Wordfence Intelligence Weekly WordPress Vulnerability Report (November 13, 2023 to November 19, 2023)

🎉Wordfence just launched its bug bounty program. For the first 6 months, all awarded bounties receive a 10% bonus. View the announcement to learn more now!

Last week, there were 126 vulnerabilities disclosed in 102 WordPress Plugins and 2 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 37 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Enterprises, Hosting Providers, and even Indivudals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 12,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

---

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

• WP Courses LMS <= 3.2.3 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

---

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status	Number of Vulnerabilities
Unpatched	40
Patched	86

---

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating	Number of Vulnerabilities
Low Severity	2
Medium Severity	105
High Severity	14
Critical Severity	5

---

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE	Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)	43
Missing Authorization	36
Cross-Site Request Forgery (CSRF)	26
Unrestricted Upload of File with Dangerous Type	4
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)	3
Information Exposure	2
Deserialization of Untrusted Data	2
Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’)	1
Improper Privilege Management	1
Unverified Password Change	1
Protection Mechanism Failure	1
URL Redirection to Untrusted Site (‘Open Redirect’)	1
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)	1
Use of Less Trusted Source	1
Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’)	1
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)	1
Improper Authorization	1

---

Researchers That Contributed to WordPress Security Last Week

Researcher Name	Number of Vulnerabilities
Abdi Pranata	23
Rafie Muhammad	18
Ngô Thiên An (ancorn_)	10
Le Ngoc Anh	5
István Márton (Wordfence Vulnerability Researcher)	4
Mika	4
Marco Wotschka (Wordfence Vulnerability Researcher)	4
Paolo Tresso (Wordfence Vulnerability Researcher)	4
emad	3
Huynh Tien Si	3
Ala Arfaoui	2
Vincenzo Turturro	2
Gianluca Parisi	2
Vincenzo Cantatore	2
Revan Arifio	1
Enrico Marcolini	1
Claudio Marchesini (Dottormarc)	1
wpdabh	1
RIN MIYACHI	1
Nicolas Surribas	1
Naveen Muthusamy	1
Vladislav Pokrovsky (ΞX.MI)	1
niclo	1
LEE SE HYOUNG	1
Muhammad Daffa	1
Brandon James Roldan (tomorrowisnew)	1
BuShiYue	1
Alex Sanford	1
thiennv	1
Nguyen Xuan Chien	1
Furkan ÖZER	1
DoYeon Park (p6rkdoye0n)	1
Dmitrii Ignatyev	1
Bartłomiej Marek	1
Tomasz Swiadek	1
resecured.io	1
Ivy (TOOR, Lisa)	1

 

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through this form. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

