{"id":162352,"date":"2024-07-08T11:29:39","date_gmt":"2024-07-08T10:29:39","guid":{"rendered":"https:\/\/getshieldsecurity.com\/?p=162352"},"modified":"2024-07-08T11:49:27","modified_gmt":"2024-07-08T10:49:27","slug":"shieldnotes-ep21","status":"publish","type":"post","link":"https:\/\/getshieldsecurity.com\/blog\/shieldnotes-ep21\/","title":{"rendered":"ShieldNOTES Ep#21: New Supply Chain Attack; Elementor Addon & WP Google Map Vulnerabilities; Hacker Security Guide"},"content":{"rendered":"\n

There’s another supply chain attack with WP.org plugins affected.<\/p>\n\n\n\n

#1 – Vulnerable: Nested Pages Plugin<\/h2>\n\n\n\n

CSRF with 100,000 installs.<\/p>\n\n\n\n

How will I know I’m okay?<\/strong>
Upgrade ASAP to v3.2.8+<\/p>\n\n\n\n

What’s the risk?<\/strong>
Severity risk 8.3<\/strong>\/10 – an attacker can force privileged users to execute unwanted actions while authenticated.<\/p>\n\n\n\n

Editor Comment<\/strong>
Please use ShieldPRO’s auto-upgrade feature<\/a> for vulnerable plugins.<\/p>\n\n\n\n

More Info \u2192<\/a><\/p>\n\n\n\n

#2 – Vulnerable: Ultimate Addons for Elementor Plugin<\/h2>\n\n\n\n

Widely used plugin with a critical Privilege Escalation vulnerability.<\/p>\n\n\n\n

How will I know I’m okay?<\/strong>
Upgrade ASAP to v1.36.32+<\/p>\n\n\n\n

What’s the risk?<\/strong>
Severity risk 8.8<\/strong>\/10 – an attacker can escalate their low-privileged account to gain higher privileges and take full control of the website.<\/p>\n\n\n\n

Editor Comment<\/strong>
Please use ShieldPRO’s auto-upgrade feature<\/a> for vulnerable plugins.<\/p>\n\n\n\n

More Info \u2192<\/a><\/p>\n\n\n\n

#3 – Vulnerable: WP Google Map Plugin<\/h2>\n\n\n\n

Potentially 300,000 WP sites with severe security risk.<\/p>\n\n\n\n

How will I know I’m okay?<\/strong>
Upgrade ASAP to v4.6.2+<\/p>\n\n\n\n

What’s the risk?<\/strong>
Severity risk 8.5<\/strong>\/10 – SQL Injection – an attacker can interact with your WP database directly!<\/p>\n\n\n\n

Editor Comment<\/strong>
Please use ShieldPRO’s auto-upgrade feature<\/a> for vulnerable plugins.<\/p>\n\n\n\n

More Info \u2192<\/a><\/p>\n\n\n\n

#4 – Vulnerable: UsersWP Plugin<\/h2>\n\n\n\n

Not a hugely popular plugin, but it poses a high risk.<\/p>\n\n\n\n

How will I know I’m okay?<\/strong>
Upgrade ASAP to v1.2.11+<\/p>\n\n\n\n

What’s the risk?<\/strong>
Severity risk 9.3<\/strong>\/10 – SQL Injection – an attacker can interact with your WP database directly!<\/p>\n\n\n\n

Editor Comment<\/strong>
Please use ShieldPRO’s auto-upgrade feature<\/a> for vulnerable plugins.<\/p>\n\n\n\n

More Info \u2192<\/a><\/p>\n\n\n\n

#5 – Plugins Affected by Polyfill Supply Chain Attack<\/h2>\n\n\n\n

Polyfill.js – a widely used JavaScript library – has been exploited by hackers with malicious code that can lead to Cross-Site Scripting (XSS) risk and steal user data, manipulate site actions, and redirect visitors to malicious sites.<\/p>\n\n\n\n

These plugins below are known to embed scripts from the affected domains and should be updated to the latest version or removed:<\/p>\n\n\n\n

Amelia<\/a><\/strong>
No official fix available. Remove it for now.<\/p>\n\n\n\n

WP User Frontend<\/a><\/strong>
Upgrade to v4.0.8+<\/p>\n\n\n\n

Product Customer List for WooCommerce<\/a><\/strong>
Upgrade to v3.1.7+<\/p>\n\n\n\n

Editor Comment<\/strong>
As a precautionary measure, take a few minutes each week to perform a review of your sites<\/a> to catch issues early.<\/p>\n\n\n\n

#6 – From our blog: Secure your site from hackers<\/h2>\n\n\n\n

Bad guys never sleep, and neither should we. We guide you through easy steps to defend your site and keep it secure.<\/p>\n\n\n\n

More Info \u2192<\/a><\/p>\n\n\n\n

Thanks for reading, and have a great week!<\/p>\n\n\n\n

Paul Goodchild<\/strong>
Shield Security for WordPress<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

There’s another supply chain attack with WP.org plugins affected.<\/p>\n","protected":false},"author":27,"featured_media":161171,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[153,201],"tags":[69],"class_list":["post-162352","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security-wordpress-solutions","category-shieldnotes","tag-security"],"acf":[],"_links":{"self":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts\/162352","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/users\/27"}],"replies":[{"embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/comments?post=162352"}],"version-history":[{"count":5,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts\/162352\/revisions"}],"predecessor-version":[{"id":162360,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts\/162352\/revisions\/162360"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/media\/161171"}],"wp:attachment":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/media?parent=162352"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/categories?post=162352"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/tags?post=162352"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}