WordPress Vulnerability Roundup: December 2019, Part 1

WordPress
WordPress Vulnerability Roundup: December 2019, Part 1

Remove Scountet Kalendar as it appears the plugin has been abandoned.

The vulnerability has been patched, and you should update it to version 1.6.90.

2. Materialis

Materialis versions 1.0.172 and below have an Authenticated Options Update vulnerability.

What You Should Do

The vulnerability has been patched, and you should update it to version 1.0.173.

4. Superlist

Superlist Logo

Superlist versions 2.9.2 and below are vulnerable to a Stored Cross-Site Scripting attack.

What You Should Do

The vulnerability hasn’t been patched, and you should remove the theme. Keep an eye on the changelog for a security update.

How to Be Proactive About WordPress Theme & Plugin Vulnerabilities

Running outdated software is the number one reason WordPress sites are hacked. It is crucial to the security of your WordPress site that you have an update routine. You should be logging into your sites at least once a week to perform updates.

Automatic Updates Can Help

Automatic updates are a great choice for WordPress websites that don’t change very often. Lack of attention often leaves these sites neglected and vulnerable to attacks. Even with recommended security settings, running vulnerable software on your site can give an attacker an entry point into your site.

Using the iThemes Security Pro plugin’s Version Management feature, you can enable automatic WordPress updates to ensure you are getting the latest security patches. These settings help protect your site with options to automatically update to new versions or to increase user security when the site’s software is outdated.

WordPress Vulnerability Roundup: December 2019, Part 1 1

Version Management Update Options
  • WordPress Updates –Automatically install the latest WordPress release.
  • Plugin Automatic Updates – Automatically install the latest plugin updates. This should be enabled unless you actively maintain this site on a daily basis and install the updates manually shortly after they are released.
  • Theme Automatic Updates – Automatically install the latest theme updates. This should be enabled unless your theme has file customizations.
  • Granular Control over Plugin and Theme updates – You may have plugins/themes that you’d like to either manually update, or delay the update until the release has had time to prove stable. You can choose Custom for the opportunity to assign each plugin or theme to either update immediately (Enable), not update automatically at all (Disable) or update with a delay of a specified amount of days (Delay).
Strengthening and Alerting to Critical Issues
  • Strengthen Site When Running Outdated Software – Automatically add extra protections to the site when an available update has not been installed for a month. The iThemes Security plugin will automatically enable stricter security when an update has not been installed for a month. First, it will force all users that do not have two-factor enabled to provide a login code sent to their email address before logging back in. Second, it will disable the WP File Editor (to block people from editing plugin or theme code), XML-RPC pingbacks, and block multiple authentication attempts per XML-RPC request (both of which will make XML-RPC stronger against attacks without having to turn it off completely).
  • Scan for Other Old WordPress Sites – This will checks for other outdated WordPress installs on your hosting account. A single outdated WordPress site with a vulnerability could allow attackers to compromise all the other sites on the same hosting account.
  • Send Email Notifications – For issues that require intervention, an email is sent to admin-level users.

Managing Multiple WP Sites? Update Plugins, Themes & Core At Once from the iThemes Sync Dashboard

WordPress Vulnerability Roundup: December 2019, Part 1 2

iThemes Sync is our central dashboard to help you manage multiple WordPress sites. From the Sync dashboard, you can view available updates for all your sites and then update plugins, themes, and WordPress core with one click. You can also get daily email notifications when a new version update is available.

WordPress Vulnerability Roundup: December 2019, Part 1 3

Breaches From Around the Web

We include breaches from around the web because it is essential to also be aware of vulnerabilities outside of the WordPress ecosystem. Exploits to server software can expose sensitive data. Database breaches can expose the credentials for the users on your site, opening the door for attackers to access your site.

1. Ring Camera Hacks

Ring Indoor Camera

Unfortunately, some families are reporting episodes of harassment after their Ring devices were hacked. If you are using any security camera that allows you to remotely view a live feed, you should know how hackers are breaking into Ring Cameras.

According to a Ring spokesperson, these reports of hacks were isolated and weren’t related to hacked or breached of Ring Security. That is excellent news, and it means the likely culprit of the hacks were weak passwords and not using 2FA.  A brute force attack, when a malicious bot tries a random combination of usernames and passwords until one is successful, and they can gain access to your account.

Luckily for us, it is pretty easy to protect your accounts from a brute force attack. According to Google security researches say that using two-factor authentication will stop 100% of bot attacks If you are installing an IoT device–especially one that allows you to see and hear what is happening inside your house–make sure you protect you and your family by using a strong password and two-factor authentication.

Summary of WordPress Vulnerabilities for
December 2019, Part 1

Core

These vulnerabilities have been patched, and you should update it to version 5.3.1.

Plugins

The vulnerability has been patched, and you should update it to version 7.1.10.

The vulnerability has been patched, and you should update it to version 1.24.1.

The vulnerability has been patched, and you should update it to version 1.20.1.

The vulnerability has been patched, and you should update it to version 4.07.

You should remove the Scountet Kalendar. It appears the plugin has been abandoned and is no longer being maintained.

The vulnerability has been patched, and you should update it to version 1.4.

Themes

The vulnerability has been patched, and you should update it to version 1.6.90.

The vulnerability has been patched, and you should update it to version 1.0.173.

The vulnerability has been patched, and you should update it to version 2.0.14.5.

The vulnerability has been patched, and you should update it to version 1.0.173.

A WordPress Security Plugin Can Help Secure Your Website

iThemes Security Pro, our WordPress security plugin, offers 30+ ways to secure and protect your website from common WordPress security vulnerabilities. With WordPress, two-factor authentication, brute force protection, strong password enforcement, and more, you can add an extra layer of security to your website.

Get iThemes Security

Keep reading the article at WordPress News and Updates from iThemes – iThemes. The article was originally written by Michael Moore on 2019-12-13 10:37:58.

The article was hand-picked and curated for you by the Editorial Team of WP Archives.

Disclosure: Some of the links in this post are "affiliate links." This means if you click on the link and purchase the product, We may receive an affiliate commission.

Related Posts

Leave a Comment

Your email address will not be published. Required fields are marked *

WordPress Vulnerability Roundup: February , Part 2

WordPress
WordPress Vulnerability Roundup: February 2020, Part 2

New WordPress plugin and theme vulnerabilities were disclosed during the second half of February, so we want to keep you aware. In this post, we cover recent WordPress plugin, theme and core vulnerabilities and what to do if you are running one of the vulnerable plugins or themes on your website.

The WordPress Vulnerability Roundup is divided into four different categories:

  1. WordPress core
  2. WordPress plugins
  3. WordPress themes

WordPress Core Vulnerabilities

There haven’t been any disclosed WordPress vulnerabilities in 2020.

WordPress Plugin Vulnerabilities

Several new WordPress plugin vulnerabilities have been discovered this month so far. Make sure to follow the suggested action below to update the plugin or completely uninstall it.

