There are quite a few Elementor-related vulnerabilities published in the last week. 1 is particularly severe.
We also share an article from our blog that you’ll find interesting, and there’s a big TicketMaster breach to be aware of.
#1 – Vulnerable: Unlimited Elements For Elementor Plugin
Critical site-takeover vulnerability with 200,000+ installs.
How will I know I’m okay?
Upgrade ASAP to v1.5.91+
What’s the risk?
Severity risk 9.9/10 – Remote Code Execution – an attacker can gain backdoor access to then take full control of the website!
Editor Comment
Please use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#2 – Vulnerable: More Elementor Plugins
Happy Addons for Elementor (XSS)
Upgrade to v3.11.0; Severity 6.5; Info
Premium Addons for Elementor (Borken Access Control)
Upgrade to v4.10.32; Severity: 4.3; Info
Essential Addons for Elementor (XSS)
Upgrade to 5.9.22; Severity: 6.5; Info
Editor Comment
Please use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#3 – Vulnerable: Flash & HTML5 Video Plugin Vulnerability
Critical site-takeover vulnerability with 200,000+ installs.
How will I know I’m okay?
Upgrade ASAP to v2.5.27+
What’s the risk?
Severity risk 9.3/10 – SQL Injection – an attacker can interact with your WP database directly!
Editor Comment
Please use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#4 – From our blog: All About .htaccess
This article outlines all you might want to know about your .htaccess file and how you might use it to restrict certain operations on your WordPress sites.
#5 – TicketMaster Breach: 560M+ Customer Records
Nobody is immune to being breached! You need to be aware that your personal info kept with TicketMaster is likely exposed.
Be vigilant of phishing attempts and people using your data. It’s not clear if passwords have been exposed, but if you’ve reused passwords with them, you should go about updating your passwords wherever this is the case.
Never re-use passwords, and use a password manager (so you can store strong unique passwords for everything).
Thanks for reading, and have a great week!
Paul Goodchild
Shield Security for WordPress
