Understanding Vulnerabilities in WordPress Plugins
Every week, we highlight known vulnerabilities in WordPress plugins. This information helps you stay informed about potential risks and take appropriate action to protect your website. By addressing these vulnerabilities, you ensure the safety and integrity of your WordPress site and its data.
Plugin: WP Super Cache
Vulnerability: Authenticated (Admin+) Remote Code Execution
Patched Version: 1.7.2
Recommended Action: Update to version 1.7.2, or a newer patched version
Plugin: wpDataTables (Premium)
Vulnerability: Improper Access Control leading to Table Permission Takeover
Patched Version: 3.4.2
Recommended Action: Update to version 3.4.2, or a newer patched version
Plugin: wpDataTables (Premium)
Vulnerability: Blind SQL Injection via length Parameter
Patched Version: 3.4.2
Recommended Action: Update to version 3.4.2, or a newer patched version
Plugin: Related Posts for WordPress
Vulnerability: Reflected Cross-Site Scripting
Patched Version: 2.0.4
Recommended Action: Update to version 2.0.4, or a newer patched version
Plugin: wpDataTables (Premium)
Vulnerability: Improper Access Control leading to Table Data Deletion
Patched Version: 3.4.2
Recommended Action: Update to version 3.4.2, or a newer patched version
Plugin: VM Backups
Vulnerability: Cross-Site Request Forgery
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: wpDataTables (Premium)
Vulnerability: Blind SQL Injection via start Parameter
Patched Version: 3.4.2
Recommended Action: Update to version 3.4.2, or a newer patched version
Plugin: BuddyPress
Vulnerability: 7.0.0
Patched Version: 7.2.1
Recommended Action: Update to version 7.2.1, or a newer patched version
Plugin: Tutor LMS – eLearning and online course solution
Vulnerability: Unprotected AJAX including Privilege Escalation
Patched Version: 1.7.7
Recommended Action: Update to version 1.7.7, or a newer patched version
Plugin: VM Backups
Vulnerability: Cross-Site Request Forgery to Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: SEO Redirection Plugin – 301 Redirect Manager
Vulnerability: 301 Redirect Manager <= 6.3
Patched Version: 6.4
Recommended Action: Update to version 6.4, or a newer patched version
Plugin: Tutor LMS – eLearning and online course solution
Vulnerability: SQL Injection via tutor_quiz_builder_get_question_form
Patched Version: 1.8.3
Recommended Action: Update to version 1.8.3, or a newer patched version
Plugin: Flo Forms – Easy Drag & Drop Form Builder
Vulnerability: Options Change to Stored Cross-Site Scripting
Patched Version: 1.0.36
Recommended Action: Update to version 1.0.36, or a newer patched version
Plugin: Tutor LMS – eLearning and online course solution
Vulnerability: SQL Injection
Patched Version: 1.7.7
Recommended Action: Update to version 1.7.7, or a newer patched version
Plugin: Tutor LMS – eLearning and online course solution
Vulnerability: SQL Injection
Patched Version: 1.7.7
Recommended Action: Update to version 1.7.7, or a newer patched version
Plugin: BuddyPress
Vulnerability: Privilege Escalation via REST API
Patched Version: 7.2.1
Recommended Action: Update to version 7.2.1, or a newer patched version
Plugin: Database Backups
Vulnerability: Cross-Site Request Forgery
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
Plugin: Tutor LMS – eLearning and online course solution
Vulnerability: SQL Injection via tutor_quiz_builder_get_answers_by_question
Patched Version: 1.8.3
Recommended Action: Update to version 1.8.3, or a newer patched version
Plugin: Tutor LMS – eLearning and online course solution
Vulnerability: SQL Injection via tutor_answering_quiz_question/get_answer_by_id
Patched Version: 1.8.3
Recommended Action: Update to version 1.8.3, or a newer patched version
Plugin: Social Slider Feed
Vulnerability: Reflected Cross-Site Scripting
Patched Version: 1.8.5
Recommended Action: Update to version 1.8.5, or a newer patched version
Plugin: JH 404 Logger
Vulnerability: Unauthenticated Stored Cross-Site Scripting
Patched Version: No patched version available
Recommended Action: No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.
***
Check out the Watch Out Wednesday Archive for past Watch Out Wednesday posts.