1. Ninja Forms

The vulnerabilities have been patched, and you should update to version 3.4.23.

2. ThemeGrill Demo Importer

WordPress Vulnerability Roundup: February 2020, Part 2 4

The vulnerability has been patched, and you should update to version 1.6.2.

3. SAML SP Single Sign On

WordPress Vulnerability Roundup: February 2020, Part 2 5

The vulnerability has been patched, and you should update to version 4.8.84.

4. wpCentral

WordPress Vulnerability Roundup: February 2020, Part 2 6

The vulnerability has been patched, and you should update to version 1.5.2.

5. ThemeREX Addons

WordPress Vulnerability Roundup: February 2020, Part 2 7

ThemRex Addons versions 1.6.50 and higher have a Remote Code Execution vulnerability that is being actively exploited.

Remove the plugin until a patch is released.

6. Modula Image Gallery

WordPress Vulnerability Roundup: February 2020, Part 2 8

The vulnerability has been patched, and you should update to version 2.2.5.

7. Duplicator

WordPress Vulnerability Roundup: February 2020, Part 2 9

The vulnerability has been patched, and you should update to version 1.3.28.

8. Chained Quiz

WordPress Vulnerability Roundup: February 2020, Part 2 10

The vulnerability has been patched, and you should update to version 1.1.9.1.

9. RegistrationMagic

WordPress Vulnerability Roundup: February 2020, Part 2 11

The vulnerabilities have been patched, and you should update to version 4.6.0.3.

10. Ultimate Membership Pro

WordPress Vulnerability Roundup: February 2020, Part 2 12

Ultimate Membership Pro below version 8.7 have Cross-Site Scripting and Cross-Site Request Forgery vulnerabilities.

The vulnerability has been patched, and you should update to version 8.7.

11. Photo Gallery by 10Web

WordPress Vulnerability Roundup: February 2020, Part 2 13

The vulnerability has been patched, and you should update to version 1.5.46.

12. Envira Photo Gallery

WordPress Vulnerability Roundup: February 2020, Part 2 14

The vulnerability has been patched, and you should update to version 1.6.2.

13. iThemes Sync Pro

WordPress Vulnerability Roundup: February 2020, Part 2 15

iThemes Sync Pro versions 2.1.3 and below are missing a nonce in an authentication request.

The vulnerability has been patched, and you should update to version 2.1.3

WordPress Themes

1. Fruitful

WordPress Vulnerability Roundup: February 2020, Part 2 16

Fruitful theme versions 3.8 and below are vulnerable to an Unauthenticated Reflected Cross-Site Scripting attack.

Remove the theme.The vulernability has been reported without a response from the theme developer.

How to Be Proactive About WordPress Theme & Plugin Vulnerabilities

Running outdated software is the number one reason WordPress sites are hacked. It is crucial to the security of your WordPress site that you have an update routine. You should be logging into your sites at least once a week to perform updates.

Automatic Updates Can Help

Automatic updates are a great choice for WordPress websites that don’t change very often. Lack of attention often leaves these sites neglected and vulnerable to attacks. Even with recommended security settings, running vulnerable software on your site can give an attacker an entry point into your site.

Using the iThemes Security Pro plugin’s Version Management feature, you can enable automatic WordPress updates to ensure you are getting the latest security patches. These settings help protect your site with options to automatically update to new versions or to increase user security when the site’s software is outdated.

WordPress Vulnerability Roundup: February 2020, Part 2 17
Version Management Update Options
  • WordPress Updates –Automatically install the latest WordPress release.
  • Plugin Automatic Updates – Automatically install the latest plugin updates. This should be enabled unless you actively maintain this site on a daily basis and install the updates manually shortly after they are released.
  • Theme Automatic Updates – Automatically install the latest theme updates. This should be enabled unless your theme has file customizations.
  • Granular Control over Plugin and Theme updates – You may have plugins/themes that you’d like to either manually update, or delay the update until the release has had time to prove stable. You can choose Custom for the opportunity to assign each plugin or theme to either update immediately (Enable), not update automatically at all (Disable) or update with a delay of a specified amount of days (Delay).
Strengthening and Alerting to Critical Issues
  • Strengthen Site When Running Outdated Software – Automatically add extra protections to the site when an available update has not been installed for a month. The iThemes Security plugin will automatically enable stricter security when an update has not been installed for a month. First, it will force all users that do not have two-factor enabled to provide a login code sent to their email address before logging back in. Second, it will disable the WP File Editor (to block people from editing plugin or theme code), XML-RPC pingbacks, and block multiple authentication attempts per XML-RPC request (both of which will make XML-RPC stronger against attacks without having to turn it off completely).
  • Scan for Other Old WordPress Sites – This will checks for other outdated WordPress installs on your hosting account. A single outdated WordPress site with a vulnerability could allow attackers to compromise all the other sites on the same hosting account.
  • Send Email Notifications – For issues that require intervention, an email is sent to admin-level users.

Managing Multiple WP Sites? Update Plugins, Themes & Core At Once from the iThemes Sync Dashboard

WordPress Vulnerability Roundup: February 2020, Part 2 18

iThemes Sync is our central dashboard to help you manage multiple WordPress sites. From the Sync dashboard, you can view available updates for all your sites and then update plugins, themes, and WordPress core with one click. You can also get daily email notifications when a new version update is available.

WordPress Vulnerability Roundup: February 2020, Part 2 19

Try Sync FREE for 30 daysLearn more

A WordPress Security Plugin Can Help Secure Your Website

iThemes Security Pro, our WordPress security plugin, offers 30+ ways to secure and protect your website from common WordPress security vulnerabilities. With WordPress, two-factor authentication, brute force protection, strong password enforcement, and more, you can add an extra layer of security to your website.

Learn more about WordPress security with 10 key tips. Download the ebook now: A Guide to WordPress Security

Keep reading the article at WordPress News and Updates from iThemes – iThemes. The article was originally written by Michael Moore on 2020-02-26 10:04:40.

The article was hand-picked and curated for you by the Editorial Team of WP Archives.

Disclosure: Some of the links in this post are "affiliate links." This means if you click on the link and purchase the product, We may receive an affiliate commission.

Related Posts

Leave a Comment

Your email address will not be published. Required fields are marked *

WordPress Vulnerability Roundup: January , Part 2

WordPress
WordPress Vulnerability Roundup: January 2020, Part 2

New WordPress plugin and theme vulnerabilities were disclosed during the second half of January, so we want to keep you aware. In this post, we cover recent WordPress plugin, theme and core vulnerabilities and what to do if you are running one of the vulnerable plugins or themes on your website.

The WordPress Vulnerability Roundup is divided into four different categories:

  • 1. WordPress core
  • 2. WordPress plugins
  • 3. WordPress themes
  • 4. Breaches from around the web

WordPress Core Vulnerabilities

There haven’t been any disclosed WordPress vulnerabilities in January of 2020.

