Updates on WordPress security, Wordfence and what we're cooking in the lab today.

Author Archive: Ram Gall

Wordfence Blog

High Severity Vulnerability Leads to Closure of Plugin with Over 100,000 Installations

This entry was posted in Vulnerabilities, WordPress Security on April 02, 2020 by Ram Gall   5 Replies

On April 1, 2020, the Wordfence Threat Intelligence team discovered a stored Cross Site Scripting (XSS) vulnerability in Contact Form 7 Datepicker, a WordPress plugin installed on over 100,000 sites. As the plugin developer’s github page indicated that the plugin was no longer being maintained, we contacted the WordPress plugins team with our disclosure, and …
Read More

Critical Vulnerabilities Affecting Over 200,000 Sites Patched in Rank Math SEO Plugin

This entry was posted in Vulnerabilities, WordPress Security on March 31, 2020 by Ram Gall   4 Replies

On March 23, 2020, our Threat Intelligence team discovered 2 vulnerabilities in WordPress SEO Plugin – Rank Math, a WordPress plugin with over 200,000 installations. The most critical vulnerability allowed an unauthenticated attacker to update arbitrary metadata, which included the ability to grant or revoke administrative privileges for any registered user on the site. The …
Read More

Vulnerabilities Patched in IMPress for IDX Broker

This entry was posted in Vulnerabilities, WordPress Security on March 26, 2020 by Ram Gall   2 Replies

On February 28, 2020, the Wordfence Threat Intelligence team became aware of a newly patched stored Cross-Site Scripting (XSS) vulnerability in IMPress for IDX Broker, a WordPress plugin with over 10,000 installations. Although all Wordfence users, including those still using the free version of Wordfence, were already protected from this vulnerability by the Web Application …
Read More

Vulnerabilities Patched in Popup Builder Plugin Affecting over 100,000 Sites

This entry was posted in Vulnerabilities, WordPress Security on March 12, 2020 by Ram Gall   5 Replies

On March 4th, our Threat Intelligence team discovered several vulnerabilities in Popup Builder, a WordPress plugin installed on over 100,000 sites. One vulnerability allowed an unauthenticated attacker to inject malicious JavaScript into any published popup, which would then be executed whenever the popup loaded. The other vulnerability allowed any logged-in user, even those with minimal …
Read More

Active Attack on Zero Day in Custom Searchable Data Entry System Plugin

This entry was posted in Vulnerabilities, WordPress Security on March 06, 2020 by Ram Gall   2 Replies

The Wordfence Threat Intelligence team is tracking a series of attacks against an unpatched vulnerability in the Custom Searchable Data Entry System plugin for WordPress. The estimated 2,000+ sites running the plugin are vulnerable to Unauthenticated Data Modification and Deletion, including the potential to delete the entire contents of any table in a vulnerable site’s …
Read More

Multiple Vulnerabilities Patched in RegistrationMagic Plugin

This entry was posted in Vulnerabilities, WordPress Security on March 05, 2020 by Ram Gall   3 Replies

On February 24th, our Threat Intelligence team discovered several critical vulnerabilities in RegistrationMagic, a WordPress plugin installed on over 10,000 sites, including the vendor’s own site. These allowed an attacker with subscriber-level permissions to elevate their account’s privileges to those of an administrator and to export every form on the site, including all the data …
Read More

Follow Us

      


Protect your websites with the #1 WordPress Security Plugin

Get Premium
Over 150 million downloads

Wordfence Newsletter

Get WordPress Security Alerts and Product Updates