---

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name	Software Slug
10WebAnalytics	wd-google-analytics
AMP+ Plus	amp-plus
ARI Stream Quiz – WordPress Quizzes Builder	ari-stream-quiz
AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth	aweber-web-form-widget
Accordion	accordions-wp
Acme Fix Images	acme-fix-images
Add Widgets to Page	add-widgets-to-page
Ajax Domain Checker	ajax-domain-checker
Anywhere Flash Embed	anywhere-flash-embed
AppPresser – Mobile App Framework	apppresser
Audio Merchant	audio-merchant
BMI Calculator Plugin	bmi-calculator-shortcode
BP Profile Shortcodes Extra	bp-profile-shortcodes-extra
BSK Contact Form 7 Blacklist	bsk-contact-form-7-blacklist
Bamboo Columns	bamboo-columns
Better RSS Widget	better-rss-widget
BetterDocs – Best Documentation & Knowledge Base Plugin	betterdocs
Big File Uploads – Increase Maximum File Upload Size	tuxedo-big-file-uploads
Bus Ticket Booking with Seat Reservation – WpBusTicketly | WordPress plugin	bus-ticket-booking-with-seat-reservation
Client Invoicing by Sprout Invoices – Easy Estimates and Invoices for WordPress	sprout-invoices
CodeBard’s Patron Button and Widgets for Patreon	patron-button-and-widgets-by-codebard
Comments – wpDiscuz	wpdiscuz
Community by PeepSo – Social Network, Membership, Registration, User Profiles	peepso-core
Conditional Fields for Contact Form 7	cf7-conditional-fields
Customer Reviews for WooCommerce	customer-reviews-woocommerce
Daily Prayer Time	daily-prayer-time-for-mosques
Delete Duplicate Posts	delete-duplicate-posts
Ditty – Responsive News Tickers, Sliders, and Lists	ditty-news-ticker
DrawIt (draw.io)	drawit
EWWW Image Optimizer	ewww-image-optimizer
Easy Call Now by ThikShare	easy-call-now
EasyAzon – Amazon Associates Affiliate Plugin	easyazon
Elementor Addon Elements	addon-elements-for-elementor-page-builder
Email Encoder – Protect Email Addresses and Phone Numbers	email-encoder-bundle
Email Verification / SMS Verification / OTP Verification / OTP Authentication / WooCommerce Notification	miniorange-otp-verification
Embed Privacy	embed-privacy
EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor	embedpress
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates	essential-blocks
Essential Grid Portfolio – Photo Gallery	essential-grid
Events Addon for Elementor	events-addon-for-elementor
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty	chaty
Footer Putter	footer-putter
FormCraft – Contact Form Builder for WordPress	formcraft-form-builder
Forminator – Contact Form, Payment Form & Custom Form Builder	forminator
Frontend File Manager Plugin	nmedia-user-file-uploader
Hreflang Manager	hreflang-manager-lite
Image Compressor & Optimizer – iLoveIMG	iloveimg
Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms	cf7-constant-contact
Interactive World Map	interactive-world-map
Jetpack – WP Security, Backup, Speed, & Growth	jetpack
LWS Hide Login	lws-hide-login
LayerSlider	layerslider
Leadster	leadster-marketing-conversacional
Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator	legal-pages
Live Preview for Contact Form 7	cf7-live-preview
LuckyWP Scripts Control	luckywp-scripts-control
MP3 Audio Player for Music, Radio & Podcast by Sonaar	mp3-music-player-by-sonaar
Namaste! LMS	namaste-lms
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions	paid-memberships-pro
Permalinks Customizer	permalinks-customizer
Phlox Shop	auxin-shop
Popup Box – Best WordPress Popup Plugin	ays-popup-box
Post Status Notifier Lite	post-status-notifier-lite
Premium Portfolio Features for Phlox theme	auxin-portfolio
Premmerce Redirect Manager	premmerce-redirect-manager
Professional Social Sharing Buttons, Icons & Related Posts – Shareaholic	shareaholic
Pz-LinkCard	pz-linkcard
Quick Call Button	quick-call-button
Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress	quiz-master-next
Restaurant & Cafe Addon for Elementor	restaurant-cafe-addon-for-elementor
SearchIQ – The Search Solution	searchiq
Shortcodes and extra features for Phlox theme	auxin-elements
Simple 301 Redirects by BetterLinks	simple-301-redirects
Simply Excerpts	simply-excerpts
Slider Revolution	revslider
Slider – Ultimate Responsive Image Slider	ultimate-responsive-image-slider
Star CloudPRNT for WooCommerce	star-cloudprnt-for-woocommerce
Theater for WordPress	theatre
URL Shortify – Simple, Powerful and Easy URL Shortener Plugin For WordPress	url-shortify
Ultimate Dashboard – Custom WordPress Dashboard	ultimate-dashboard
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses	wp-courses
WP Custom Admin Interface	wp-custom-admin-interface
WP EXtra	wp-extra
WP Fastest Cache	wp-fastest-cache
WP Like Button	wp-like-button
WP Maintenance	wp-maintenance
WP Meta and Date Remover	wp-meta-and-date-remover
WP Not Login Hide (WPNLH)	wp-not-login-hide-wpnlh
WPCafe – Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation	wp-cafe
Website Optimization – Plerdy	plerdy-heatmap
Welcart e-Commerce	usc-e-shop
Welcome Email Editor	welcome-email-editor
WooCommerce	woocommerce
WooCommerce Blocks	woo-gutenberg-products-block
WooCommerce Bookings	woocommerce-bookings
WooCommerce Product Carousel Slider	product-carousel-slider-for-woocommerce
Woocommerce Shipping Canada Post	woocommerce-shipping-canada-post
WordPress File Upload	wp-file-upload
YOP Poll	yop-poll
avalex – Automatisch sichere Rechtstexte	avalex
eCommerce Product Catalog Plugin for WordPress	ecommerce-product-catalog
wpMandrill	wpmandrill

