{"id":166306,"date":"2024-12-16T13:40:09","date_gmt":"2024-12-16T13:40:09","guid":{"rendered":"https:\/\/getshieldsecurity.com\/?p=166306"},"modified":"2024-12-16T13:48:29","modified_gmt":"2024-12-16T13:48:29","slug":"shieldnotes-45","status":"publish","type":"post","link":"https:\/\/getshieldsecurity.com\/blog\/shieldnotes-45\/","title":{"rendered":"A big week for vulnerabilities; REST API Security Tips; & ShieldPRO 20.1 Released"},"content":{"rendered":"\n

This is a big week for vulnerabilities. Several popular form plugins are hit by quite serious vulnerabilities, and there’s a privilege escalation risk with the MainWP client plugin.<\/p>\n\n\n\n

It’s hard to imagine that there’s anyone out there not affected by at least 1 vulnerability this week.<\/p>\n\n\n\n

I’d also like to draw your attention to our latest ShieldPRO release, v20.1 (see more below)<\/p>\n\n\n\n

#1 – Security Risks in Popular Plugins<\/h2>\n\n\n\n

These are widely used plugins with security threats, led by WPForms, affecting 6+ million sites.<\/p>\n\n\n\n

Contact Form by WPForms Plugin<\/a><\/strong>
Broken Access Control; 8.5\/10; Update to v1.9.2.2+<\/p>\n\n\n\n

MainWP Child Plugin<\/a><\/strong>
Privilege Escalation; 8.1\/10; Update to v5.3+<\/p>\n\n\n\n

FooGallery Premium Plugin<\/a><\/strong>
Directory Traversal; 7.7\/10; Update to v2.4.27+<\/p>\n\n\n\n

Ninja Forms Plugin<\/a><\/strong>
XSS; 7.1\/10; Update to v3.8.20+<\/p>\n\n\n\n

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin<\/a><\/strong>
XSS; 6.5\/10; Update to v1.5.127+<\/p>\n\n\n\n

Beaver Builder Plugin<\/a><\/strong>
XSS; 6.5\/10; Update to v2.8.5.3+<\/p>\n\n\n\n

ProfilePress Plugin<\/a><\/strong>
XSS; 5.9\/10; Update to v4.15.15+<\/p>\n\n\n\n

Popup Builder Plugin<\/a><\/strong>
XSS; 5.9\/10; Update to v4.3.5+<\/p>\n\n\n\n

LuckyWP Table of Contents Plugin<\/a><\/strong>
XSS; 5.9\/10; Update to v2.1.7+<\/p>\n\n\n\n

The Events Calendar Plugin<\/a><\/strong>
Broken Access Control; 5.3\/10; Update to v6.8.2.1+<\/p>\n\n\n\n

Members Plugin<\/a><\/strong>
Sensitive Data Exposure; 5.3\/10; Update to v3.2.11+<\/p>\n\n\n\n

Editor Comment<\/strong>
It’s worth taking a few minutes each week to perform a sites review<\/a> to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade<\/a> feature for vulnerable plugins.<\/p>\n\n\n\n

#2 – High Security Risks in Less Popular Plugins & Themes<\/h2>\n\n\n\n

These plugins and theme, despite limited use, pose extreme risks\u20142 most critical with no-fix and removed from wp.org<\/p>\n\n\n\n

WP SuperBackup Plugin<\/a><\/strong>
Arbitrary File Upload; 10<\/strong>\/10; Update to v2.4+<\/p>\n\n\n\n

Opt-In Downloads Plugin<\/a><\/strong>
Arbitrary File Upload; 9.9<\/strong>\/10; Removed from wp.org; No fix; Remove\/or replace.<\/p>\n\n\n\n

Woffice Theme<\/a><\/strong>
Broken Authentication; 9.8<\/strong>\/10; Update to v5.4.15+<\/p>\n\n\n\n

Hunk Companion Plugin<\/a><\/strong>
Broken Access Control; 9.8<\/strong>\/10; Update to v1.9.0+<\/p>\n\n\n\n

Sign In With Google Plugin<\/a><\/strong>
Broken Authentication; 9.8<\/strong>\/10; Removed from wp.org; No fix; Remove\/or replace.<\/p>\n\n\n\n

Responsive Filterable Portfolio Plugin<\/a><\/strong>
SQL Injection; 9.3<\/strong>\/10; Update to v1.0.9+<\/p>\n\n\n\n

Editor Comment<\/strong>
It’s worth taking a few minutes each week to perform a sites review<\/a> to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade<\/a> feature for vulnerable plugins.<\/p>\n\n\n\n

#3 – Our blog: Proven Tips Securing Your WordPress REST API<\/h2>\n\n\n\n

WordPress REST APIs offer powerful functionality but come with security risks. Learn advanced techniques for securing APIs with strong authentication, access control, and protection against malicious traffic and code injection.<\/p>\n\n\n\n

More Info \u2192<\/a><\/p>\n\n\n\n

#4 – Shield Security 20.1 Released<\/h2>\n\n\n\n

With this release we’ve made further UI improvements and extended the coverage of the FileLocker feature to cover your critical theme’s functions <\/strong>file. There’s lots more to explore, and we advise all our members to upgrade asap!<\/p>\n\n\n\n

More Info \u2192<\/a><\/p>\n\n\n\n

Thanks for reading, and have a great week!<\/p>\n\n\n\n

Paul Goodchild<\/strong>
Shield Security for WordPress<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

This is a big week for vulnerabilities. Several popular form plugins are hit by quite serious vulnerabilities, and there’s a priviledge escalation risk with the MainWP client plugin. It’s hard to imagine that there’s anyone out there not affected by at least 1 vulnerability this week. I’d also like to draw your attention to our latest ShieldPRO release, v20.1. <\/p>\n","protected":false},"author":27,"featured_media":163832,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[153,201],"tags":[69],"class_list":["post-166306","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security-wordpress-solutions","category-shieldnotes","tag-security"],"acf":[],"_links":{"self":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts\/166306","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/users\/27"}],"replies":[{"embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/comments?post=166306"}],"version-history":[{"count":7,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts\/166306\/revisions"}],"predecessor-version":[{"id":166313,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts\/166306\/revisions\/166313"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/media\/163832"}],"wp:attachment":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/media?parent=166306"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/categories?post=166306"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/tags?post=166306"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}