WordPress Vulnerability Roundup: March 2021, Part 4

by Hayley Yates | Mar 30, 2021 | Security

Written by Michael Moore of Ithemes on March 30, 2021

Last Updated on March 30, 2021

New WordPress plugin and theme vulnerabilities were disclosed during the final week of March. This post covers the recent WordPress plugin, theme, and core vulnerabilities and what to do if you run one of the vulnerable plugins or themes on your website.

The WordPress Vulnerability Roundup is divided into three different categories: WordPress core, WordPress plugins, and WordPress themes.

Each vulnerability will have a severity rating of Low, Medium, High, or Critical. The severity ratings are based on the Common WordPress Vulnerability Scoring System.

Is Your WordPress Website Secure?

DID YOU KNOW – A staggering 83% of WordPress websites are not upgraded or updated, is your website one of these?

Hacks happen due to lack of website upkeep and protection, like updating WordPress or plugins, plus using weak passwords. Contrary to popular belief, web designers and website hosting companies are not responsible for the security of your WordPress website; you are. It’s like using your computer without Anti-virus!

WordPress Core Vulnerabilities
No new WordPress core vulnerabilities have been disclosed this month.

WordPress Theme Vulnerabilities
All Thrive Themes Legacy Themes

WordPress Plugin Vulnerabilities
1. GiveWP
2. Mapplic and Mapplic Lite
3. MapifyLife
4. Thrive AB Page Testing
5. Thrive Comments
6. Thrive Headline Optimizer
7. Thrive Leads
8. Thrive Ultimatum
9. Thrive Quiz Builder
10. Thrive Apprentice
11. Thrive Visual Editor
12. Thrive Dashboard
13. Thrive Ovation
14. JH 404 Logger
15. Business Directory
16. Facebook for WordPress
17. Vertical News Scroller
18. Quiz and Survey Master
19. WP-Curricul Vitea Free
20. N5 Upload Form
21. Easy Form Builder
22. Patreon WordPress
23. AccessAlly

WordPress Plugin Vulnerabilities

1. Give WP

Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 2.10.0
Severity: High – CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

2. Mapplic and Mapplic Lite

Vulnerability: SSRF to Stored Cross-Site Scripting
Patched in Version: Mapplic Lite 1.0.1 & Mapplic 6.2.1
Severity: High – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

3. Mappify

Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: No Known Fix
Severity: Medium – CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

4. Thrive AB Page Testing

Vulnerability: Unauthenticated Option Update
Patched in Version: 1.4.13.3
Severity: Medium – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

5. Thrive Comments

Vulnerability: Unauthenticated Option Update
Patched in Version: 1.4.15.3
Severity: Critical – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

6. Thrive Headline Optimizer

Vulnerability: Unauthenticated Option Update
Patched in Version: 1.3.7.3
Severity: Medium – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

7. Thrive Leads

Vulnerability: Unauthenticated Option Update
Patched in Version: 2.3.9.4
Severity: Medium – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

8. Thrive Ultimatum

Vulnerability: Unauthenticated Option Update
Patched in Version: 2.3.9.4
Severity: Medium – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

9. Thrive Quiz Builder

Vulnerability: Unauthenticated Option Update
Patched in Version: 2.3.9.4
Severity: Medium – CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

10. Thrive Appearance

Vulnerability: Unauthenticated Option Update
Patched in Version: 2.3.9.4
Severity: Medium – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

11. Thrive Visual Editor

Vulnerability: Unauthenticated Option Update
Patched in Version: 2.6.7.4
Severity: Medium – CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

12. Thrive Dashboard

Vulnerability: Unauthenticated Option Update
Patched in Version: 2.3.9.3
Severity: Medium – CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

13. Thrive Ovation

Vulnerability: Unauthenticated Option Update
Patched in Version: 2.4.5
Severity: Critical – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

14. JH 404 Logger

Vulnerability: Unauthenticated Stored Cross-Site Scripting
Patched in Version: No Known Fix
Severity: Critical – CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

15. Business Directory

Vulnerability: Unauthenticated Reflected Cross-Site Scripting
Patched in Version: No Known Fix
Severity: Medium – CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

16. Facebook for WordPress

Vulnerability: PHP Object Injection with POP Chain
Patched in Version: 3.0.0
Severity: Critical – CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Vulnerability: CSRF to Stored XSS and Settings Deletion
Patched in Version: 3.0.4
Severity: High – CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

17. Vertical News Scroller

Vulnerability: Authenticated Reflected Cross-Site Scripting
Patched in Version: 1.17
Severity: Critical – CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

18. Quiz and Survey Master

Vulnerability: Authenticated SQL injection via shortcode
Patched in Version: 7.1.12
Severity: High – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability: Authenticated SQL injection via Rest API
Patched in Version: 7.1.14
Severity: High – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

19. WP-Curricul Vitea Free

Vulnerability: Unauthenticated Arbitrary File Upload to RCE
Patched in Version: No known fix
Severity: Critical – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

20. N5 Upload Form

Vulnerability: Unauthenticated Arbitrary File Upload to RCE
Patched in Version: No known fix
Severity: Critical – CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

21. Easy Form Builder

Vulnerability: Authenticated Arbitrary File Upload
Patched in Version: No known fix
Severity: Critical – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

22. Patreon WordPress

Vulnerability: Unauthenticated Local File Disclosure
Patched in Version: 1.7.0
Severity: High – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability: CSRF to Overwrite/Create User Meta
Patched in Version: 1.7.0
Severity: Medium – CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Vulnerability: CSRF to Disconnect Sites From Patreon
Patched in Version: 1.7.0
Severity: Medium – CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Vulnerability: CSRF to Disconnect Sites From Patreon
Patched in Version: 1.7.0
Severity: High – CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability: Reflected XSS on Login Form
Patched in Version: 1.7.2
Severity: High – CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability: Reflected XSS on patreon_save_attachment_patreon_level AJAX action
Patched in Version: 1.7.2
Severity: High – CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

23. AccessAlly

Vulnerability: $_SERVER Superglobal Leakage
Patched in Version: 3.5.7
Severity: High – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

WordPress Theme Vulnerabilities

1. All Thrive Themes Legacy Themes

Affected Themes: Rise, Luxe, Minus, Ignition, Focusblog, Squared, Voice, Performag, Pressive, & Storied
Vulnerability: Unauthenticated Arbitrary File Upload and Option Deletion
Patched in Version: 2.0.0
Severity: Critical – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Protect Your WordPress Website Today With Website Guardian

Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.

Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!

We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.