---

WordPress Themes with Reported Vulnerabilities Last Week

Software Name	Software Slug
Betheme	betheme
Thrive Themes Builder	thrive-theme

---

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Shortcodes and extra features for Phlox theme <= 2.14.0 – Unauthenticated Local File Inclusion

---

WP Fastest Cache <= 1.2.2 – Unauthenticated SQL Injection

---

Phlox Shop <= 2.0.0 – Unauthenticated Local File Inclusion

---

Phlox Portfolio <= 2.3.1 – Unauthenticated Local File Inclusion

---

Frontend File Manager Plugin <= 22.5 – Authenticated (Editor+) Directory Traversal

---

Audio Merchant <= 5.0.4 – Cross-Site Request Forgery to Arbitrary File Upload

---

Thrive Theme Builder <= 3.20.1 – Cross-Site Request Forgery

---

Thrive Theme Builder <= 3.20.1 – Privilege Escalation

---

WP Courses LMS <= 3.2.3 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

---

Welcart e-Commerce <= 2.9.4 – Cross-Site Request Forgery

---

Welcart e-Commerce <= 2.9.4 – Authenticated (Subscriber+) Arbitrary File Upload

---

Essential Grid <= 3.0.18 – Missing Authorization

---

Thrive Theme Builder <= 3.20.1 – Missing Authorization

---

AppPresser <= 4.2.5 – Insecure Password Reset Mechanism

---

Paid Memberships Pro <= 2.12.3 – Authenticated (Subscriber+) Arbitrary File Upload

---

Image Compressor & Optimizer – iLoveIMG <= 1.0.5 – Authenticated (Administrator+) PHP Object Injection

---

Welcart e-Commerce <= 2.9.5 – Authenticated (Administrator+) PHP Object Injection

---

Slider Revolution <= 6.6.15 – Authenticated (Author+) Arbitrary File Upload

---

Bus Ticket Booking with Seat Reservation <= 5.2.5 – Unauthenticated Cross-Site Scripting

---

Forminator <= 1.27.0 – Authenticated (Administrator+) Arbitrary File Upload

---

Email Encoder Bundle <= 2.1.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

---

Better RSS Widget <= 2.8.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

eCommerce Product Catalog for WordPress <= 3.3.26 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

LayerSlider <= 7.7.9 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

WooCommerce <= 8.1.1 & WooCommerce Blocks <= 11.1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image alt Attribute

---

Quiz And Survey Master <= 8.1.13 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Ajax Domain Checker <= 1.3.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Add Widgets to Page <= 1.3.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Slider Revolution <= 6.6.14 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Jetpack <= 12.8-a.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via block attribute

---

BMI Calculator Plugin <= 1.0.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Bamboo Columns <= 1.6.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Anywhere Flash Embed <= 1.0.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

DrawIt (draw.io) <= 1.1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

WooCommerce Product Carousel Slider <= 3.3.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

---

BP Profile Shortcodes Extra <= 2.5.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

ARI Stream Quiz <= 1.2.32 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Daily Prayer Time <= 2023.10.13 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

