WordPress Vulnerability Roundup: March , Part 2

WordPress Vulnerability Roundup: March 2020, Part 2

Written by

Michael Moore
on

March 25, 2020

Last Updated On March 25, 2020

New WordPress plugin and theme vulnerabilities were disclosed during the second half of March, so we want to keep you aware. In this post, we cover recent WordPress plugin, theme and core vulnerabilities and what to do if you are running one of the vulnerable plugins or themes on your website.

The WordPress Vulnerability Roundup is divided into four different categories:

  1. WordPress core
  2. WordPress plugins
  3. WordPress themes

WordPress Core Vulnerabilities

There haven’t been any disclosed WordPress vulnerabilities in 2020.

WordPress Plugin Vulnerabilities

Several new WordPress plugin vulnerabilities have been discovered this month so far. Make sure to follow the suggested action below to update the plugin or completely uninstall it.

1 – 7. Multiple Plugins

Remove the plugins,they have been closed on the WordPress.org plugin repository.

8. WordPress File Upload

WordPress Vulnerability Roundup: March 2020, Part 2 1

The vulnerabilities have been patched, and you should update to version 4.13.0.

9. Newsletter

WordPress Vulnerability Roundup: March 2020, Part 2 2

The vulnerabilities have been patched, and you should update to version 6.5.4.

10. LearnPress

WordPress Vulnerability Roundup: March 2020, Part 2 3

The vulnerabilities have been patched, and you should update to version 3.2.6.7.

11. Custom Post Type UI

WordPress Vulnerability Roundup: March 2020, Part 2 4

The vulnerabilities have been patched, and you should update to version 1.7.4.

12. Gutenberg & Elementor Templates Importer For Responsive

WordPress Vulnerability Roundup: March 2020, Part 2 5

The vulnerabilities have been patched, and you should update to version 2.2.6.

13. Advanced Ads – Ad Manager & AdSense

WordPress Vulnerability Roundup: March 2020, Part 2 6

The vulnerabilities have been patched, and you should update to version 1.17.4.

14. Migrate & Backup WordPress – WPvivid Backup Plugin

WordPress Vulnerability Roundup: March 2020, Part 2 7

The vulnerabilities have been patched, and you should update to version 0.9.36.

15. Cookiebot

WordPress Vulnerability Roundup: March 2020, Part 2 8

Cookiebot versions below 3.6.1 have an Authenticated Reflected Cross-Site Scripting vulnerability.

The vulnerabilities have been patched, and you should update to version 3.6.1.

16. Data Tables Generator by Supsystic

WordPress Vulnerability Roundup: March 2020, Part 2 9

Data Tables Generator by Supsystic versions below 1.9.92 have multiple vulnerabilities.

The vulnerabilities have been patched, and you should update to version 1.9.92.

17. product-lister-walmart

WordPress Vulnerability Roundup: March 2020, Part 2 10

Remove the plugin, it has been closed on the WordPress.org plugin repository pending review.

18. All-in-One WP Migration

WordPress Vulnerability Roundup: March 2020, Part 2 11

The vulnerabilities have been patched, and you should update to version 7.15.

WordPress Themes

1. Fruitful

WordPress Vulnerability Roundup: March 2020, Part 2 12

The vulnerabilities have been patched, and you should update to version 3.8.2.

How to Be Proactive About WordPress Theme & Plugin Vulnerabilities

Running outdated software is the number one reason WordPress sites are hacked. It is crucial to the security of your WordPress site that you have an update routine. You should be logging into your sites at least once a week to perform updates.

Automatic Updates Can Help

Automatic updates are a great choice for WordPress websites that don’t change very often. Lack of attention often leaves these sites neglected and vulnerable to attacks. Even with recommended security settings, running vulnerable software on your site can give an attacker an entry point into your site.

Using the iThemes Security Pro plugin’s Version Management feature, you can enable automatic WordPress updates to ensure you are getting the latest security patches. These settings help protect your site with options to automatically update to new versions or to increase user security when the site’s software is outdated.