WordPress Plugin Vulnerabilities

Several new WordPress plugin vulnerabilities have been discovered this month so far. Make sure to follow the suggested action below to update the plugin or completely uninstall it.

1. Code Snippets

Code Snippets versions 2.13.3 and below have a Cross-Site Request Forgery vulnerability that can lead to a Remote Code Execution attack.

What You Should Do

The vulnerabilities have been patched, so you should update to version 2.14.0.

2. WP Database Reset

WP Database Reset Logo

WP Database Reset versions 3.1 and below have two vulnerabilities. The first vulnerability would all an unauthenticated user to reset any database table to the initial WordPress set-up state. The second vulnerability would allow any user to grant their account administrative privileges and drop other users from the table.

What You Should Do

The vulnerabilities have been patched, so you should update to version 3.15.

3. Chained Quiz

Chained Quiz Logo

Chained Quiz versions 1.1.8 and below are vulnerable to an Unauthenticated Reflected XSS attack.

What You Should Do

The vulnerability has been patched, so you should update to version 1.1.8.2.

4. Resim Ara

Resim Ara Logo

Resim Ara version 3.0 and below are vulnerable to an Unauthenticated Reflected XSS attack.

What You Should Do

WordPress.org closed Resim Ara on January 17, 2020, so you should remove the plugin and find a replacement.

5. Marketo Forms and Tracking

Marketo Forms and Tracking Logo

Marketo Forms and Tracking version 3.2.2 and below are vulnerable to a Cross-Site Scripting attack that could lead to Cross-Site Request Forgery due to a lack of CRSF checks and sanitization.

What You Should Do

WordPress.org closed Marketo Forms and Tracking on December 11, 2019, so you should remove the plugin and find a replacement.

6. Contextual Adminbar Color

Contextual Adminbar Color Logo

Contextual Adminbar Color versions 0.2 and below have an Authenticated Stored Cross-Site Scripting vulnerability.

What You Should Do

The vulnerability has been patched, and you should update it to version 0.3.

7. 2J SlideShow

2J SlideShow Logo

2J SlideShow versions 1.3.33 and below have authenticated arbitrary plugin deactivation vulnerability that will allow a user with minimal privileges–like a Subscriber–to disable any plugin installed on the site.

What You Should Do

The vulnerability has been patched, and you should update it to version 1.3.40.

8. Chatbot with IBM Watson

Chatbot with IBM Watson Logo

Chatbot with IBM Watson versions 0.8.20 and below includes DOM-based XSS vulnerability that will allow a remote attacker to execute JavaScript in the victim’s browser by tricking the victim into pasting HTML inside the chatbox.

What You Should Do

The vulnerability has been patched, so you should update to version 0.8.21.

9. WP Accessibility

WP Accessibility Logo

WP Accessibility versions 1.6.10 and below have a minor Authenticated Stored Cross-Site Scripting vulnerability in the “Styles for Skiplinks when they have focus” section of the WP Accessibility plugin.

What You Should Do

The vulnerability has been patched, so you should update to version 1.7.0.

10. AccessAlly

AcessAlly Logo

AccessAlly versions below 3.3.2 have an Arbitrary PHP Execution vulnerability. The vulnerability allows an attacker to execute PHP code using the Login Widget. The vulnerability has been exploited out in the wild.

What You Should Do

The vulnerability has been patched, so you should update to version 3.3.2.

11. Ultimate Member

Ultimate Member Logo

Ultimate Member versions 2.1.2 and below have an Insecure Direct Object Reference that would allow an attacker to change other user’s profiles and cover photos

What You Should Do

The vulnerability has been patched, so you should update to version 2.1.3.

12. WP DS FAQ Plus

WP DS FAQ Plus Logo

WP DS FAQ Plus versions 1.4.1 and below are vulnerable to a Stored Cross-Site Scripting attack.

What You Should Do

The vulnerability has been patched, so you should update to version 1.4.2.

13. wpCentral

wpCentral

wpCentral versions 1.4.7 and below have a Privilege Escalation vulnerability that will allow any logged in user to increase their privileges. If you allow anyone to register and create a user on your site, an attacker could create a new user with the subscriber user role and then give themselves admin privileges.

What You Should Do

The vulnerability has been patched, so you should update to version 1.4.8.

14. WPS Hide Login

WPS Hide Login Logo

WPS Hide Login versions 1.5.4.2 and below had a vulnerability that would allow an attacker to bypass the secret login. If in 2020 you are still using a custom login URL as a security strategy, please check out our 5 Simple Rules for WordPress Login Security.

What You Should Do

The vulnerability has been patched, so you should update to version 1.5.5.

15. Contact Form Clean and Simple

Contact Form Clean and Simple

Contact Form Clean and Simple versions 4.7.0 and below have Stored Cross-Site Forgery vulnerability that would allow a user with admin capabilities to submit malicious code through the plugin’s options. The malicious code would then be executed on every page with the contact form.

What You Should Do

WordPress.org closed Contact Form Clean and Simple on January 23, 2020, so you should remove the plugin and find a replacement.

16. Calculated Fields Form

Calculated Fields Form Logo

Calculated Fields Form versions 1.0.353 and below have an Authenticated Stored Cross-Site Scripting vulnerability. The vulnerability will allow an authenticated user with access to edit or create Calculated Fields Form content to inject javascript into input fields such as ‘field name’ and ‘form name.

What You Should Do

The vulnerability has been patched, so you should update to version 1.0.354.

17. Flamingo

Flamingo Logo

Flamingo versions 2.1 and below have a CSV Injection vulnerability. The vulnerability will allow users with low-level privileges to inject OS command that will be included in the exported CSV file, which could lead to malicious code execution.

What You Should Do

The vulnerability has been patched, so you should update to version 2.1.1.

1. CarSpot

CarSpot Logo

CarSpot versions 2.2.0 and below have multiple vulnerabilities, including 2 separate Authenticated Persistent Cross-Site Scripting vulnerabilities and an Insecure Direct Object Reference vulnerability.

What You Should Do

The vulnerability has been patched, so you should update to version 2.2.1.

2. Houzez – Real Estate

Houzez - Real Estate Logo

Houzez – Real Estate versions 1.8.3.1 and below have an Unauthenticated Cross-Site Scripting vulnerability.

What You Should Do

The vulnerability has been patched, so you should update to version 1.8.4.

How to Be Proactive About WordPress Theme & Plugin Vulnerabilities

Running outdated software is the number one reason WordPress sites are hacked. It is crucial to the security of your WordPress site that you have an update routine. You should be logging into your sites at least once a week to perform updates.

How Automatic Updates Can Help

Automatic updates are a great choice for WordPress websites that don’t change very often. Lack of attention often leaves these sites neglected and vulnerable to attacks. Even with recommended security settings, running vulnerable software on your site can give an attacker an entry point into your site.

