<p align="justify">This article covers our public notifications related to major security issues our clients and the WordPress community should know about. <!--more-->We are always focused on <a href="http://pagely.com/solutions/secure-wordpress-hosting/">prevention and the mitigation of risk to our clients</a>, and keeping you updated here is part of that process.</p> <h3 align="justify">List of Vulnerable Plugins, September 2021</h3> <p style="text-align: center;">[visualizer id=”22314″ lazy=”no” class=””]</p> <h3>Plugins Removed From WordPress Repository</h3> <p style="text-align: center;">[visualizer id=”22309″ lazy=”no” class=””]</p> <p align="justify">As of this writing, the plugins on this list have been removed, suspended from the WordPress repository or there’s no fix for the vulnerability reported. WordPress security team decides to close a plugin when a security issue is found and the developer doesn’t release a patch in a timely manner. You can read more about this <a href="https://developer.wordpress.org/plugins/wordpress-org/alerts-and-warnings/">here</a>.</p> <p align="justify">If you are using one or more of the above plugins we recommend deactivating them until the developer releases a patch for the mentioned vulnerability or consider a more reliable alternative. It is possible that the plugin may be reintroduced at a later time. Pagely does not control the official WordPress Plugin Repository and we’re simply reporting on the latest events.</p> <h3 align="justify">Relevant Vulnerabilities</h3> <p align="justify">This month none of the vulnerabilities mentioned above caused massive infections or any important damage to our customers thanks to the nature of the vulnerabilities and the fast reaction of our team.</p>
The WordPress team released WordPress 5.8.1. This version features 60 bug fixes in addition to three security fixes: Data exposure within the REST API. Cross Site Scripting in the block editor. Lodash library was updated to version 4.17.21 to incorporate security fixes. The Pagely team has already begun rolling out this patch for all customers. If you have a version hold request on file, we will patch your site while keeping it on the same major branch version.
This article covers our public notifications related to major security issues our clients and the WordPress community should know about. We are always focused on prevention and the mitigation of risk to our clients, and keeping you updated here is part of that process. List of Vulnerable Plugins, July 2021 [visualizer id=”22234″ lazy=”no” class=””] Plugins Removed From WordPress Repository [visualizer id=”22239″ lazy=”no” class=””] As of this writing, the plugins on this list have been removed, suspended from the WordPress repository or there’s no fix for the vulnerability reported. WordPress security team decides to close a plugin when a security issue is found and the developer doesn’t release a patch in a timely manner. You can read more about this here. If you are using one or more of the above plugins we recommend deactivating them until the developer releases a patch for the mentioned vulnerability or consider a more reliable alternative. It is possible that the plugin may be reintroduced at a later time. Pagely does not control the official WordPress Plugin Repository and we’re simply reporting on the latest events. Relevant Vulnerabilities This month none of the vulnerabilities mentioned above caused massive infections or any important damage to our customers thanks to the nature of the vulnerabilities and the fast reaction of our team.
This article covers our public notifications related to major security issues our clients and the WordPress community should know about. We are always focused on prevention and the mitigation of risk to our clients, and keeping you updated here is part of that process. List of Vulnerable Plugins, Jun 2021 [visualizer id=”22203″ lazy=”no” class=””] Plugins Removed From WordPress Repository [visualizer id=”22208″ lazy=”no” class=””] As of this writing, the plugins on this list have been removed, suspended from the WordPress repository or there’s no fix for the vulnerability reported. WordPress security team decides to close a plugin when a security issue is found and the developer doesn’t release a patch in a timely manner. You can read more about this here. If you are using one or more of the above plugins we recommend deactivating them until the developer releases a patch for the mentioned vulnerability or consider a more reliable alternative. It is possible that the plugin may be reintroduced at a later time. Pagely does not control the official WordPress Plugin Repository and we’re simply reporting on the latest events. Relevant Vulnerabilities This month none of the vulnerabilities mentioned above caused massive infections or any important damage to our customers thanks to the nature of the vulnerabilities and the fast reaction of our team.
This article covers our public notifications related to major security issues our clients and the WordPress community should know about. We are always focused on prevention and the mitigation of risk to our clients, and keeping you updated here is part of that process. List of Vulnerable Plugins, May 2021 [visualizer id=”22175″ lazy=”no” class=””] Plugins Removed From WordPress Repository [visualizer id=”22171″ lazy=”no” class=””] WordPress security team decides to close a plugin when a security issue is found and the developer doesn’t release a patch in a timely manner. You can read more about this here. If you are using one or more of the above plugins we recommend deactivating them until the developer releases a patch for the mentioned vulnerability or consider a more reliable alternative. Relevant Vulnerabilities This month none of the vulnerabilities mentioned above caused massive infections or any important damage to our customers thanks to the nature of the vulnerabilities and the fast reaction of our team.