WordPress Vulnerability Roundup: March 2020, Part 2 13
Version Management Update Options
  • WordPress Updates –Automatically install the latest WordPress release.
  • Plugin Automatic Updates – Automatically install the latest plugin updates. This should be enabled unless you actively maintain this site on a daily basis and install the updates manually shortly after they are released.
  • Theme Automatic Updates – Automatically install the latest theme updates. This should be enabled unless your theme has file customizations.
  • Granular Control over Plugin and Theme updates – You may have plugins/themes that you’d like to either manually update, or delay the update until the release has had time to prove stable. You can choose Custom for the opportunity to assign each plugin or theme to either update immediately (Enable), not update automatically at all (Disable) or update with a delay of a specified amount of days (Delay).
Strengthening and Alerting to Critical Issues
  • Strengthen Site When Running Outdated Software – Automatically add extra protections to the site when an available update has not been installed for a month. The iThemes Security plugin will automatically enable stricter security when an update has not been installed for a month. First, it will force all users that do not have two-factor enabled to provide a login code sent to their email address before logging back in. Second, it will disable the WP File Editor (to block people from editing plugin or theme code), XML-RPC pingbacks, and block multiple authentication attempts per XML-RPC request (both of which will make XML-RPC stronger against attacks without having to turn it off completely).
  • Scan for Other Old WordPress Sites – This will checks for other outdated WordPress installs on your hosting account. A single outdated WordPress site with a vulnerability could allow attackers to compromise all the other sites on the same hosting account.
  • Send Email Notifications – For issues that require intervention, an email is sent to admin-level users.

Managing Multiple WP Sites? Update Plugins, Themes & Core At Once from the iThemes Sync Dashboard

WordPress Vulnerability Roundup: March 2020, Part 2 14

iThemes Sync is our central dashboard to help you manage multiple WordPress sites. From the Sync dashboard, you can view available updates for all your sites and then update plugins, themes, and WordPress core with one click. You can also get daily email notifications when a new version update is available.

WordPress Vulnerability Roundup: March 2020, Part 2 15

Try Sync FREE for 30 daysLearn more

A WordPress Security Plugin Can Help Secure Your Website

iThemes Security Pro, our WordPress security plugin, offers 30+ ways to secure and protect your website from common WordPress security vulnerabilities. With WordPress, two-factor authentication, brute force protection, strong password enforcement, and more, you can add an extra layer of security to your website.

Learn more about WordPress security with 10 key tips. Download the ebook now: A Guide to WordPress Security

Keep reading the article at WordPress News and Updates from iThemes – iThemes. The article was originally written by Michael Moore on 2020-03-25 10:00:58.

The article was hand-picked and curated for you by the Editorial Team of WP Archives.

Disclosure: Some of the links in this post are "affiliate links." This means if you click on the link and purchase the product, We may receive an affiliate commission.

Leave a Comment

Your email address will not be published. Required fields are marked *

WordPress Vulnerability Roundup: March , Part 1

WordPress Vulnerability Roundup: March 2020, Part 1

Written by

Michael Moore
on

March 11, 2020

Last Updated On March 11, 2020

New WordPress plugin and theme vulnerabilities were disclosed during the first half of March, so we want to keep you aware. In this post, we cover recent WordPress plugin, theme and core vulnerabilities and what to do if you are running one of the vulnerable plugins or themes on your website.

The WordPress Vulnerability Roundup is divided into four different categories:

  1. WordPress core
  2. WordPress plugins
  3. WordPress themes

WordPress Core Vulnerabilities

There haven’t been any disclosed WordPress vulnerabilities in 2020.

WordPress Plugin Vulnerabilities

Several new WordPress plugin vulnerabilities have been discovered this month so far. Make sure to follow the suggested action below to update the plugin or completely uninstall it.

1. Pricing Table by Supsystic

The vulnerabilities have been patched, and you should update to version 1.8.2.

2. Flexible Checkout Fields for WooCommerce

WordPress Vulnerability Roundup: March 2020, Part 1 16

Flexible Checkout Fields for WooCommerce versions 2.3.1 and below have an Unauthenticated Settings Update vulnerability. The plugin was being active exploited in the wiled, and injecting malicious scripts into WooCommerce checkout pages.

The vulnerability has been patched, and you should update to version 2.3.2.

3. Export Users

WordPress Vulnerability Roundup: March 2020, Part 1 17

The plugin is closed on the WordPress.org plugin repository and should be removed.

4. Hero Maps

WordPress Vulnerability Roundup: March 2020, Part 1 18

The vulnerability has been patched, and you should update to version 2.2.3.

5. CardGate Payments for WooCommerce

WordPress Vulnerability Roundup: March 2020, Part 1 19

The vulnerability has been patched, and you should update to version 3.1.16.

6. Async JavaScript

WordPress Vulnerability Roundup: March 2020, Part 1 20

Async JavaScript versions 2.19.07.14 and below have an Unauthenticated Stored Cross-Site Scripting vulnerability.

The vulnerability has been patched, and you should update to version 2.20.02.27.

7. 10Web Map Builder for Google Maps

WordPress Vulnerability Roundup: March 2020, Part 1 21

The vulnerability has been patched, and you should update to version 1.0.64.

8. Modern Events Calendar Lite

WordPress Vulnerability Roundup: March 2020, Part 1 22

The vulnerability has been patched, and you should update to version 5.1.7.

9. Appointment Booking Calendar

WordPress Vulnerability Roundup: March 2020, Part 1 23

The vulnerability has been patched, and you should update to version 1.3.35.