Using the iThemes Security Pro plugin’s Version Management feature, you can enable automatic WordPress updates to ensure you are getting the latest security patches. These settings help protect your site with options to automatically update to new versions or to increase user security when the site’s software is outdated.

WordPress Vulnerability Roundup: January 2020, Part 2 20

Version Management Update Options
  • WordPress Updates –Automatically install the latest WordPress release.
  • Plugin Automatic Updates – Automatically install the latest plugin updates. This should be enabled unless you actively maintain this site on a daily basis and install the updates manually shortly after they are released.
  • Theme Automatic Updates – Automatically install the latest theme updates. This should be enabled unless your theme has file customizations.
  • Granular Control over Plugin and Theme updates – You may have plugins/themes that you’d like to either manually update, or delay the update until the release has had time to prove stable. You can choose Custom for the opportunity to assign each plugin or theme to either update immediately (Enable), not update automatically at all (Disable) or update with a delay of a specified amount of days (Delay).
Strengthening and Alerting to Critical Issues
  • Strengthen Site When Running Outdated Software – Automatically add extra protections to the site when an available update has not been installed for a month. The iThemes Security plugin will automatically enable stricter security when an update has not been installed for a month. First, it will force all users that do not have two-factor enabled to provide a login code sent to their email address before logging back in. Second, it will disable the WP File Editor (to block people from editing plugin or theme code), XML-RPC pingbacks, and block multiple authentication attempts per XML-RPC request (both of which will make XML-RPC stronger against attacks without having to turn it off completely).
  • Scan for Other Old WordPress Sites – This will checks for other outdated WordPress installs on your hosting account. A single outdated WordPress site with a vulnerability could allow attackers to compromise all the other sites on the same hosting account.
  • Send Email Notifications – For issues that require intervention, an email is sent to admin-level users.

Managing Multiple WP Sites? Update Plugins, Themes & WP Core Across Multiple Sites at Once from the iThemes Sync Dashboard

WordPress Vulnerability Roundup: January 2020, Part 2 21

iThemes Sync is our central dashboard to help you manage multiple WordPress sites. From the Sync dashboard, you can view available updates for all your sites and then update plugins, themes, and WordPress core with one click. You can also get daily email notifications when a new version update is available.

WordPress Vulnerability Roundup: January 2020, Part 2 22
Try Sync FREE for 30 daysLearn more

Breaches From Around the Web

We include breaches from around the web because it is essential to also be aware of vulnerabilities outside of the WordPress ecosystem. Exploits to server software can expose sensitive data. Database breaches can expose the credentials for the users on your site, opening the door for attackers to access your site.

1. Zoom

Zoom Logo

Zoom fixed a flaw that could open meetings to hackers. Every Zoom meeting is assigned a randomly generated 9-10 digit meeting ID. Check Point security researchers were able to correctly guess some meetings IDs and successfully join some Zoom calls.

Check Point disclosed the vulnerability to Zoom fixed the flaw by making replacing randomized generation of meeting ID numbers with a cryptographically strong ID, added more digits to meeting ID numbers, and made password requirements the default option changed scheduled

A WordPress Security Plugin Can Help Secure Your Website

iThemes Security Pro, our WordPress security plugin, offers 30+ ways to secure and protect your website from common WordPress security vulnerabilities. With WordPress, two-factor authentication, brute force protection, strong password enforcement, and more, you can add an extra layer of security to your website.

Learn more about WordPress security with 10 key tips. Download the ebook now: A Guide to WordPress Security

Get iThemes Security

Keep reading the article at WordPress News and Updates from iThemes – iThemes. The article was originally written by Michael Moore on 2020-01-29 11:37:38.

The article was hand-picked and curated for you by the Editorial Team of WP Archives.

Disclosure: Some of the links in this post are "affiliate links." This means if you click on the link and purchase the product, We may receive an affiliate commission.

Related Posts

Leave a Comment

Your email address will not be published. Required fields are marked *

WordPress Vulnerability Roundup: January , Part 1

WordPress
WordPress Vulnerability Roundup: January 2020, Part 1

TownHub versions 1.0.5 and below have multiple vulnerabilities including, an Unauthenticated Reflected XSS, an Authenticated Persistent XSS, and an Insecure Direct Object Reference.

The vulnerability has been patched, and you should update it to version 1.0.6.

6. CityBook

CityBook versions 2.9.4 and below have multiple vulnerabilities including, an Unauthenticated Reflected XSS, an Authenticated Persistent XSS, and an Insecure Direct Object Reference.

What You Should Do

The vulnerability has been patched, and you should update it to version 2.9.5.

7. Real Estate 7

Real Estate 7 Logo

Real Estate 7 versions 2.3.3 and below have multiple vulnerabilities including, an Unauthenticated Reflected XSS, an Authenticated Persistent XSS, and an Insecure Direct Object Reference.

What You Should Do

The vulnerability has been patched, and you should update it to version 2.3.4.

How to Be Proactive About WordPress Theme & Plugin Vulnerabilities

Running outdated software is the number one reason WordPress sites are hacked. It is crucial to the security of your WordPress site that you have an update routine. You should be logging into your sites at least once a week to perform updates.

Automatic Updates Can Help

Automatic updates are a great choice for WordPress websites that don’t change very often. Lack of attention often leaves these sites neglected and vulnerable to attacks. Even with recommended security settings, running vulnerable software on your site can give an attacker an entry point into your site.

Using the iThemes Security Pro plugin’s Version Management feature, you can enable automatic WordPress updates to ensure you are getting the latest security patches. These settings help protect your site with options to automatically update to new versions or to increase user security when the site’s software is outdated.

WordPress Vulnerability Roundup: January 2020, Part 1 23

Version Management Update Options
  • WordPress Updates –Automatically install the latest WordPress release.
  • Plugin Automatic Updates – Automatically install the latest plugin updates. This should be enabled unless you actively maintain this site on a daily basis and install the updates manually shortly after they are released.
  • Theme Automatic Updates – Automatically install the latest theme updates. This should be enabled unless your theme has file customizations.
  • Granular Control over Plugin and Theme updates – You may have plugins/themes that you’d like to either manually update, or delay the update until the release has had time to prove stable. You can choose Custom for the opportunity to assign each plugin or theme to either update immediately (Enable), not update automatically at all (Disable) or update with a delay of a specified amount of days (Delay).
Strengthening and Alerting to Critical Issues
  • Strengthen Site When Running Outdated Software – Automatically add extra protections to the site when an available update has not been installed for a month. The iThemes Security plugin will automatically enable stricter security when an update has not been installed for a month. First, it will force all users that do not have two-factor enabled to provide a login code sent to their email address before logging back in. Second, it will disable the WP File Editor (to block people from editing plugin or theme code), XML-RPC pingbacks, and block multiple authentication attempts per XML-RPC request (both of which will make XML-RPC stronger against attacks without having to turn it off completely).
  • Scan for Other Old WordPress Sites – This will checks for other outdated WordPress installs on your hosting account. A single outdated WordPress site with a vulnerability could allow attackers to compromise all the other sites on the same hosting account.
  • Send Email Notifications – For issues that require intervention, an email is sent to admin-level users.

