WordPress Vulnerability Roundup: April 2020, Part 1

by Hayley Yates | Apr 15, 2020 | Security

Written by Michael Moore of iThemes on April 15, 2020

Last Updated on August 17, 2020

New WordPress plugin and theme vulnerabilities were disclosed during the first half of April, so we want to keep you aware. In this post, we cover recent WordPress plugin, theme and core vulnerabilities and what to do if you are running one of the vulnerable plugins or themes on your website.

The WordPress Vulnerability Roundup is divided into three different categories: WordPress core, WordPress plugins, and WordPress themes.

Is Your WordPress Website Secure?

DID YOU KNOW – A staggering 83% of WordPress websites are not upgraded or updated, is your website one of these?

Hacks happen due to lack of website upkeep and protection, like updating WordPress or plugins, plus using weak passwords. Contrary to popular belief, web designers and website hosting companies are not responsible for the security of your WordPress website; you are. It’s like using your computer without Anti-virus!

WordPress Core Vulnerabilities
No new WordPress core vulnerabilities have been disclosed this month.

WordPress Theme Vulnerabilities

WordPress Plugin Vulnerabilities
1. IMPress for IDX Broker
2. CM Pop-Up banners for WordPress
3. Rank Math
4. LifterLMS
5. Elementor Page Builder
6. LearnDash
7. Login by Auth0
8. WordPress WP-Advanced-Search
9. Contact Form 7 Datepicker
10. Art-Picture-Gallery
11. WP Last Modified Info
12. WP Lead Plus X
13. Ultimate Addons for Gutenberg
14. Klarna Checkout for WooCommerce
15. Tickera – WordPress Event Ticketing
16. Responsive Poll
17. Media Library Assistant

WordPress Plugin Vulnerabilities

Several new WordPress plugin vulnerabilities have been discovered this month so far. Make sure to follow the suggested action below to update the plugin or completely uninstall it.

1. IMPress for IDX Broker

IMPress for IDX Broker below version 2.6.2 have an Authenticated Post Creation, Modification/Deletion and Authenticated Stored Cross-Site Scripting (XSS) via unprotected ‘idx_update_recaptcha_key’ vulnerabilities.

The vulnerabilities have been patched, and you should update to version 2.6.2.

2. CM Pop-Up banners for WordPress

CM Pop-Up banners for WordPress versions below 1.4.11 have an Authenticated Stored XSS vulnerability.

The vulnerability has been patched, and you should update to version 1.4.11.

3. Rank Math

Rank Math versions below 1.0.4.1 have a Redirect Creation and Privilege Escalation vulnerabilities.

The vulnerabilities have been patched, and you should update to version 1.4.1.

4. LifterLMS

LifterLMS versions below 3.37.15 have an Arbitrary File Writing vulnerability.

The vulnerability has been patched, and you should update to version 3.37.15.

5. Elementor Page Builder

Elementor Page Builder versions below 2.9.6 have an Authenticated Safe Mode Privilege Escalation vulnerability.

The vulnerability has been patched, and you should update to version 2.9.6.

6. LearnDash

LearnDash versions below 3.1.6 have an Unauthenticated SQL Injection vulnerability.

The vulnerability has been patched, and you should update to version 3.1.6.

7. Login by Auth0

The vulnerability has been patched, and you should update to version 4.0.0.

8. WordPress WP-Advanced-Search

WordPress WP-Advanced-Search versions below 3.3.6 have an Unauthenticated SQL Injection vulnerability.

The vulnerability has been patched, and you should update to version 3.3.6.

9. Contact Form 7 Datepicker

All versions of Contact Form 7 Datepicker have an Authenticated Stored Cross-Site Scripting vulnerability.

Remove the plugin, it has been closed on the WordPress.org plugin repository pending review.

10. Art-Picture-Gallery

All versions of Art-Picture-Gallery have an Unauthenticated Arbitrary File Upload vulnerability.

Remove the plugin, it has been closed on the WordPress.org plugin repository pending review.