10. WPForms

WordPress Vulnerability Roundup: March 2020, Part 1 24

The vulnerability has been patched, and you should update to version 1.5.9.

11. WordPress WP-Advanced-Search

WordPress Vulnerability Roundup: March 2020, Part 1 25

The vulnerability has been patched, and you should update to version 3.3.4.

12. Registration Magic

WordPress Vulnerability Roundup: March 2020, Part 1 26

The vulnerability has been patched, and you should update to version 4.6.0.4.

13. Brizy – Page Builder

WordPress Vulnerability Roundup: March 2020, Part 1 27

The vulnerability has been patched, and you should update to version 1.0.114.

14. Custom Searchable Data Entry System

WordPress Vulnerability Roundup: March 2020, Part 1 28

A security patch hasn’t been released and you should remove the plugin.

15. WP Security Audit Log

WordPress Vulnerability Roundup: March 2020, Part 1 29

The vulnerability has been patched, and you should update to version 4.0.2.

WordPress Themes

There haven’t been any disclosed Theme vulnerabilities in March 2020.

How to Be Proactive About WordPress Theme & Plugin Vulnerabilities

Running outdated software is the number one reason WordPress sites are hacked. It is crucial to the security of your WordPress site that you have an update routine. You should be logging into your sites at least once a week to perform updates.

Automatic Updates Can Help

Automatic updates are a great choice for WordPress websites that don’t change very often. Lack of attention often leaves these sites neglected and vulnerable to attacks. Even with recommended security settings, running vulnerable software on your site can give an attacker an entry point into your site.

Using the iThemes Security Pro plugin’s Version Management feature, you can enable automatic WordPress updates to ensure you are getting the latest security patches. These settings help protect your site with options to automatically update to new versions or to increase user security when the site’s software is outdated.

WordPress Vulnerability Roundup: March 2020, Part 1 30
Version Management Update Options
  • WordPress Updates –Automatically install the latest WordPress release.
  • Plugin Automatic Updates – Automatically install the latest plugin updates. This should be enabled unless you actively maintain this site on a daily basis and install the updates manually shortly after they are released.
  • Theme Automatic Updates – Automatically install the latest theme updates. This should be enabled unless your theme has file customizations.
  • Granular Control over Plugin and Theme updates – You may have plugins/themes that you’d like to either manually update, or delay the update until the release has had time to prove stable. You can choose Custom for the opportunity to assign each plugin or theme to either update immediately (Enable), not update automatically at all (Disable) or update with a delay of a specified amount of days (Delay).
Strengthening and Alerting to Critical Issues
  • Strengthen Site When Running Outdated Software – Automatically add extra protections to the site when an available update has not been installed for a month. The iThemes Security plugin will automatically enable stricter security when an update has not been installed for a month. First, it will force all users that do not have two-factor enabled to provide a login code sent to their email address before logging back in. Second, it will disable the WP File Editor (to block people from editing plugin or theme code), XML-RPC pingbacks, and block multiple authentication attempts per XML-RPC request (both of which will make XML-RPC stronger against attacks without having to turn it off completely).
  • Scan for Other Old WordPress Sites – This will checks for other outdated WordPress installs on your hosting account. A single outdated WordPress site with a vulnerability could allow attackers to compromise all the other sites on the same hosting account.
  • Send Email Notifications – For issues that require intervention, an email is sent to admin-level users.

Managing Multiple WP Sites? Update Plugins, Themes & Core At Once from the iThemes Sync Dashboard

WordPress Vulnerability Roundup: March 2020, Part 1 31

iThemes Sync is our central dashboard to help you manage multiple WordPress sites. From the Sync dashboard, you can view available updates for all your sites and then update plugins, themes, and WordPress core with one click. You can also get daily email notifications when a new version update is available.

WordPress Vulnerability Roundup: March 2020, Part 1 32

Try Sync FREE for 30 daysLearn more

A WordPress Security Plugin Can Help Secure Your Website

iThemes Security Pro, our WordPress security plugin, offers 30+ ways to secure and protect your website from common WordPress security vulnerabilities. With WordPress, two-factor authentication, brute force protection, strong password enforcement, and more, you can add an extra layer of security to your website.

Learn more about WordPress security with 10 key tips. Download the ebook now: A Guide to WordPress Security

Keep reading the article at WordPress News and Updates from iThemes – iThemes. The article was originally written by Michael Moore on 2020-03-11 12:45:08.

The article was hand-picked and curated for you by the Editorial Team of WP Archives.

Disclosure: Some of the links in this post are "affiliate links." This means if you click on the link and purchase the product, We may receive an affiliate commission.

Leave a Comment

Your email address will not be published. Required fields are marked *

Show Your ❤️ Love! Like Us
Scroll to Top