Managing Multiple WP Sites? Update Plugins, Themes & Core At Once from the iThemes Sync Dashboard

WordPress Vulnerability Roundup: January 2020, Part 1 24

iThemes Sync is our central dashboard to help you manage multiple WordPress sites. From the Sync dashboard, you can view available updates for all your sites and then update plugins, themes, and WordPress core with one click. You can also get daily email notifications when a new version update is available.

WordPress Vulnerability Roundup: January 2020, Part 1 25
Try Sync FREE for 30 daysLearn more

Breaches From Around the Web

We include breaches from around the web because it is essential to also be aware of vulnerabilities outside of the WordPress ecosystem. Exploits to server software can expose sensitive data. Database breaches can expose the credentials for the users on your site, opening the door for attackers to access your site.

1. NSA Discovers Vulnerability in Windows 10

Windows 10 Logo

The NSA found a dangerous Microsoft software flaw, so be sure you have the latest Windows Security Patch. The vulnerability is related to the Windows crypt32.dll, which handles certificates and cryptographic messaging functions. If exploited, a hacker could use the vulnerability to forge digital signatures.

Summary of WordPress Vulnerabilities for January 2020, Part 1

Core

No WordPress Core vulnerabilities were disclosed in the first half of January 2020.

Plugins

The vulnerability has been patched, and you should update it to version 7.1.2.

The vulnerability has been patched, and you should update it to version 6.3.5.

The vulnerability has been patched, and you should update it to version 2.45.

The vulnerability has been patched, and you should update it to version 3.2.3.

The vulnerability has been patched, and you should update it to version 2.7.8.

bbPress Members Only versions 1.2.1 and below is vulnerable to a Cross-Site Request Forgery attack on the plugins Optional Settings page.

The vulnerability has been patched, and you should update it to version 1.3.1.

The vulnerability has been patched, and you should update it to version 2.8.5.

The vulnerability has been patched, and you should update it to version 4.0.3.

The vulnerability has been patched, and you should update it to version 2.0.7.

The vulnerability has been patched, and you should update it to version 2.17.

The vulnerability has been patched, and you should update it to version 2.0.5.

Postie versions 1.9.40 and below have a Post Spoofing and Stored XSS vulnerability that can lead to an unauthenticated user publishing a new post. This is a zero-day vulnerability and anyone can easily find instructions on exploiting the Postie plugin.

WordPress.org closed Postie on January 8th, 2019, so I would suggest removing the plugin and finding a replacement.

The vulnerability has been patched, and you should update it to version 1.15.0.1.

Ultimate FAQ versions 1.8.29 and below have an Unauthenticated Reflected XSS vulnerability. The FAQ shortcode does not sanitize the Display_FAQ GET parameter, which can lead to a Reflected Cross-Site Scripting attack on pages where the shortcode is displayed.

The vulnerability has been patched, and you should update it to version 1.8.30.

The vulnerability has been patched, and you should update it to version 0.3.7.

The vulnerability has been patched, and you should update it to version 1.21.16.

The vulnerability has been patched, and you should update it to version 1.9.4.5.

The vulnerability has been patched, and you should update it to version 4.0.6.

The vulnerability has been patched, and you should update it to version 2.4.

The vulnerability has been patched, and you should update it to version 5.8.0.

The vulnerability has been patched, and you should update it to version 1.1.4.

The vulnerability has been patched, and you should update it to version 2.0.

LearnDash version 3.1.1and below is vulnerable to a Reflected Cross-Site Scripting attack.

The vulnerability has been patched, and you should update it to version 3.1.2.

Themes

ListingPro versions 2.5.3 and below are vulnerable to an Unauthenticated Reflected XSS attack.

The vulnerability has been patched, and you should update it to version 2.5.4.

The vulnerability has been patched, and you should update it to version 2.7.8.6.

ElegantThemes Divi, Divi Builder and Extra below versions 4.0.10 are vulnerable to an Authenticated Code Injection attack.

The vulnerability has been patched, and you should update it to version 4.0.10.

EasyBook versions 1.2.1 and below have multiple vulnerabilities including, an Unauthenticated Reflected XSS, an Authenticated Persistent XSS, and an Insecure Direct Object Reference.

The vulnerability has been patched, and you should update it to version 1.2.2.

TownHub versions 1.0.5 and below have multiple vulnerabilities including, an Unauthenticated Reflected XSS, an Authenticated Persistent XSS, and an Insecure Direct Object Reference.

The vulnerability has been patched, and you should update it to version 1.0.6.

CityBook versions 2.9.4 and below have multiple vulnerabilities including, an Unauthenticated Reflected XSS, an Authenticated Persistent XSS, and an Insecure Direct Object Reference.

The vulnerability has been patched, and you should update it to version 2.9.5.

Real Estate 7 versions 2.3.3 and below have multiple vulnerabilities including, an Unauthenticated Reflected XSS, an Authenticated Persistent XSS, and an Insecure Direct Object Reference.

The vulnerability has been patched, and you should update it to version 2.3.4.

A WordPress Security Plugin Can Help Secure Your Website

iThemes Security Pro, our WordPress security plugin, offers 30+ ways to secure and protect your website from common WordPress security vulnerabilities. With WordPress, two-factor authentication, brute force protection, strong password enforcement, and more, you can add an extra layer of security to your website.

Learn more about WordPress security with 10 key tips. Download the ebook now: A Guide to WordPress Security

Get iThemes Security

Keep reading the article at WordPress News and Updates from iThemes – iThemes. The article was originally written by Michael Moore on 2020-01-15 16:26:02.

The article was hand-picked and curated for you by the Editorial Team of WP Archives.

Disclosure: Some of the links in this post are "affiliate links." This means if you click on the link and purchase the product, We may receive an affiliate commission.

Related Posts

Leave a Comment

Your email address will not be published. Required fields are marked *

WordPress Vulnerability Roundup: December , Part 2

WordPress
WordPress Vulnerability Roundup: December 2020, Part 2

Written by

Michael Moore
on

December 23, 2020

Last Updated on December 23, 2020

New WordPress plugin and theme vulnerabilities were disclosed during the second half of December. This post covers the recent WordPress plugin, theme, and core vulnerabilities and what to do if you run one of the vulnerable plugins or themes on your website.

The WordPress Vulnerability Roundup is divided into three different categories: WordPress core, WordPress plugins, and WordPress themes.