---

Shareaholic <= 9.7.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

AWeber <= 7.3.9 – Missing Authorization via AJAX actions

---

Betheme <= 27.1.1 – Missing Authorization

---

Interactive World Map <= 3.2.0 – Reflected Cross-Site Scripting

---

BSK Contact Form 7 Blacklist <= 1.0.1 – Reflected Cross-Site Scripting

---

Star CloudPRNT for WooCommerce <= 2.0.3 – Reflected Cross-Site Scripting

---

AMP+ Plus <= 3.0 – Reflected Cross Site Scripting

---

EmbedPress <= 3.9.1 – Reflected Cross-Site Scripting

---

Footer Putter <= 6.1.3 – Reflected Cross-Site Scripting

---

Post Status Notifier Lite <= 1.11.0 – Reflected Cross-Site Scripting

---

Permalinks Customizer <= 2.8.2 – Reflected Cross-Site Scripting

---

Namaste! LMS <= 2.6.1.1 – Reflected Cross-Site Scripting

---

Accordion <= 2.6 – Authenticated (Editor+) Stored Cross-Site Scripting via accordion settings

---

Embed Privacy <= 1.8.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Elementor Addon Elements <= 1.12.7 – Cross-Site Request Forgery

---

MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 4.10 – Missing Authorization to Template Import

---

Legal Pages <= 1.3.8 – Cross-Site Request Forgery via moveToTrash and fetch_and_insert_template_data

---

Pz-LinkCard <= 2.4.8 – Cross-Site Request Forgery via page_cacheman

---

eCommerce Product Catalog for WordPress <= 3.3.25 – Cross-Site Request Forgery

---

Audio Merchant <= 5.0.4 – Cross-Site Request Forgery to Settings Modifcation and Stored Cross-Site Scripting

---

Delete Duplicate Posts <= 4.8.9 – Missing Authorization via AJAX Actions

---

Elementor Addon Elements <= 1.12.7 – Cross-Site Request Forgery

---

Restaurant & Cafe Addon for Elementor <= 1.5.2 – Missing Authorization

---

Ditty <= 3.1.24 – Missing Authorization via save_ditty_permissions_check

---

FormCraft <= 1.2.7 – Missing Authorization via formcraft_nag_update

---

SearchIQ <= 4.4 – Missing Authorization via getSIQPluginSettings

---

YOP Poll <= 6.5.26 – Race Condition to Vote Manipulation

---

WPCafe <= 2.2.19 – Missing Authorization via dismiss_ajax_call

---

LWS Hide Login <= 2.1.8 – Protection Mechanism Bypass

---

avalex – Automatisch sichere Rechtstexte <= 3.0.8 – Missing Authorization

---

WP Maintenance <= 6.1.3 – IP Restriction Bypass

---

Elementor Addon Elements <= 1.12.7 – Missing Authorization to Sensitive Information Exposure

---

Welcome Email Editor <= 5.0.5 – Missing Authorization via ajax_handler

---

Events Addon for Elementor <= 2.1.2 – Missing Authorization

---

Acme Fix Images <= 1.0.0 – Missing Authorization via acme_fix_images_ajax_callback

---

EWWW Image Optimizer <= 7.2.0 – Unauthenticated Sensitive Information Exposure via Debug Log

---

WP Meta and Date Remover <= 2.3.0 – Cross-Site Request Forgery via updateSettings

---

Jetpack < 12.7 – Authenticated(Contributor+) Clickjacking via Iframe Injection

---

Integration for Contact Form 7 and Constant Contact <= 1.1.4 – Open Redirect

---

Chaty <= 3.1.2 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

---

Popup Box <= 3.8.6 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Simply Excerpts <= 1.4 – Authenticated (Admin+) Stored Cross-Site Scripting

---

Quick Call Button <= 1.2.9 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

---

Ultimate Dashboard <= 3.7.7 – Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings

---

WP Not Login Hide <= 1.0 – Authenticated (Admin+) Stored Cross-Site Scripting

---

Theater for WordPress <= 0.18.3 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

