Cross-Site Request Forgery to Product Manipulation

---

WP Custom Admin Interface <= 7.32 – Missing Authorization to Transients Deletion

---

WP Hide Pages <= 1.0 – Cross-Site Request Forgery

---

Add Shortcodes Actions And Filters <= 2.0.9 – Cross-Site Request Forgery

---

Woocommerce ESTO <= 2.23.1 – Cross-Site Request Forgery via saveSetting

---

BEAR <= 1.1.3.3 – Cross-Site Request Forgery to Stored Cross-Site Scripting

---

Contact Form <= 2.0.10 – Cross-Site Request Forgery

---

Table of Contents Plus <= 2302 – Cross-Site Request Forgery

---

WP GPX Map <= 1.7.05 – Missing Authorization

---

BEAR <= 1.1.3.3 – Cross-Site Request Forgery to Profile Creation

---

Vrm 360 3D Model Viewer <= 1.2.1 – Authenticated(Subscriber+) Sensitive Information Exposure

---

Remove slug from custom post type <= 1.0.3 – Cross-Site Request Forgery

---

WP Captcha <= 2.0.0 – Cross-Site Request Forgery

---

WP Custom Admin Interface <= 7.32 – Cross-Site Request Forgery to Transients Deletion

---

Mediavine Control Panel <= 2.10.2 – Cross-Site Request Forgery via render_settings_page

---

Backend Localization <= 2.1.10 – Cross-Site Request Forgery

---

BEAR <= 1.1.3.3 – Missing Authorization to Product Manipulation

---

BEAR <= 1.1.3.3 – Cross-Site Request Forgery to Profile Deletion

---

BEAR <= 1.1.3.3 – Missing Authorization to Product Manipulation

---

Kv TinyMCE Editor Add Fonts <= 1.1 – Cross-Site Request Forgery

---

ActivityPub <= 0.17.0 – Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Post Title Exposure

---

FooGallery <= 2.2.44 – Cross-Site Request Forgery

---

Mang Board WP <= 1.7.6 – Cross-Site Request Forgery

---

Timthumb Vulnerability Scanner <= 1.54 – Cross-Site Request Forgery

---

WP Site Protector <= 2.0 – Cross-Site Request Forgery

---

Shockingly Simple Favicon <= 1.8.2 – Cross-Site Request Forgery

---

WP Job Openings <= 3.4.2 – Information Exposure

---

Active Directory Integration / LDAP Integration <= 4.1.10 – LDAP Passback

---

Staff / Employee Business Directory for Active Directory <= 1.2.3 – Authenticated (Admin+) LDAP Passback

---

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us using our CVE Request form, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.