In the December, Part 2 Report

WordPress Core Vulnerabilities

The latest version of WordPress core is currently 5.6. As a WordPress security best practice, make sure you’re running the latest version of WordPress core.

WordPress Plugin Vulnerabilities

1. DiveBook

DiveBook versions below 1.1.4 have an Improper Authorization Check, Unauthenticated SQL Injection, & Unauthenticated Reflected XSS vulnerabilities.

Remove the plugin until a security fix is released.

2. Pagelayer

WordPress Vulnerability Roundup: December 2020, Part 2 26

The vulnerability is patched, and you should update to version 1.3.5.

3. Ultimate Category Excluder

WordPress Vulnerability Roundup: December 2020, Part 2 27

The vulnerability is patched, and you should update to version 1.2.

4. Directories Pro

WordPress Vulnerability Roundup: December 2020, Part 2 28

The vulnerability is patched, and you should update to version 1.3.46.

5. Total Upkeep

WordPress Vulnerability Roundup: December 2020, Part 2 29

The vulnerability is patched, and you should update to version 1.14.10.

6. Redux Framework

WordPress Vulnerability Roundup: December 2020, Part 2 30

The vulnerability is patched, and you should update to version 4.1.21.

7. Contact Form 7

WordPress Vulnerability Roundup: December 2020, Part 2 31

The vulnerability is patched, and you should update to version 5.3.2.

8. Simple Social Media Share Buttons

WordPress Vulnerability Roundup: December 2020, Part 2 32

The vulnerability is patched, and you should update to version 3.2.1.

9. Envira Gallery Lite

WordPress Vulnerability Roundup: December 2020, Part 2 33

The vulnerability is patched, and you should update to version 1.8.3.3.

10. Limit Login Attempts Reloaded

WordPress Vulnerability Roundup: December 2020, Part 2 34

The vulnerability is patched, and you should update to version 2.16.0.

WordPress Theme Vulnerabilities

1. ListingPro

WordPress Vulnerability Roundup: December 2020, Part 2 35

ListingPro versions below 2.6.1 have an Unauthenticated Arbitrary Plugin Installation/Activation/Deactivation & Unauthenticated Sensitive Data Disclosure vulnerabilities.

The vulnerability is patched, and you should update to version 2.6.1.

December Security Tip: Why You Need a Universal User for Support

Anytime you create a new user on your website, you are adding another entry point that a hacker could exploit. But there will likely be times you may need some outside help for your website, like when you are seeking support or after hiring an independent contractor. You need a safe, secure way to add temporary admin access to your website.

Granting Outside Access to your Website: Your Typical Bad Options

Typically, you have two options to provide external access to your website…. and neither are great.

1. Share Your Admin User’s Credentials

Your first and worst option is to share the username and password of your WordPress admin user.

Why Sharing Your Admin Credentials is a Terrible Idea

  • Reduced Security – If you share your user’s credentials, you will have to disable two-factor authentication to allow the person using your credentials to login. Google shared on its blog that using two-factor authentication, or 2-step verification, can stop 100% of automated bot attacks. Disabling two-factor authentication, even for a short period of time, drastically reduces your website’s security.
  • Inconvenient – Sharing your credentials requires you to change your password. If you forget to change your password, there are one or more people that have admin access to your website whenever they want it.

2. Create a Separate User for the Support Tech

While creating a brand new admin user for the support specialist is better than sharing your admin credentials, it still isn’t great.

Why Creating a User for the Support Tech is Terrible

  • Increased Vulnerability – Creating a new administrator user adds another point of entry that could be exploited. If you don’t have a password policy in place, the support tech could choose a weak password, making your WordPress login more vulnerable to attack.
  • Inconvenient – Going through the process of setting up a new user anytime you need outside help is time-consuming. You have to create the new user and then remember to delete the user when they no longer need access to your website. It is a WordPress security best practice to remove any unused users from your website.

Granting Outside Access to Your Website: The Better Way

The iThemes Security Pro Privilege Escalation feature allows you to grant a user extra capabilities temporarily.

Privilege Escalation makes it easy and safe to create a universal user that you can give to any outside developers or support techs that need temporary access to your website.

With Privilege Escalation, you can create a new user and name it Support and give it the Subscriber user role. The next time you need to provide temporary access to your website, you can bump the Support user from a subscriber to an administrator. We will walk through how to do this later in the post, but first, let’s talk about why Privilege Escalation is a better way of granting access to your website.

Why Privilege Escalation is Better

  • Easy – You don’t have to create a new user every time you need to grant access to your website.
  • Automatic – The privilege escalation only lasts for 24 hours. After 24 hours is up, the user automatically loses all the additional privileges. You don’t have to remember to remove users or change any passwords.
  • No Sacrifice in Security – You can still require this universal support user to use the email method of two-factor to login, which means you have the same level security as you do with your other admin users. Because the actual user role is a subscriber, you don’t run any real risk leaving it on your website.

How to Use Privilege Escalation in iThemes Security Pro

To get started, enable Privilege Escalation on the main page of the security settings.

WordPress Vulnerability Roundup: December 2020, Part 2 36

You can create a new user and name it Support and give it the Subscriber user role. The next time you need to provide temporary access to your website, navigate to your Support user’s Profile page.

WordPress Vulnerability Roundup: December 2020, Part 2 37

Update the email address to allow the outside support person to request a new password. Then scroll down until you see the Temporary Privilege Escalation settings. Click the Set Temporary Role toggle, and select Admin. The user will now have Admin access for the next 24 hours.

WordPress Vulnerability Roundup: December 2020, Part 2 38

If they don’t need the full 24 hours, you can revoke the privilege escalation from the user profile page. If you need more than 24 hours, you can set the exact number of days you need in the Days field.

WordPress Vulnerability Roundup: December 2020, Part 2 39

See how it works

A WordPress Security Plugin Can Help Secure Your Website

iThemes Security Pro, our WordPress security plugin, offers 50+ ways to secure and protect your website from common WordPress security vulnerabilities. With WordPress, two-factor authentication, brute force protection, strong password enforcement, and more, you can add an extra layer of security to your website.

Get iThemes Security Pro

WordPress Vulnerability Roundup: December 2020, Part 2 40

Keep reading the article at WordPress News and Updates from iThemes – iThemes. The article was originally written by Michael Moore on 2020-12-23 10:11:14.

The article was hand-picked and curated for you by the Editorial Team of WP Archives.

Disclosure: Some of the links in this post are "affiliate links." This means if you click on the link and purchase the product, We may receive an affiliate commission.

Related Posts

Leave a Comment

Your email address will not be published. Required fields are marked *

WordPress Vulnerability Roundup: December , Part 1

WordPress
vulnerability roundup

Written by

Michael Moore
on

December 9, 2020

Last Updated on December 9, 2020

New WordPress plugin and theme vulnerabilities were disclosed during the first half of December. This post covers recent WordPress plugin, theme, and core vulnerabilities and what to do if you run one of the vulnerable plugins or themes on your website.

