Another week with major high-risk vulnerabilities, alongside tips on WordPress backdoor threats, from our blog.
#1 – Vulnerable: GiveWP Plugin
High severity PHP Object Injection vulnerability.
How will I know I’m okay?
Upgrade ASAP to v3.14.2+
What’s the risk?
Severity risk 10/10 – an attacker can inject and execute malicious objects within a PHP application.
Editor Comment
Please use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#2 – Vulnerable: MainWP Child Reports Plugin
CSRF on up to 90,000 sites.
How will I know I’m okay?
Upgrade ASAP to v2.2.1+
What’s the risk?
Severity risk 8.8/10 – an attacker can force privileged users to execute unwanted actions while authenticated.
Editor Comment
Please use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#3 – Vulnerable: BookingPress Plugin
A lesser-known plugin but with a high Broken Authentication.
How will I know I’m okay?
Upgrade ASAP to v1.1.8+
What’s the risk?
Severity risk 10/10 – an attacker can access site without permission, steal data, or take over user accounts.
Editor Comment
Please use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#4 – Vulnerable: LearnPress Plugin
SQL Injection vulnerability with 90,000 installs.
How will I know I’m okay?
Upgrade ASAP to v4.2.6.9.4+
What’s the risk?
Severity risk 8.5/10 – SQL Injection – an attacker can interact with your WP database directly!
Editor Comment
Please use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#5 – Vulnerable: Cost Calculator Builder Plugin
Another critical SQL Injection risk.
How will I know I’m okay?
Upgrade ASAP to v3.2.16+
What’s the risk?
Severity risk 9.3/10 – SQL Injection – an attacker can interact with your WP database directly!
Editor Comment
Please use ShieldPRO’s auto-upgrade feature for vulnerable plugins.
#6 – From our blog: WordPress Backdoor Threats
For effective site security, it’s vital to spot, remove, and prevent hidden backdoor risks that give hackers ongoing access.
Thanks for reading, and have a great week!
Paul Goodchild
Shield Security for WordPress
