Another week with major high-risk vulnerabilities, alongside tips on WordPress backdoor threats, from our blog.

#1 – Vulnerable: GiveWP Plugin

High severity PHP Object Injection vulnerability.

How will I know I’m okay?
Upgrade ASAP to v3.14.2+

What’s the risk?
Severity risk 10/10 – an attacker can inject and execute malicious objects within a PHP application.

Editor Comment
Please use ShieldPRO’s auto-upgrade feature for vulnerable plugins.

More Info →

#2 – Vulnerable: MainWP Child Reports Plugin

CSRF on up to 90,000 sites.

How will I know I’m okay?
Upgrade ASAP to v2.2.1+

What’s the risk?
Severity risk 8.8/10 – an attacker can force privileged users to execute unwanted actions while authenticated.

Editor Comment
Please use ShieldPRO’s auto-upgrade feature for vulnerable plugins.

More Info →

#3 – Vulnerable: BookingPress Plugin

A lesser-known plugin but with a high Broken Authentication.

How will I know I’m okay?
Upgrade ASAP to v1.1.8+

What’s the risk?
Severity risk 10/10 – an attacker can access site without permission, steal data, or take over user accounts.

Editor Comment
Please use ShieldPRO’s auto-upgrade feature for vulnerable plugins.

More Info →

#4 – Vulnerable: LearnPress Plugin

SQL Injection vulnerability with 90,000 installs.

How will I know I’m okay?
Upgrade ASAP to v4.2.6.9.4+

What’s the risk?
Severity risk 8.5/10 – SQL Injection – an attacker can interact with your WP database directly!

Editor Comment
Please use ShieldPRO’s auto-upgrade feature for vulnerable plugins.

More Info →

#5 – Vulnerable: Cost Calculator Builder Plugin

Another critical SQL Injection risk.

How will I know I’m okay?
Upgrade ASAP to v3.2.16+

What’s the risk?
Severity risk 9.3/10 – SQL Injection – an attacker can interact with your WP database directly!

Editor Comment
Please use ShieldPRO’s auto-upgrade feature for vulnerable plugins.

More Info →

#6 – From our blog: WordPress Backdoor Threats

For effective site security, it’s vital to spot, remove, and prevent hidden backdoor risks that give hackers ongoing access.

More Info →

Thanks for reading, and have a great week!

Paul Goodchild
Shield Security for WordPress