The WordPress Vulnerability Roundup is divided into three different categories: WordPress core, WordPress plugins, and WordPress themes.

In the December, Part 1 Report

WordPress Core Vulnerabilities

No new WordPress core vulnerabilities have been disclosed this month.

However, a new major version of WordPress core was just released yesterday. WordPress 5.6 includes several new features and improvements, so be sure to update.

WordPress Plugin Vulnerabilities

1. WPJobBoard

The vulnerability is patched, and you should update to version 5.7.0.

2. WP Google Map Plugin

WordPress Vulnerability Roundup: December 2020, Part 1 41

The vulnerability is patched, and you should update to version 4.1.4.

3. BuddyPress

WordPress Vulnerability Roundup: December 2020, Part 1 42

The vulnerability is patched, and you should update to version 6.4.0.

4. Events Manager

WordPress Vulnerability Roundup: December 2020, Part 1 43

The vulnerability is patched, and you should update to version 5.9.8.

5. Age Gate

WordPress Vulnerability Roundup: December 2020, Part 1 44

The vulnerability is patched, and you should update to version 2.13.5.

6. Canto

WordPress Vulnerability Roundup: December 2020, Part 1 45

Remove the plugin until a security fix is released.

7. Profile Builder

WordPress Vulnerability Roundup: December 2020, Part 1 46

The vulnerability is patched, and you should update to version 2.2.9.

8. Paid Memberships Pro

WordPress Vulnerability Roundup: December 2020, Part 1 47

The vulnerability is patched, and you should update to version 2.5.1.

9. Themify Portfolio Post

WordPress Vulnerability Roundup: December 2020, Part 1 48

The vulnerability is patched, and you should update to version 1.1.6.

10. Easy WP SMTP

WordPress Vulnerability Roundup: December 2020, Part 1 49

The vulnerability is patched, and you should update to version 1.4.3.

WordPress Theme Vulnerabilities

1. Wibar

WordPress Vulnerability Roundup: December 2020, Part 1 50

Wibar versions below 1.2.1 has an Authenticated Stored Cross-Site Scripting vulnerability.

The vulnerability is patched, and you should update to version 1.2.1.

December Security Tip: Why You Need a Universal User for Support

Anytime you create a new user on your website, you are adding another entry point that a hacker could exploit. But there will likely be times you may need some outside help for your website, like when you are seeking support or after hiring an independent contractor. You need a safe, secure way to add temporary admin access to your website.

Granting Outside Access to your Website: Your Typical Bad Options

Typically, you have two options to provide external access to your website…. and neither are great.

1. Share Your Admin User’s Credentials

Your first and worst option is to share the username and password of your WordPress admin user.

Why Sharing Your Admin Credentials is a Terrible Idea

  • Reduced Security – If you share your user’s credentials, you will have to disable two-factor authentication to allow the person using your credentials to login. Google shared on its blog that using two-factor authentication, or 2-step verification, can stop 100% of automated bot attacks. Disabling two-factor authentication, even for a short period of time, drastically reduces your website’s security.
  • Inconvenient – Sharing your credentials requires you to change your password. If you forget to change your password, there are one or more people that have admin access to your website whenever they want it.

2. Create a Separate User for the Support Tech

While creating a brand new admin user for the support specialist is better than sharing your admin credentials, it still isn’t great.

Why Creating a User for the Support Tech is Terrible

  • Increased Vulnerability – Creating a new administrator user adds another point of entry that could be exploited. If you don’t have a password policy in place, the support tech could choose a weak password, making your WordPress login more vulnerable to attack.
  • Inconvenient – Going through the process of setting up a new user anytime you need outside help is time-consuming. You have to create the new user and then remember to delete the user when they no longer need access to your website. It is a WordPress security best practice to remove any unused users from your website.

Granting Outside Access to Your Website: The Better Way

The iThemes Security Pro Privilege Escalation feature allows you to grant a user extra capabilities temporarily.

Privilege Escalation makes it easy and safe to create a universal user that you can give to any outside developers or support techs that need temporary access to your website.

With Privilege Escalation, you can create a new user and name it Support and give it the Subscriber user role. The next time you need to provide temporary access to your website, you can bump the Support user from a subscriber to an administrator. We will walk through how to do this later in the post, but first, let’s talk about why Privilege Escalation is a better way of granting access to your website.

Why Privilege Escalation is Better

  • Easy – You don’t have to create a new user every time you need to grant access to your website.
  • Automatic – The privilege escalation only lasts for 24 hours. After 24 hours is up, the user automatically loses all the additional privileges. You don’t have to remember to remove users or change any passwords.
  • No Sacrifice in Security – You can still require this universal support user to use the email method of two-factor to login, which means you have the same level security as you do with your other admin users. Because the actual user role is a subscriber, you don’t run any real risk leaving it on your website.

How to Use Privilege Escalation in iThemes Security Pro

To get started, enable Privilege Escalation on the main page of the security settings.

WordPress Vulnerability Roundup: December 2020, Part 1 51

You can create a new user and name it Support and give it the Subscriber user role. The next time you need to provide temporary access to your website, navigate to your Support user’s Profile page.

WordPress Vulnerability Roundup: December 2020, Part 1 52

Update the email address to allow the outside support person to request a new password. Then scroll down until you see the Temporary Privilege Escalation settings. Click the Set Temporary Role toggle, and select Admin. The user will now have Admin access for the next 24 hours.

WordPress Vulnerability Roundup: December 2020, Part 1 53

If they don’t need the full 24 hours, you can revoke the privilege escalation from the user profile page. If you need more than 24 hours, you can set the exact number of days you need in the Days field.

WordPress Vulnerability Roundup: December 2020, Part 1 54

See how it works

A WordPress Security Plugin Can Help Secure Your Website

iThemes Security Pro, our WordPress security plugin, offers 50+ ways to secure and protect your website from common WordPress security vulnerabilities. With WordPress, two-factor authentication, brute force protection, strong password enforcement, and more, you can add an extra layer of security to your website.

Get iThemes Security Pro

vulnerability roundup

Keep reading the article at WordPress News and Updates from iThemes – iThemes. The article was originally written by Michael Moore on 2020-12-09 10:37:22.

The article was hand-picked and curated for you by the Editorial Team of WP Archives.

Disclosure: Some of the links in this post are "affiliate links." This means if you click on the link and purchase the product, We may receive an affiliate commission.

Related Posts

Leave a Comment

Your email address will not be published. Required fields are marked *

WordPress Vulnerability Roundup: May , Part 2

WordPress
WordPress Vulnerability Roundup: May 2020, Part 2

Written by

Michael Moore
on

May 27, 2020

Last Updated On May 28, 2020

New WordPress plugin and theme vulnerabilities were disclosed during the second half of May, so we want to keep you aware. In this post, we cover recent WordPress plugin, theme and core vulnerabilities and what to do if you are running one of the vulnerable plugins or themes on your website.

