Wordfence Intelligence Weekly WordPress Vulnerability Report (October 7, 2024 to October 13, 2024)
🦸 👻 Calling all superheroes and haunters! Introducing the Cybersecurity Month Spooktacular Haunt and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program! Through November 11th, 2024:
- All in-scope vulnerability types for WordPress plugins/themes with >= 1,000 active installations are in-scope for ALL researchers
- Top-tier researchers earn automatic bonuses of between 10% to 120% for valid submissions
- Pending report limits are increased for all
- It’s possible to earn up to $31,200 for high impact vulnerabilities!
Last week, there were 107 vulnerabilities disclosed in 105 WordPress Plugins and no WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 40 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 19,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- Hunk Companion <= 1.8.4 – Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation
- WAF-RULE-754 – Data redacted while we work with the vendor on a patch.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 75 |
| Partially Patched | 1 |
| Unpatched | 31 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Medium Severity | 84 |
| High Severity | 14 |
| Critical Severity | 9 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 49 |
| Missing Authorization | 18 |
| Cross-Site Request Forgery (CSRF) | 7 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 6 |
| Exposure of Sensitive Information to an Unauthorized Actor | 5 |
| Improper Control of Generation of Code ('Code Injection') | 5 |
| Deserialization of Untrusted Data | 4 |
| Authentication Bypass Using an Alternate Path or Channel | 2 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 2 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 2 |
| Unrestricted Upload of File with Dangerous Type | 2 |
| Improper Input Validation | 1 |
| Improper Privilege Management | 1 |
| Improper Restriction of XML External Entity Reference | 1 |
| Incorrect Privilege Assignment | 1 |
| Use of Less Trusted Source | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 14 | |
| 13 | |
| 11 | |
| 6 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| 2D Tag Cloud | 2d-tag-cloud-widget-by-sujin |
| ACF Images Search And Insert | acf-images-search-and-insert |
| Addon Elements for Elementor (formerly Elementor Addon Elements) | addon-elements-for-elementor-page-builder |
| Advanced Blocks Pro | advanced-blocks-pro |
| Advanced Contact form 7 DB | advanced-cf7-db |
| Advanced Custom Fields | advanced-custom-fields |
| Advanced Custom Fields (ACF®) | advanced-custom-fields |
| Advanced Custom Fields Pro | advanced-custom-fields-pro |
| Advanced Order Export For WooCommerce | woo-order-export-lite |
| Auto iFrame | auto-iframe |
| Backup and Staging by WP Time Capsule | wp-time-capsule |
| Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder | bit-form |
| BlockMeister – Block Pattern Builder | blockmeister |
| Bot for Telegram on WooCommerce | bot-for-telegram-on-woocommerce |
| Brevo – Email, SMS, Web Push, Chat, and more. | mailin |
| Bridge Core | bridge-core |
| BuddyPress Docs | buddypress-docs |
| Category Icon | category-icon |
| CM Tooltip Glossary | enhanced-tooltipglossary |
| CMSMasters Content Composer | cmsmasters-content-composer |
| Comments Import & Export | comments-import-export-woocommerce |
| Contact Form 7 – PayPal & Stripe Add-on | contact-form-7-paypal-add-on |
| Contact Form by Supsystic | contact-form-by-supsystic |
| Contact Form Widget | new-contact-form-widget |
| Creates 3D Flipbook, PDF Flipbook in WordPress | create-flipbook-from-pdf |
| CubeWP Framework | cubewp-framework |
| Curator.io | curatorio |
| Disc Golf Manager | disc-golf-manager |
| Download Manager | download-manager |
| Download Plugins and Themes in ZIP from Dashboard | download-plugins-dashboard |
| Easy Mega Menu for WordPress – ThemeHunk | themehunk-megamenu-plus |
| Easy PayPal Gift Certificate | paypal-gift-certificate |
| Easy Social Share Buttons | easy-social-share-buttons |
| Elementor Inline SVG | inline-svg-elementor |
| Embed PDF Viewer | embed-pdf-viewer |
