Lots of Elementor related vulnerabilities again this week, alongside some really severe discoveries and some that haven’t even been patched, yet.
#1 – Vulnerable: Email Subscribers & Newsletters Plugin Vulnerability
SQL injection with 90,000+ installs.
How will I know I’m okay?
Upgrade ASAP to v5.7.21+
What’s the risk?
Severity risk 9.3/10 – SQLi – an attacker can directly access your database!
Editor Comment
Please use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#2 – Vulnerable: More Elementor Plugins
Unlimited Elements For Elementor (SQLi)
Upgrade to v1.5.110; Severity 8.5; Info
Qi Addons For Elementor (XSS)
Upgrade to v1.7.3; Severity: 8.5; Info
Prime Slider (XSS)
Upgrade to 3.14.8; Severity: 6.5; Info
Royal Elementor Addons (XSS)
Upgrade to 1.3.977; Severity: 6.5; Info
Editor Comment
Please use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#3 – Vulnerable: WooCommerce Amazon Affiliates
Multiple critical vulnerabilities.
How will I know I’m okay?
There is no patch and the vendor hasn’t appeared to respond to the vulnerabilities.
What’s the risk?
Severity risk 9.6/10 – SQL Injection and other – an attacker can directly interact with your WP database!
Editor Comment
Please use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#4 – Vulnerable: ARForms Plugin
Major 10/10 vulnerability, with 9,500 installs.
How will I know I’m okay?
Upgrade ASAP to v6.6+
What’s the risk?
Severity risk 10/10 – Remote Code Execution – an attacker can gain backdoor access to take full site control!
Editor Comment
Please use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#5 – From our blog: All About 2FA
This article outlines all you need to know about 2FA and WordPress.
#6 – WordCamp Europe 2024
Date: 13-15 June 2024
Location: Torino, Italy
There’s always a lot going on at WordCamp Europe and this year’s event will be no different. From the many talks taking place across the three days, to the chance to educate yourself by attending one of the many hands-on sessions and workshops plus networking with all the attendees.
I’m going to be heading down to WCEU for a couple of days, so if you’re going to be about and want to finally put a real-life face to the name, let me know! See you there!
Thanks for reading, and have a great week!
Paul Goodchild
Shield Security for WordPress
