WordPress Vulnerability Report: April 2021, Part 2
Written by Michael Moore of Ithemes on April 14, 2021
Last Updated on April 14, 2021
New WordPress plugin and theme vulnerabilities were disclosed during the second week of April. This post covers the recent WordPress plugin, theme, and core vulnerabilities and what to do if you run one of the vulnerable plugins or themes on your website.
The WordPress Vulnerability Roundup is divided into three different categories: WordPress core, WordPress plugins, and WordPress themes.
Each vulnerability will have a severity rating of Low, Medium, High, or Critical. The severity ratings are based on the Common WordPress Vulnerability Scoring System.
Is Your WordPress Website Secure?
DID YOU KNOW – A staggering 83% of WordPress websites are not upgraded or updated, is your website one of these?
Hacks happen due to lack of website upkeep and protection, like updating WordPress or plugins, plus using weak passwords. Contrary to popular belief, web designers and website hosting companies are not responsible for the security of your WordPress website; you are. It’s like using your computer without Anti-virus!
WordPress Core Vulnerabilities
No new WordPress core vulnerabilities have been disclosed this month.
WordPress Theme Vulnerabilities
WordScout Core Theme
WordPress Plugin Vulnerabilities
1. iThemes Security Free & Pro
2. Simple Membership
3. WPBakery Page Builder Clipboard
4. OpenID Connect Generic Client
5. Stop Spammers
6. Imagements
7. Workscout Core Plugin
8. Larsens Calendar
9. Contact Form Check Tester
10. Business Directory Plugin
11. Event Banner
12. Classyfrieds
13. College Publisher Import
WordPress Plugin Vulnerabilities
1. iThemes Security Theme Pro
Vulnerability: Improper Access Control to Privilege Escalation
Patched in Version: (iThemes Security): 7.9.1
Patched in Version (iThemes Security Pro): 6.8.4
Severity: High – CVSS:3.1AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/
The Hide Backend feature in iThemes Security allows users to hide the login page by changing its name and preventing access to wp-login.php and wp-admin. A bug was discovered in versions below 7.9.1 of iThemes Security and below 6.8.4 of iThemes Security Pro that make the hidden login page discoverable, reducing the effectiveness of the feature.
You should be aware that the hide backend feature isn’t full-proof no matter how much we try to improve it. In fact, the effectiveness of hiding the login page of your website for security reasons is our #1 WordPress security myth. Why? The truth is that you can’t completely hide the backend of your website. The login page may be exposed by WordPress core, plugins, or themes when printing links to the login page (like Privacy Request Confirmations or front-end login forms).
2. Simple Membership
Vulnerability: Authenticated SQL Injections
Patched in Version: 4.0.4
Severity: Critical – CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
3. WPBakery Page Builder Clipboard
Vulnerability: Subscriber+ Stored Cross-Site Scripting
Patched in Version: 4.5.6
Severity: Critical – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Vulnerability: Unauthorized Arbitrary License Options Update
Patched in Version: 4.5.8
Severity: Medium – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
4. OpenID Connect Generic Client
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 3.8.2
Severity: Medium – CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
5. Stop Spammers
Vulnerability: Reflected Cross-Site Scripting
Patched in Version: 2021.9
Severity: Medium – CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
6. Imagements
Vulnerability: Unauthenticated Arbitrary File Upload to RCE
Patched in Version: No known fix
Severity: Critical – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
7. WorkScout Core Plugin
Vulnerability: Authenticated Stored XSS & XFS
Patched in Version: 1.3.4
Severity: High – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
8. Larsens Calendar
Vulnerability: Stored Cross-Site Scripting
Patched in Version: No known fix
Severity: High – CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
9. Contact Form Check Tester
Vulnerability: Broken Access Control to Cross-Site Scripting
Patched in Version: No known fix
Severity: High – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
10. Business Directory Plugin
Vulnerability: Arbitrary Listing Export
Patched in Version: 5.11.2
Severity: High – CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Vulnerability: Arbitrary Payment History Update
Patched in Version: 5.11.2
Severity: Medium – CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Vulnerability: Authenticated Stored Cross-Site Scripting
Patched in Version: 5.11.2
Severity: Medium – CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
11. Event Banner
Vulnerability: Arbitrary File Upload to RCE
Patched in Version: No known fix
Severity: Critical – CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
12. Classyfrieds
Vulnerability: Authenticated Arbitrary File Upload to RCE
Patched in Version: No known fix
Severity: Critical – CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
13. College Publisher Import
Vulnerability: Arbitrary File Upload to RCE
Patched in Version: No known fix
Severity: Critical – CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
WordPress Theme Vulnerabilities
WordScout Core Theme
Vulnerability: Authenticated Stored XSS & XFS
Patched in Version: 2.0.33
Severity: High – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Protect Your WordPress Website Today With Website Guardian
Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.
Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!
We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.