---

Premmerce Redirect Manager <= 1.0.11 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Elementor Addon Elements <= 1.12.7 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Website Optimization – Plerdy <= 1.3.2 – Authenticated (Admin+) Stored Cross-Site Scripting

---

URL Shortify <= 1.7.9 – Authenticated (Admin+) Stored Cross-Site Scripting

---

wpDiscuz <= 7.6.12 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Community by PeepSo <= 6.1.6.0 – Cross-Site Request Forgery via delete

---

WP Courses LMS <= 3.2.3 – Missing Authorization

---

Sprout Invoices <= 20.5.3 – Sensitive Information Exposure

---

BetterDocs <= 2.5.2 – Missing Authorization via AJAX actions

---

Conditional Fields for Contact Form 7 <= 2.4.1 – Missing Authorization

---

WP Courses LMS <= 3.2.3 – Cross-Site Request Forgery

---

LuckyWP Scripts Control <= 1.2.1 – Missing Authorization

---

Events Addon for Elementor <= 2.1.2 – Cross-Site Request Forgery

---

wpDiscuz <= 7.6.11 – Cross-Site Request Forgery

---

Ultimate Responsive Image Slider <= 3.5.11 – Missing Authorization via AJAX action

---

10WebAnalytics <= 1.2.12 – Missing Authorization via gawd_wd_bp_install_notice_status

---

miniorange otp verification <= 4.2.1 – Missing Authorization via dismiss_notice

---

WP EXtra <= 6.4 – Cross-Site Request Forgery ToolImport

---

Leadster <= 1.1.2 – Cross-Site Request Forgery via leadster_script_code_action

---

Live Preview for Contact Form 7 <= 1.2.0 – Missing Authorization via update_option

---

WP Custom Admin Interface <= 7.31 – Missing Authorization via wpcai_pro_notice_disable

---

EasyAzon – Amazon Associates Affiliate <= 5.1.0 – Missing Authorization on AJAX actions

---

LayerSlider <= 7.7.9 – Cross-Site Request Forgery

---

Big File Uploads <= 2.1.1 – Cross-Site Request Forgery via actions

---

Easy Call Now by ThikShare <= 1.1.0 – Cross-Site Request Forgery via settings_page

---

Restaurant & Cafe Addon for Elementor <= 1.5.2 – Cross-Site Request Forgery

---

Conditional Fields for Contact Form 7 <= 2.4.0 – Missing Authorization

---

CodeBard’s Patron Button and Widgets for Patreon <= 2.1.9 – Cross-Site Request Forgery

---

WooCommerce Bookings <= 2.0.3 – Cross-Site Request Forgery

---

Customer Reviews for WooCommerce <= 5.38.1 – Cross-Site Request Forgery via manual review reminders

---

WordPress File Upload 4.24.0 – Cross-Site Request Forgery

---

ARI Stream Quiz <= 1.2.32 – Cross-Site Request Forgery

---

wpMandrill <= 1.33 – Missing Authorization via getAjaxStats

---

Essential Blocks for Gutenberg <= 4.2.0 – Missing Authorization via AJAX actions

---

Hreflang Manager <= 1.06 – Cross-Site Request Forgery

---

Customer Reviews for WooCommerce <= 5.38.1 – Missing Authorization via manual review reminders

---

Legal Pages <= 1.3.8 – Missing Authorization

---

Simple 301 Redirects by BetterLinks <= 2.0.7 – Missing Authorization via clicked

---

Jetpack <= 12.6.2 – Improper Authorization via WPCom External Media REST endpoints

---

WooCommerce Canada Post Shipping <= 2.8.3 – Cross-Site Request Forgery

---

Restaurant & Cafe Addon for Elementor <= 1.5.3 – Missing Authorization via multiple AJAX functions

---

WP Like Button <= 1.7.0 – Missing Authorization via crublabFBLBAjax

---

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us using our CVE Request form, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.