Updates on WordPress security, Wordfence and what we're cooking in the lab today.

Category Archive: WordPress Security

Wordfence Blog

High Severity Vulnerability Patched in WooCommerce Stock Manager Plugin

This entry was posted in Research, Vulnerabilities, WordPress Security on June 14, 2021 by Chloe Chamberland   0 Replies

On May 21, 2021, the Wordfence Threat Intelligence team initiated the responsible disclosure process for a vulnerability that we discovered in WooCommerce Stock Manager, a WordPress plugin installed on over 30,000 sites. This flaw made it possible for an attacker to upload arbitrary files to a vulnerable site and achieve remote code execution, as long …
Read More

Malicious Attack Campaign Targeting Jetpack Users Reusing Passwords

This entry was posted in PSA, Research, WordPress Security on June 11, 2021 by Ram Gall   10 Replies

The Wordfence Threat Intelligence and Site Cleaning teams have been tracking a malware campaign that redirects all site visitors to malvertising domains, while attempting to keep site administrators unaware of the infection. Since June 1, 2021, the number of sites we are tracking that have been infected with this malware has more than doubled, and …
Read More

Wordfence is now a CVE Numbering Authority (CNA)

This entry was posted in General Security, WordPress Security on June 10, 2021 by Chloe Chamberland   5 Replies

Today, we are excited to announce that Wordfence is authorized by the Common Vulnerabilities and Exposures (CVE®) Program as a CNA, or CVE Numbering Authority. As a CNA, Wordfence can now assign CVE IDs for new vulnerabilities in WordPress Core, WordPress Plugins and WordPress Themes. WordPress powers over 40% of the World Wide Web in …
Read More

Critical 0-day in Fancy Product Designer Under Active Attack

This entry was posted in Research, Vulnerabilities, WordPress Security on June 01, 2021 by Ram Gall   2 Replies

Update: A patched version of Fancy Product Designer, 4.6.9, is now available as of June 2, 2021. This article has been updated to reflect newly available information, including Indicators of Compromise. On May 31, 2021, the Wordfence Threat Intelligence team discovered a critical file upload vulnerability being actively exploited in Fancy Product Designer, a WordPress …
Read More

Severe Vulnerabilities Patched in Simple 301 Redirects by BetterLinks Plugin

This entry was posted in Research, Vulnerabilities, WordPress Security on May 26, 2021 by Chloe Chamberland   0 Replies

On April 8, 2021, the Wordfence Threat Intelligence team initiated the responsible disclosure process for several vulnerabilities discovered in Simple 301 Redirects by BetterLinks, a WordPress plugin installed on over 300,000 sites. One of these flaws made it possible for unauthenticated users to update redirects for the site allowing an attacker to redirect all site …
Read More

Over 600,000 Sites Impacted by WP Statistics Patch

This entry was posted in Research, Vulnerabilities, WordPress Security on May 18, 2021 by Ram Gall   0 Replies

On March 13, 2021, the Wordfence Threat Intelligence team initiated responsible disclosure for a vulnerability in WP Statistics, a plugin installed on over 600,000 WordPress sites. The vulnerability allowed any site visitor to extract sensitive information from a site’s database via Time-Based Blind SQL Injection. We received a response to our initial disclosure the same …
Read More

WordPress 5.7.2 Security Release: What You Need to Know

This entry was posted in Vulnerabilities, WordPress Security on May 13, 2021 by Ram Gall   10 Replies

On May 13, 2021 01:00 UTC, WordPress core released a security patch for a Critical Object Injection vulnerability in PHPMailer, the component that WordPress uses to send emails by default. If your site is set to allow auto updating of minor point releases, your site has probably already updated to WordPress 5.7.2. While we do …
Read More

Critical Vulnerability Patched in External Media Plugin

This entry was posted in Research, Vulnerabilities, WordPress Security on May 13, 2021 by Chloe Chamberland   2 Replies

On February 2, 2021, our Threat Intelligence team responsibly disclosed the details of a vulnerability in External Media, a WordPress plugin used by over 8,000 sites. This flaw made it possible for authenticated users, such as subscribers, to upload arbitrary files on any site running the plugin. This vulnerability could be used to achieve remote …
Read More

SQL Injection Vulnerability Patched in CleanTalk AntiSpam Plugin

This entry was posted in Research, Vulnerabilities, WordPress Security on May 03, 2021 by Ram Gall   0 Replies

On March 4, 2021, the Wordfence Threat Intelligence team initiated responsible disclosure for a Time-Based Blind SQL Injection vulnerability discovered in Spam protection, AntiSpam, FireWall by CleanTalk, a WordPress plugin installed on over 100,000 sites. This vulnerability could be used to extract sensitive information from a site’s database, including user emails and password hashes, all …
Read More

Severe Unpatched Vulnerabilities Leads to Closure of Store Locator Plus Plugin

This entry was posted in Research, Vulnerabilities, WordPress Security on April 26, 2021 by Chloe Chamberland   2 Replies

On March 5, 2021, the Wordfence Threat Intelligence team wrapped up an investigation that led to the discovery of a privilege escalation vulnerability along with several additional vulnerabilities in Store Locator Plus, a WordPress plugin installed on over 9,000 sites. We initially reached out to the plugin’s developer on March 5, 2021. We received no …
Read More

Follow Us

      


Protect your websites with the #1 WordPress Security Plugin

Get Premium
Over 200 million downloads

Wordfence Newsletter

Get WordPress Security Alerts and Product Updates