From unpatched vulnerabilities to hidden malware in the ‘mu-plugins’ directory, this roundup covers recent WordPress security threats, with a link to our recovery guide in case things go wrong.
#1 – Security Risks in Popular Plugins
Many sites face risks from these unpatched plugins, with CMP leading as the top threat.
CMP – Coming Soon & Maintenance Plugin
Arbitrary File Upload; 9.1/10; No fix; Remove/or replace.
ShareThis Dashboard for Google Analytics Plugin
CSRF; 4.3/10; No fix; Remove/or replace.
Editor Comment
It’s worth taking a few minutes each week to perform a sites review to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#2 – High Security Risks in Less Popular Plugins & Themes
With two open flaws, these plugins and themes are a prime target for ongoing exploitation.
Front End Users Plugin
Arbitrary File Upload; 10/10; Removed from wp.org; No fix; Remove/or replace.
Bloggie Theme
Arbitrary File Upload; 9.9/10; No fix; Remove/or replace.
tagDiv Composer Plugin
PHP Object Injection; 9.8/10; Update to v5.4+
Woffice Theme
Privilege Escalation; 9.8/10; Update to v5.4.22+
Product Filter by WBW Plugin
SQL Injection; 9.3/10; Update to v2.8.0+
Editor Comment
It’s worth taking a few minutes each week to perform a sites review to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#3 – Masked WordPress Malware in Must-Use Plugins
Hackers are hiding malware in WordPress ‘mu-plugins’ directory to avoid detection.
Must-Use plugins load automatically, don’t need activation, and aren’t visible in the standard plugin interface. This makes the directory a prime target for stealthy infections on compromised sites.
#4 – Our blog: WordPress Database Backup Recovery Guide
Crashed sites, cybercrime hacks, or data loss may leave you needing to recover your WordPress site.
Discover simple to complex recovery methods, including configuration and security checks. You’ll never stress about WordPress recovery again.
Thanks for reading, and have a wonderful week!
Paul Goodchild
Shield Security for WordPress