| Embed videos and respect privacy | video-embed-privacy |
| Event Calendar | event-calendars |
| Export Products, Orders & Customers for WooCommerce | export-woocommerce |
| External featured image from bing | external-featured-image-from-bing |
| Featured Posts with Multiple Custom Groups (FPMCG) | featured-posts-with-multiple-custom-groups-fpmcg |
| Forms for Mailchimp by Optin Cat – Grow Your MailChimp List | mailchimp-wp |
| FULL – Cliente | full-customer |
| GDPR-Extensions-com – Consent Manager | gdpr-consent-manager |
| GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor | gutenkit-blocks-addon |
| Happy Addons for Elementor | happy-elementor-addons |
| Hunk Companion | hunk-companion |
| Image Optimizer, Resizer and CDN – Sirv | sirv |
| ImagePress – Image Gallery | image-gallery |
| Import Content in WordPress & WooCommerce with Excel | content-excel-importer |
| Import Users & Customers | Export Users with Excel for WordPress & WooCommerce | users-import-export-with-excel-for-wp |
| Increase upload file size & Maximum Execution Time limit | increase-upload-file-size-maximum-execution-time-limit |
| IP Loc8 | ip-loc8 |
| Iptanus File Upload | wp-file-upload |
| Keep Backup Daily | keep-backup-daily |
| Language Switcher | language-switcher |
| Limit Login Attempts (Spam Protection) | wp-limit-failed-login-attempts |
| Linkz.ai – Automatic link previews on hover | linkz-ai |
| Marketing and SEO Booster | marketing-and-seo-booster |
| Maximum Products per User for WooCommerce | maximum-products-per-user-for-woocommerce |
| Mynx Page Builder | mynx-page-builder |
| Nested Pages | wp-nested-pages |
| Notification for Telegram | notification-for-telegram |
| Order Attachments for WooCommerce | order-attachments-for-woocommerce |
| Pedalo Connector | pedalo-connector |
| PowerPress Podcasting plugin by Blubrry | powerpress |
| pretix widget | pretix-widget |
| Product Excel Import & Export for WooCommerce | woo-product-excel-importer |
| Product Excel Import Export & Bulk Edit for WooCommerce | webd-woocommerce-product-excel-importer-bulk-edit |
| Products Stock Manager with Excel for WooCommerce Inventory | products-stock-manager-with-excel |
| PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes | revisionary |
| QA Assistants – Driven by data | qa-heatmap-analytics |
| Read more By Adam | read-more |
| Rescue Shortcodes | rescue-shortcodes |
| Restaurant Reservations Widget | restaurantconnect-reswidget |
| Robo Gallery – Photo & Image Slider | robo-gallery |
| Royal Addons for Elementor – Addons and Templates Kit for Elementor | royal-elementor-addons |
| SB Random Posts Widget | sb-random-posts-widget |
| SEUR Oficial | seur |
| ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin | woolentor-addons |
| Shortcode For Elementor Templates | shortcode-support-for-elementor-templates |
| Shortcodes AnyWhere | shortcodes-anywhere |
| ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF | shortpixel-image-optimiser |
| Simple Baseball Scoreboard | simple-baseball-scoreboard |
| SKT Blocks – Gutenberg based Page Builder | skt-blocks |
| Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News | post-carousel |
| Smooth Gallery Replacement | smooth-gallery-replacement |
| Social Sharing (by Danny) | dvk-social-sharing |
| Stackable – Page Builder Gutenberg Blocks | stackable-ultimate-gutenberg-blocks |
| Survey Maker by AYS | survey-maker |
| TablePress – Tables in WordPress made easy | tablepress |
| Tainacan | tainacan |
| Talkback | talkback-secure-linkback-protocol |
| Telecash Ricaricaweb | telecash-ricaricaweb |
| The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce | the-plus-addons-for-elementor-page-builder |
| TS Poll – Survey, Versus Poll, Image Poll, Video Poll | poll-wp |
| User registration & user profile – UserPlus | userplus |
| Visualizer – Tables & Charts Manager with Built-in AI Generator | visualizer |
| WP Builder | cssjockey-add-ons |
| WP Helper Premium | wp-helper-lite |
| WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars | wp-post-author |
| WP Ultimate Post Grid | wp-ultimate-post-grid |
| WP Users Masquerade | wp-users-masquerade |
| wp-Monalisa | wp-monalisa |
