Even the foundation isn’t safe. A critical flaw in WordPress itself leads the vulnerability list, joined by two popular plugins in the same danger zone, plus a handful of others that deserve your attention. We close with how to find and remove the hidden entry points attackers leave behind.

#1 – Critical WordPress Core Risk

WordPress 7.1.3 and earlier contain a security risk in the upgrade process, rated 9/10, that can lead to remote code execution under certain conditions. WordPress fixed it in v7.1.4, along with more than ten additional problems, so upgrade to the new release without delay.

Editor Comment
Monitor WordPress updates closely and install security fixes immediately upon release to protect your site from these vulnerabilities. Also, it’s worth taking a few minutes each week to perform a sites review to catch issues early.

Two names you’ll probably recognise, and two issues you can’t afford to put off, so update them first.

Gravity Forms Plugin
Deserialization of untrusted data; 9.8/10; Update to v3.1.3+; Recurring 13×

Widget Options Plugin
RCE; 9.1/10; Update to v4.2.6+; Recurring 3×

Editor Comment
It’s worth taking a few minutes each week to perform a sites review to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade feature for vulnerable plugins.

Less pressing than the ones above, but still worth ten minutes of your maintenance time.

NextGEN Gallery Plugin
RCE; 8.8/10; Update to v4.5.0+; Recurring 7×

Contact Form 7 Plugin
Arbitrary File Upload; 8.1/10; Update to v6.2.4+; Recurring 2×

Relevanssi Plugin
XSS; 7.1/10; Update to v4.28.6+; Recurring 8×

Ninja Forms Plugin
XSS; 7.1/10; Update to v3.15.6+; Recurring 12×

Independent Analytics Pro Plugin
XSS; 7.1/10; Update to v2.16.0+

WooCommerce PDF Invoices & Packing Slips Plugin
XSS; 7.1/10; Update to v5.16.5+; Recurring 5×

Media LIbrary Assistant Plugin
XSS; 6.5/10; Update to v3.44+; Recurring 18×

Editor Comment
It’s worth taking a few minutes each week to perform a sites review to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade feature for vulnerable plugins.

Small user base, maximum stakes: if any of these appear on your sites, patch them right away.

s2Member Plugin
RCE; 10/10; Update to v261001+; Recurring 4×

Uncanny Toolkit for LearnDash Plugin
Broken Authentication; 9.8/10; Update to v3.8.3+; Recurring 2×

FunnelKit Automations Plugin
PHP Object Injection; 9.8/10; Update to v3.8.6.2+; Recurring 4×

WP Project Manager Plugin
RCE; 9.8/10; Update to v4.1.2+; Recurring 6×

WP Directory Kit Plugin
SQL Injection; 9.3/10; Update to v1.6.1+; Recurring 15×

Web 2.0 Directory Plugin
SQL Injection; 9.3/10; Update to v3.0.0+

Transliterator Plugin
SQL Injection; 9.3/10; Update to v2.5.14+; Recurring 2×

BookIt Plugin
SQL Injection; 9.3/10; Update to v2.6.0.7+; Recurring 11×

Editor Comment
It’s worth taking a few minutes each week to perform a sites review to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade feature for vulnerable plugins.

#5 – Our blog: Keep Backdoors Out of WordPress

A backdoor lets attackers slip back in long after a hack seems fixed. Learn where these hidden entry points live and how to remove them.

More Info →

Thanks for reading, and have a wonderful week!

Paul Goodchild
Shield Security for WordPress