11. WP Last Modified Info

WP Last Modified Info versions below 1.6.6 have an Authenticated Stored XSS vulnerability.

The vulnerability has been patched, and you should update to version 1.6.6.

12. WP Lead Plus X

All versions of WP Lead Plus X have a Cross-Site Request Forgery vulnerability.

Remove the plugin until a patch is released.

13. Ultimate Addons for Gutenberg

Ultimate Addons for Gutenberg versions below 1.14.8 have an Authenticated Settings Change vulnerability.

The vulnerability has been patched, and you should update to version 1.14.8.

14. Klarna Checkout for WooCommerce

Klarna Checkout for WooCommerce versions below 2.0.10 have an Authenticated Arbitrary Plugin Deactivation, Activation and Installation vulnerability.

15. Tickera – WordPress Event Ticketing

Tickera – WordPress Event Ticketing versions below 3.4.6.9 have an Unauthenticated Sensitive Data Exposure vulnerability.

The vulnerability has been patched, and you should update to version 3.4.6.9.

16. Responsive Poll

All versions of Responsive Poll have Broken Authentication and Missing Capability Checks on AJAX calls.

Remove the plugin, it has been closed on the WordPress.org plugin repository pending review.

17. Media Library Assistant

Media Library Assistant versions below 2.82 have an Authenticated Stored Cross-Site Scripting and Unauthenticated Limited Local File Inclusion vulnerabilities.

The vulnerability has been patched, and you should update to version 2.82.

How to Be Proactive About WordPress Theme & Plugin Vulnerabilities

Running outdated software is the number one reason WordPress sites are hacked. It is crucial to the security of your WordPress site that you have an update routine. You should be logging into your sites at least once a week to perform updates.

Automatic Updates Can Help

Automatic updates are a great choice for WordPress websites that don’t change very often. Lack of attention often leaves these sites neglected and vulnerable to attacks. Even with recommended security settings, running vulnerable software on your site can give an attacker an entry point into your site.

Version Management Update Options

WordPress Updates –Automatically install the latest WordPress release.
Plugin Automatic Updates – Automatically install the latest plugin updates. This should be enabled unless you actively maintain this site on a daily basis and install the updates manually shortly after they are released.
Theme Automatic Updates – Automatically install the latest theme updates. This should be enabled unless your theme has file customizations.
Granular Control over Plugin and Theme updates – You may have plugins/themes that you’d like to either manually update, or delay the update until the release has had time to prove stable. You can choose Custom for the opportunity to assign each plugin or theme to either update immediately (Enable), not update automatically at all (Disable) or update with a delay of a specified amount of days (Delay).

Strengthening and Alerting to Critical Issues

Strengthen Site When Running Outdated Software – Automatically add extra protections to the site when an available update has not been installed for a month. The iThemes Security plugin will automatically enable stricter security when an update has not been installed for a month. First, it will force all users that do not have two-factor enabled to provide a login code sent to their email address before logging back in. Second, it will disable the WP File Editor (to block people from editing plugin or theme code), XML-RPC pingbacks, and block multiple authentication attempts per XML-RPC request (both of which will make XML-RPC stronger against attacks without having to turn it off completely).
Scan for Other Old WordPress Sites – This will checks for other outdated WordPress installs on your hosting account. A single outdated WordPress site with a vulnerability could allow attackers to compromise all the other sites on the same hosting account.
Send Email Notifications – For issues that require intervention, an email is sent to admin-level users.

Protect Your WordPress Website Today With Website Guardian

Join hundreds of businesses like yours who trust InterwebDEFENCE to protect their websites and livelihood. Using our proven website security analysis and best-in-class AI ‘Website Guardian” software, we are able to protect, monitor and backup your WordPress website.

Go ahead, keep the good guys In and the bad guys out – Click HERE to see our Website Guardian security plans NOW
PLUS
Find out about our unconditional ‘Double Protection’ Guarantee. This guarantee is better than risk free!

We’ll have you scanned, protected and secure in no time, giving you total peace of mind that your website is safe, leaving you to focus on your business success.