| WPML Multilingual & Multicurrency for WooCommerce | woocommerce-multilingual |
| Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress | youzify |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
Disc Golf Manager [disc-golf-manager]
Researcher
Affected Software
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor [gutenkit-blocks-addon]
Researcher
Affected Software
Hunk Companion [hunk-companion]
Researcher
Affected Software
IP Loc8 [ip-loc8]
Researcher
Affected Software
Pedalo Connector [pedalo-connector]
Researcher
Affected Software
Talkback [talkback-secure-linkback-protocol]
Researcher
Affected Software
Telecash Ricaricaweb [telecash-ricaricaweb]
Researcher
Affected Software
Researcher
Affected Software
Iptanus File Upload [wp-file-upload]
Researcher
Affected Software
ACF Images Search And Insert [acf-images-search-and-insert]
Researcher
Affected Software
Bot for Telegram on WooCommerce [bot-for-telegram-on-woocommerce]
Researcher
Affected Software
Creates 3D Flipbook, PDF Flipbook in WordPress [create-flipbook-from-pdf]
Researcher
Affected Software
External featured image from bing [external-featured-image-from-bing]
Researcher
Affected Software
pretix widget [pretix-widget]
Researcher
Affected Software
SB Random Posts Widget [sb-random-posts-widget]
Researcher
Affected Software
WP Users Masquerade [wp-users-masquerade]
Researcher
Affected Software
Shortcodes AnyWhere [shortcodes-anywhere]
Researcher
Affected Software
Researcher
Affected Software
Contact Form by Supsystic [contact-form-by-supsystic]
Researcher
Affected Software
Researcher
Affected Software
Backup and Staging by WP Time Capsule [wp-time-capsule]
Researcher
Affected Software
Researcher
Affected Software
Tainacan [tainacan]
Researcher
Affected Software
Comments Import & Export [comments-import-export-woocommerce]
Researcher
Affected Software
Advanced Blocks Pro [advanced-blocks-pro]
Researcher
Affected Software
Auto iFrame [auto-iframe]
Researcher
Affected Software
Bridge Core [bridge-core]
Researcher
Category Icon <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
6.4
Affected Software
Category Icon [category-icon]
Researcher
Affected Software
CM Tooltip Glossary [enhanced-tooltipglossary]
Researcher
Affected Software
CMSMasters Content Composer [cmsmasters-content-composer]
Researcher
Affected Software
Curator.io [curatorio]
Researcher
Affected Software
Download Manager [download-manager]
Researcher
Affected Software
Easy Mega Menu for WordPress – ThemeHunk [themehunk-megamenu-plus]
Researcher
Affected Software
Elementor Inline SVG [inline-svg-elementor]
Researcher
Affected Software
Embed PDF Viewer [embed-pdf-viewer]
Researcher
Affected Software
GDPR-Extensions-com – Consent Manager [gdpr-consent-manager]
Researcher
Affected Software
Researcher
Affected Software
Marketing and SEO Booster [marketing-and-seo-booster]
Researcher
Affected Software
Mynx Page Builder [mynx-page-builder]
Researcher
Affected Software
PowerPress Podcasting plugin by Blubrry [powerpress]
Researcher
Rescue Shortcodes <= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
Affected Software
Rescue Shortcodes [rescue-shortcodes]
Researcher
Affected Software
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
Researcher
Affected Software
Simple Baseball Scoreboard [simple-baseball-scoreboard]
Researcher
Affected Software
SKT Blocks – Gutenberg based Page Builder [skt-blocks]
Researcher
Affected Software
Social Sharing (by Danny) [dvk-social-sharing]
Researcher
Affected Software
TablePress – Tables in WordPress made easy [tablepress]
Researcher
Affected Software
WP Builder [cssjockey-add-ons]
Researcher
Affected Software
WP Ultimate Post Grid [wp-ultimate-post-grid]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
2D Tag Cloud [2d-tag-cloud-widget-by-sujin]
Researcher
Affected Software
BlockMeister – Block Pattern Builder [blockmeister]
Researcher
Affected Software
BuddyPress Docs [buddypress-docs]
Researcher
Affected Software
Contact Form 7 – PayPal & Stripe Add-on [contact-form-7-paypal-add-on]
Researcher
Affected Software
Download Plugins and Themes in ZIP from Dashboard [download-plugins-dashboard]
Researcher