The WordPress team released WordPress 5.7.2. This version features one security fix: Object injection in PHPMailer Fix: This vulnerability was originally discovered in versions before 5.2.27 and 6.x before 6.0.6 of PHPMailer and was reintroduced in the versions 6.1.8 through 6.4.0. In order to fix this issue, the WordPress team upgraded PHPMailer from version 6.4.0 to 6.4.1 You can see more details about this vulnerability here: https://nvd.nist.gov/vuln/detail/CVE-2020-36326 Pagely staff have already begun applying patches to our customers’ WordPress websites. Customers with version holds will only receive the patch for the branch they are currently running.
This article covers our public notifications related to major security issues our clients and the WordPress community should know about. We are always focused on prevention and the mitigation of risk to our clients, and keeping you updated here is part of that process. List of Vulnerable Plugins, April 2021 [visualizer id=”22119″ lazy=”no” class=””] Plugins Removed From WordPress Repository [visualizer id=”22123″ lazy=”no” class=””] WordPress security team decides to close a plugin when a security issue is found and the developer doesn’t release a patch in a timely manner. You can read more about this here. If you are using one or more of the above plugins we recommend deactivating them until the developer releases a patch for the mentioned vulnerability or consider a more reliable alternative. Relevant Vulnerabilities Thankfully this month none of the vulnerabilities mentioned above caused massive infections or any important damage thanks to the nature of the vulnerability and the fast reaction of our team.
The WordPress team released WordPress 5.7.1. This version features 26 bug fixes in addition to two security fixes: XML External Entity Injection within the media library affecting only PHP 8. Fix: WordPress Security Team disabled the ability to load external entities for all versions Data exposure vulnerability within the REST API. Fix: WordPress Security Team added extra measures to restrict access to password protected posts. The Pagely team will be rolling out this patch for all customers shortly. If you have a version hold request on file, we will patch your site while keeping it on the same major branch version.
This article covers our public notifications related to major security issues our clients and the WordPress community should know about. We are always focused on prevention and the mitigation of risk to our clients, and keeping you updated here is part of that process. List of Vulnerable Plugins, March 2021 [visualizer id=”22079″ lazy=”no” class=””] Plugins Removed From WordPress Repository [visualizer id=”22083″ lazy=”no” class=””] WordPress security team decides to close a plugin when a security issue is found and the developer doesn’t release a patch in a timely manner. You can read more about this here. If you are using one or more of the above plugins we recommend deactivating them until the developer releases a patch for the mentioned vulnerability or consider a more reliable alternative. Relevant Vulnerabilities ht-slider-for-elementor: Arbitrary Post Creation This month we found and reported a medium severity vulnerability in this plugin affecting versions <= 1.2.3. If exploited, any unauthenticated attacker would be able to create arbitrary posts in the vulnerable site. Multiple thrive plugins and themes: Option Update and File Upload Over 100,000 websites were exposed to this vulnerability. All Pagely customers using these plugins were patched the same day this vulnerability was made public.
This article covers our public notifications related to major security issues our clients and the WordPress community should know about. We are always focused on prevention and the mitigation of risk to our clients, and keeping you updated here is part of that process. List of Vulnerable Plugins, January February [visualizer id=”22035″ lazy=”no” class=””] Plugins Removed From WordPress Repository [visualizer id=”22039″ lazy=”no” class=””] WordPress security team decides to close a plugin when a security issue is found and the developer doesn’t release a patch in a timely manner. You can read more about this here. If you are using one or more of the above plugins we recommend deactivating them until the developer releases a patch for the mentioned vulnerability or consider a more reliable alternative. Relevant Vulnerabilities Woocommerce-customers-manager: Privilege Escalation Vulnerability This month we found and reported a critical vulnerability in this plugin affecting versions <= 26.4. If exploited, any user in the site could become administrator. Photo-gallery: Cross-Site Scripting Proof Of Concept: http://vulnsite.com/index.php/bwg_gallery/randomalbumName/?bwg_search_0=%22%20onfocus=%22alert(1)%22%20autofocus=%22 Post SMTP: Cross-Site Request Forgery Proof Of Concept: GET /wp-admin/admin.php?page=postman_email_log&post-smtp-filter=1&_wp_http_referer=%2Fwp-admin%2Fadmin.php%3Fpage%3Dpostman_email_log&from_date=&to_date=&search=&postman_page_records=10&postman_export_csv=