{"id":161837,"date":"2024-06-24T09:45:50","date_gmt":"2024-06-24T08:45:50","guid":{"rendered":"https:\/\/getshieldsecurity.com\/?p=161837"},"modified":"2024-06-24T09:45:51","modified_gmt":"2024-06-24T08:45:51","slug":"shieldnotes-ep19","status":"publish","type":"post","link":"https:\/\/getshieldsecurity.com\/blog\/shieldnotes-ep19\/","title":{"rendered":"ShieldNOTES Ep#19: Recurring Vulnerability + Severely Critical + Monitor WP Activity"},"content":{"rendered":"\n

This week, 1 plugin stands out due to its recurring vulnerability, alongside plugins with high severity issues that may need attention.<\/p>\n\n\n\n

#1 – Vulnerable: Email Subscribers & Newsletters Plugin<\/h2>\n\n\n\n

A recurring SQL Injection vulnerability.<\/p>\n\n\n\n

How will I know I’m ok?<\/strong>
Upgrade ASAP to v5.7.24+<\/p>\n\n\n\n

What’s the risk?<\/strong>
Severity risk 9.3<\/strong>\/10 – SQL Injection – an attacker can interact with your WP database directly!<\/p>\n\n\n\n

Editor Comment<\/strong>
Please use ShieldPRO’s auto-upgrade feature<\/a> for vulnerable plugins.<\/p>\n\n\n\n

More Info \u2192<\/a><\/p>\n\n\n\n

#2 – Vulnerable: Shariff Plugin<\/h2>\n\n\n\n

Potentially 50.000 WP sites with a high risk of local file inclusion.<\/p>\n\n\n\n

How will I know I’m okay?<\/strong>
Upgrade ASAP to v4.6.14+<\/p>\n\n\n\n

What’s the risk?<\/strong>
Severity risk 9.8<\/strong>\/10 – a malicious actor may include local files of the target website and show output on the screen!<\/p>\n\n\n\n

Editor Comment<\/strong>
Please use ShieldPRO’s auto-upgrade feature<\/a> for vulnerable plugins.<\/p>\n\n\n\n

More Info \u2192<\/a><\/p>\n\n\n\n

#3 – Vulnerable: Themify \u2013 WooCommerce Product Filter Plugin<\/h2>\n\n\n\n

SQL injection vulnerability on up to 30.000 sites.<\/p>\n\n\n\n

How will I know I’m okay?<\/strong>
Upgrade ASAP to v1.5.0+<\/p>\n\n\n\n

What’s the risk?<\/strong>
Severity risk 9.3<\/strong>\/10 – SQL Injection – an attacker can directly interact with your WP database!<\/p>\n\n\n\n

Editor Comment<\/strong>
Please use ShieldPRO’s auto-upgrade feature<\/a> for vulnerable plugins.<\/p>\n\n\n\n

More Info \u2192<\/a><\/p>\n\n\n\n

#4 – Vulnerable: Salon Booking System Plugin<\/h2>\n\n\n\n

A less widely used plugin poses an extremely high security risk.<\/p>\n\n\n\n

How will I know I’m okay?<\/strong>
Upgrade ASAP to v10.3+<\/p>\n\n\n\n

What’s the risk?<\/strong>
Severity risk 10<\/strong>\/10 – Arbitrary File Upload – an attacker can upload any type of file to your site, including backdoors that could gain further access.<\/p>\n\n\n\n

Editor Comment<\/strong>
Please use ShieldPRO’s auto-upgrade feature<\/a> for vulnerable plugins.<\/p>\n\n\n\n

More Info \u2192<\/a><\/p>\n\n\n\n

#5 – Vulnerable: Custom Field Suite Plugin<\/h2>\n\n\n\n

PHP Object Injection vulnerability with no official fix.<\/p>\n\n\n\n

How will I know I’m okay?<\/strong>
No fix available yet; please watch for updates.<\/p>\n\n\n\n

What’s the risk?<\/strong>
Severity risk 8.8<\/strong>\/10 – an attacker can inject and execute malicious objects within a PHP application.<\/p>\n\n\n\n

Editor Comment<\/strong>
Please use ShieldPRO’s auto-upgrade feature<\/a> for vulnerable plugins.<\/p>\n\n\n\n

More Info \u2192<\/a><\/p>\n\n\n\n

#6 – From our blog: Track All Activity<\/h2>\n\n\n\n

Knowing what users and visitors are actually doing on your site is critical to monitoring your WP security.<\/p>\n\n\n\n

More Info \u2192<\/a><\/p>\n\n\n\n

Thanks for reading, and have a great week!<\/p>\n\n\n\n

Paul Goodchild<\/strong>
Shield Security for WordPress<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

This week, 1 plugin stands out due to its recurring vulnerability, alongside plugins with high severity issues that may need attention.<\/p>\n","protected":false},"author":27,"featured_media":161171,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[153,201],"tags":[69],"class_list":["post-161837","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security-wordpress-solutions","category-shieldnotes","tag-security"],"acf":[],"_links":{"self":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts\/161837","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/users\/27"}],"replies":[{"embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/comments?post=161837"}],"version-history":[{"count":4,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts\/161837\/revisions"}],"predecessor-version":[{"id":161843,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts\/161837\/revisions\/161843"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/media\/161171"}],"wp:attachment":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/media?parent=161837"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/categories?post=161837"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/tags?post=161837"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}