Certain patches belong at the very top of your list. Some of the most widely used WordPress plugins carry critical vulnerabilities, and the worst could let an intruder run commands on your server. Plenty more are waiting for updates, while our blog shows how to shut down brute force attacks.
#1 – Critical Security Risks in Popular Plugins
Four big ones, each near the ceiling for severity: give them priority now.
ACF Extended Pro Plugin
RCE; 10/10; Update to v0.9.2.7+; Recurring 10×
LatePoint Plugin
Broken Authentication; 9.8/10; Update to v5.7.7+; Recurring 26×
WPvivid Backup and Migration Plugin
Arbitrary File Upload; 9.1/10; Update to v0.9.137+; Recurring 8×
Checkout Field Editor for WooCommerce Pro Plugin
Arbitrary File Deletion; 9.1/10; Update to v3.8.1+; Recurring 3×
Editor Comment
It’s worth taking a few minutes each week to perform a sites review to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#2 – Other Security Risks in Popular Plugins
Plenty to get through, but most fixes are a single click away, so clear them in one sitting.
Import and Export Users and Customers Plugin
Privilege Escalation; 8.8/10; Update to v2.5.12+; Recurring 12×
Limit Login Attempts Reloaded Plugin
Broken Authentication; 7.5/10; Update to v3.4.1+; Recurring 2×
CTX Feed Plugin
RCE; 7.2/10; Update to v8.0.27+; Recurring 8×
Duplicator Free & Pro Plugin
XSS; 7.1/10; Update to v5.1.0+; Recurring 4×
Iubenda Plugin
XSS; 7.1/10; Update to v3.13.7+; Recurring 2×
Advanced Custom Fields Plugin
XSS; 7.1/10; Update to v6.8.11+; Recurring 3×
Parsi Date Plugin
XSS; 6.5/10; Update to v6.5+; Recurring 2×
Permalink Manager Lite Plugin
XSS; 6.5/10; Update to v2.6.2+; Recurring 3×
Enable Media Replace Plugin
XSS; 6.5/10; Update to v4.2.3+; Recurring 5×
SEOPress Plugin
XSS; 6.5/10; Update to v10.4+; Recurring 5×
BackUpWordPress Plugin
Arbitrary File Deletion; 5.4/10; Update to v3.15+
AMP for WP Plugin
Arbitrary Code Execution; 5.4/10; Update to v1.1.19+; Recurring 5×
Redirection for Contact Form 7 Plugin
Broken Access Control; 5.3/10; Update to v3.2.15+; Recurring 4×
Kirki Plugin
Bypass Vulnerability; 5.3/10; Update to v6.2.5+; Recurring 34×
MC4WP Plugin
Other Vulnerability Type; 4.8/10; Update to v4.15.0+; Recurring 5×
Post Duplicator Plugin
Broken Access Control; 4.3/10; Update to v3.0.17+; Recurring 7×
Editor Comment
It’s worth taking a few minutes each week to perform a sites review to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#3 – Critical Security Risks in Less Popular Plugins
Few installs, yet each one is serious enough to put an entire website at stake, so check for them today.
Woody Ad Snippets Plugin
RCE; 10/10; Update to v3.3.1+; Recurring 2×
All In One Login Plugin
Broken Authentication; 9.8/10; Update to v2.5.0+; Recurring 2×
WPJAM Basic Plugin
Privilege Escalation; 9.8/10; Update to v7.1.2+; Recurring 4×
wpForo Forum Plugin
SQL Injection; 9.3/10; Update to v3.2.2+; Recurring 20×
Frontend Admin by DynamiApps Plugin
Privilege Escalation; 9.1/10; Update to v3.30.2+; Recurring 15×
Editor Comment
It’s worth taking a few minutes each week to perform a sites review to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#4 – Our blog: How to Stop Brute Force Attacks with OTP
Bots never tire of hammering your login page. See how one-time codes add an extra layer that guessing alone can’t get past.
Thanks for reading, and have a wonderful week!
Paul Goodchild
Shield Security for WordPress