New WordPress plugin and theme vulnerabilities were disclosed during the second half of April, so we want to keep you aware. In this post, we cover recent WordPress plugin, theme and core vulnerabilities and what to do if you are running one of the vulnerable plugins or themes on your website.

The WordPress Vulnerability Roundup is divided into four different categories:

  1. WordPress core
  2. WordPress plugins
  3. WordPress themes

Each vulnerability will have a threat rating of Low, Medium, High, or Critical.

WordPress Core Vulnerabilities

There have not been any WordPress vulnerabilities disclosed in May 2020.

WordPress Plugin Vulnerabilities

Several new WordPress plugin vulnerabilities have been discovered this month so far. Make sure to follow the suggested action below to update the plugin or completely uninstall it.

1. Site Kit by Google – Critical

The vulnerability is patched, and you should update to version 1.8.0.

2. Easy Testimonials – Critical

WordPress Vulnerability Roundup: May 2020, Part 2 55

The vulnerability is patched, and you should update to version 3.6.

3. WP Product Review – High

WordPress Vulnerability Roundup: May 2020, Part 2 56

The vulnerability is patched, and you should update to version 3.7.6.

4. Login/Signup Popup – Critical

WordPress Vulnerability Roundup: May 2020, Part 2 57

The vulnerability is patched, and you should update to version 1.5.

5. Photo Gallery by 10Web – Critical

WordPress Vulnerability Roundup: May 2020, Part 2 58

The vulnerability is patched, and you should update to version 1.5.55.

6. Team Members – Critical

WordPress Vulnerability Roundup: May 2020, Part 2 59

The vulnerability is patched, and you should update to version 5.0.4.

7. Visual Composer Website Builder – High

WordPress Vulnerability Roundup: May 2020, Part 2 60

The vulnerability is patched, and you should update to version 27.0.

8. WordPress Infinite Scroll – Critical

WordPress Vulnerability Roundup: May 2020, Part 2 61

The vulnerability is patched, and you should update to version 5.3.2.

9. WP Frontend Profile – Low

WordPress Vulnerability Roundup: May 2020, Part 2 62

The vulnerability is patched, and you should update to version 1.2.2.

10. Paid Memberships Pro – Medium

paid membership pro logo

The vulnerability is patched, and you should update to version 2.3.3.

11. ThirstyAffiliates Affiliate Link Manager – Medium

WordPress Vulnerability Roundup: May 2020, Part 2 63

The vulnerability is patched, and you should update to version 3.9.3.

12. Official MailerLite Sign Up Forms – Critical

WordPress Vulnerability Roundup: May 2020, Part 2 64

Remove the plugin. It is closed on WordPress.org pending review.

13. Add-on SweetAlert Contact Form 7 – Low

WordPress Vulnerability Roundup: May 2020, Part 2 65

The vulnerability is patched, and you should update to version 1.0.8.

14. Form Maker by 10Web – High

WordPress Vulnerability Roundup: May 2020, Part 2 66

Remove the plugin. It is closed on WordPress.org pending review.

WordPress Themes

There have been no disclosed WordPress Theme vulnerabilities in the second half of may.

How to Be Proactive About WordPress Theme & Plugin Vulnerabilities

Running outdated software is the number one reason WordPress sites are hacked. It is crucial to the security of your WordPress site that you have an update routine. You should be logging into your sites at least once a week to perform updates.

Automatic Updates Can Help

Automatic updates are a great choice for WordPress websites that don’t change very often. Lack of attention often leaves these sites neglected and vulnerable to attacks. Even with recommended security settings, running vulnerable software on your site can give an attacker an entry point into your site.

Using the iThemes Security Pro plugin’s Version Management feature, you can enable automatic WordPress updates to ensure you are getting the latest security patches. These settings help protect your site with options to automatically update to new versions or to increase user security when the site’s software is outdated.

WordPress Vulnerability Roundup: May 2020, Part 2 67
Version Management Update Options
  • WordPress Updates –Automatically install the latest WordPress release.
  • Plugin Automatic Updates – Automatically install the latest plugin updates. This should be enabled unless you actively maintain this site on a daily basis and install the updates manually shortly after they are released.
  • Theme Automatic Updates – Automatically install the latest theme updates. This should be enabled unless your theme has file customizations.
  • Granular Control over Plugin and Theme updates – You may have plugins/themes that you’d like to either manually update, or delay the update until the release has had time to prove stable. You can choose Custom for the opportunity to assign each plugin or theme to either update immediately (Enable), not update automatically at all (Disable) or update with a delay of a specified amount of days (Delay).
Strengthening and Alerting to Critical Issues
  • Strengthen Site When Running Outdated Software – Automatically add extra protections to the site when an available update has not been installed for a month. The iThemes Security plugin will automatically enable stricter security when an update has not been installed for a month. First, it will force all users that do not have two-factor enabled to provide a login code sent to their email address before logging back in. Second, it will disable the WP File Editor (to block people from editing plugin or theme code), XML-RPC pingbacks, and block multiple authentication attempts per XML-RPC request (both of which will make XML-RPC stronger against attacks without having to turn it off completely).
  • Scan for Other Old WordPress Sites – This will checks for other outdated WordPress installs on your hosting account. A single outdated WordPress site with a vulnerability could allow attackers to compromise all the other sites on the same hosting account.
  • Send Email Notifications – For issues that require intervention, an email is sent to admin-level users.

Managing Multiple WP Sites? Update Plugins, Themes & Core At Once from the iThemes Sync Dashboard

WordPress Vulnerability Roundup: May 2020, Part 2 68

iThemes Sync is our central dashboard to help you manage multiple WordPress sites. From the Sync dashboard, you can view available updates for all your sites and then update plugins, themes, and WordPress core with one click. You can also get daily email notifications when a new version update is available.

WordPress Vulnerability Roundup: May 2020, Part 2 69

Try Sync Free for 30 Days

A WordPress Security Plugin Can Help Secure Your Website

iThemes Security Pro, our WordPress security plugin, offers 30+ ways to secure and protect your website from common WordPress security vulnerabilities. With WordPress, two-factor authentication, brute force protection, strong password enforcement, and more, you can add an extra layer of security to your website.

Learn more about WordPress security with 10 key tips. Download the ebook now: A Guide to WordPress Security

Keep reading the article at WordPress News and Updates from iThemes – iThemes. The article was originally written by Michael Moore on 2020-05-27 09:00:15.

The article was hand-picked and curated for you by the Editorial Team of WP Archives.

Disclosure: Some of the links in this post are "affiliate links." This means if you click on the link and purchase the product, We may receive an affiliate commission.

Related Posts

Leave a Comment

Your email address will not be published. Required fields are marked *

✕
Show Your ❤️ Love! Like Us
WPArchives
Scroll to Top