Affected Software
Easy PayPal Gift Certificate [paypal-gift-certificate]
Researcher
Affected Software
Easy Social Share Buttons [easy-social-share-buttons]
Researcher
Affected Software
Embed videos and respect privacy [video-embed-privacy]
Researcher
Affected Software
Featured Posts with Multiple Custom Groups (FPMCG) [featured-posts-with-multiple-custom-groups-fpmcg]
Researcher
Affected Software
FULL – Cliente [full-customer]
Researcher
Increase upload file size & Maximum Execution Time limit <= 2.0 - Reflected Cross-Site Scripting
6.1
Affected Software
Increase upload file size & Maximum Execution Time limit [increase-upload-file-size-maximum-execution-time-limit]
Researcher
Affected Software
Language Switcher [language-switcher]
Researcher
Affected Software
Maximum Products per User for WooCommerce [maximum-products-per-user-for-woocommerce]
Researcher
Affected Software
Export Products, Orders & Customers for WooCommerce [export-woocommerce]
Researcher
Affected Software
Researcher
Affected Software
Restaurant Reservations Widget [restaurantconnect-reswidget]
Researcher
Affected Software
Smooth Gallery Replacement [smooth-gallery-replacement]
Researcher
Affected Software
WPML Multilingual & Multicurrency for WooCommerce [woocommerce-multilingual]
Researcher
Smart Post Show <= 3.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting via Pagination Color
5.5
Affected Software
Researcher
Affected Software
Bridge Core [bridge-core]
Researcher
Affected Software
CubeWP Framework [cubewp-framework]
Researcher
Affected Software
Happy Addons for Elementor [happy-elementor-addons]
Researcher
Affected Software
Researcher
Affected Software
Event Calendar [event-calendars]
Researcher
Affected Software
Keep Backup Daily [keep-backup-daily]
Researcher
Limit Login Attempts (Spam Protection) <= 5.3 - IP Address Spoofing to Protection Mechanism Bypass
5.3
Affected Software
Limit Login Attempts (Spam Protection) [wp-limit-failed-login-attempts]
Researcher
Affected Software
QA Assistants – Driven by data [qa-heatmap-analytics]
Researcher
Affected Software
Stackable – Page Builder Gutenberg Blocks [stackable-ultimate-gutenberg-blocks]
Researcher
Affected Software
WP Helper Premium [wp-helper-lite]
Researcher
Affected Software
Advanced Custom Fields (ACF®) [advanced-custom-fields]
Advanced Custom Fields Pro [advanced-custom-fields-pro]
Advanced Custom Fields [advanced-custom-fields]
Researcher
Affected Software
Researcher
Affected Software
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF [shortpixel-image-optimiser]
Researcher
Affected Software
Event Calendar [event-calendars]
Researcher
Affected Software
Researcher
Affected Software
ImagePress – Image Gallery [image-gallery]
Researcher
Affected Software
Nested Pages [wp-nested-pages]
Researcher
Affected Software
Survey Maker by AYS [survey-maker]
Researcher
Affected Software
Contact Form Widget [new-contact-form-widget]
Researcher
Affected Software
Addon Elements for Elementor (formerly Elementor Addon Elements) [addon-elements-for-elementor-page-builder]
Researcher
Affected Software
Featured Posts with Multiple Custom Groups (FPMCG) [featured-posts-with-multiple-custom-groups-fpmcg]
Researcher
Affected Software
ImagePress – Image Gallery [image-gallery]
Researcher
Affected Software
ImagePress – Image Gallery [image-gallery]
Researcher
Affected Software
Researcher
Affected Software
Notification for Telegram [notification-for-telegram]
Researcher
Affected Software
Order Attachments for WooCommerce [order-attachments-for-woocommerce]
Researcher
Affected Software
Robo Gallery – Photo & Image Slider [robo-gallery]
Researcher
Affected Software
Read more By Adam [read-more]
Researcher
Affected Software
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin [woolentor-addons]
Researcher
Affected Software
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF [shortpixel-image-optimiser]
Researcher
Affected Software
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce [the-plus-addons-for-elementor-page-builder]
Researcher
Affected Software
wp-Monalisa [wp-monalisa]
Researcher
Affected Software
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments