This week, 1 plugin stands out due to its recurring vulnerability, alongside plugins with high severity issues that may need attention.
#1 – Vulnerable: Email Subscribers & Newsletters Plugin
A recurring SQL Injection vulnerability.
How will I know I’m ok?
Upgrade ASAP to v5.7.24+
What’s the risk?
Severity risk 9.3/10 – SQL Injection – an attacker can interact with your WP database directly!
Editor Comment
Please use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#2 – Vulnerable: Shariff Plugin
Potentially 50.000 WP sites with a high risk of local file inclusion.
How will I know I’m okay?
Upgrade ASAP to v4.6.14+
What’s the risk?
Severity risk 9.8/10 – a malicious actor may include local files of the target website and show output on the screen!
Editor Comment
Please use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#3 – Vulnerable: Themify – WooCommerce Product Filter Plugin
SQL injection vulnerability on up to 30.000 sites.
How will I know I’m okay?
Upgrade ASAP to v1.5.0+
What’s the risk?
Severity risk 9.3/10 – SQL Injection – an attacker can directly interact with your WP database!
Editor Comment
Please use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#4 – Vulnerable: Salon Booking System Plugin
A less widely used plugin poses an extremely high security risk.
How will I know I’m okay?
Upgrade ASAP to v10.3+
What’s the risk?
Severity risk 10/10 – Arbitrary File Upload – an attacker can upload any type of file to your site, including backdoors that could gain further access.
Editor Comment
Please use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#5 – Vulnerable: Custom Field Suite Plugin
PHP Object Injection vulnerability with no official fix.
How will I know I’m okay?
No fix available yet; please watch for updates.
What’s the risk?
Severity risk 8.8/10 – an attacker can inject and execute malicious objects within a PHP application.
Editor Comment
Please use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#6 – From our blog: Track All Activity
Knowing what users and visitors are actually doing on your site is critical to monitoring your WP security.
Thanks for reading, and have a great week!
Paul Goodchild
Shield Security for WordPress
