{"id":167145,"date":"2025-02-03T14:52:06","date_gmt":"2025-02-03T14:52:06","guid":{"rendered":"https:\/\/getshieldsecurity.com\/?p=167145"},"modified":"2025-02-03T14:52:07","modified_gmt":"2025-02-03T14:52:07","slug":"shieldnotes-51","status":"publish","type":"post","link":"https:\/\/getshieldsecurity.com\/blog\/shieldnotes-51\/","title":{"rendered":"Latest Vulnerabilities, WordPress Trends; & Hints for a Spam-Free Contact Form 7"},"content":{"rendered":"\n

We bring the latest plugin security risks, including Elementor Pro and a recurring vulnerability in Ninja Forms.<\/p>\n\n\n\n

Hackers exploit outdated WordPress versions and plugins to spread malware. Plus, catch up on the new updates in the WordPress community and learn how to keep your Contact Form 7 spam-free, from our blog.<\/p>\n\n\n\n

#1 – Security Risks in Popular Plugins<\/h2>\n\n\n\n

Lower severity but timely updates are key, as these plugins affect millions of sites.<\/p>\n\n\n\n

Forminator Plugin<\/a><\/strong>
XSS; 7.1\/10; Update to v1.38.3+<\/p>\n\n\n\n

ElementsKit Pro Plugin<\/a><\/strong>
XSS; 6.5\/10; Update to v3.7.9+<\/p>\n\n\n\n

Ninja Forms Plugin<\/a><\/strong>
XSS; 6.5\/10; Update to v3.8.25+<\/p>\n\n\n\n

Tracking Code Manager Plugin<\/a><\/strong>
XSS; 6.5\/10; Update to v2.4.0+<\/p>\n\n\n\n

Elementor Pro Plugin<\/a><\/strong>
Sensitive Data Exposure; 4.3\/10; Update to v3.25.11+<\/p>\n\n\n\n

Editor Comment<\/strong>
It’s worth taking a few minutes each week to perform a sites review<\/a> to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade<\/a> feature for vulnerable plugins.<\/p>\n\n\n\n

#2 – High Security Risks in Less Popular Plugins<\/h2>\n\n\n\n

Even less popular plugins, but with high-severity risks, like the ones below, can lead to major security issues.<\/p>\n\n\n\n

ThemeREX Addons Plugin<\/a><\/strong>
Arbitrary File Upload; 10<\/strong>\/10; Update to v2.34.0+<\/p>\n\n\n\n

Media Manager for UserPro Plugin<\/a><\/strong>
Broken Access Control; 9.8<\/strong>\/10; No fix; Remove\/or replace.<\/p>\n\n\n\n

iControlWP Plugin<\/a><\/strong>
PHP Object Injection; 9.8<\/strong>\/10; Update to v4.5.2+<\/p>\n\n\n\n

Eventer Plugin<\/a><\/strong>
SQL Injection; 9.3<\/strong>\/10; Update to v3.9.9+<\/p>\n\n\n\n

Borderless Plugin<\/a><\/strong>
RCE; 9.1<\/strong>\/10; No fix; Remove\/or replace.<\/p>\n\n\n\n

Editor Comment<\/strong>
It’s worth taking a few minutes each week to perform a sites review<\/a> to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade<\/a> feature for vulnerable plugins.<\/p>\n\n\n\n

#3 – Hackers Target Outdated WordPress Versions and Plugins to Spread Malware<\/h2>\n\n\n\n

Hackers are exploiting outdated WordPress versions and plugins to infect thousands of sites, aiming to trick visitors into downloading malware. The malware steals personal information from both Windows and Mac users. The attack, still ongoing, redirects visitors to fake Chrome update pages that prompt them to download harmful files.<\/p>\n\n\n\n

More Info \u2192<\/a><\/p>\n\n\n\n

#4 – WordPress Community Moves Toward Decentralization and Shared Control<\/h2>\n\n\n\n

A growing movement is pushing to build a parallel community to WordPress, aiming to increase stability and ensure its continued popularity. Disputes between Matt Mullenweg and WP Engine could shift control away from Automattic.<\/p>\n\n\n\n

The community is also exploring decentralizing plugin and theme distribution through multiple channels to reduce Automattic’s control.<\/p>\n\n\n\n

More Info \u2192<\/a><\/p>\n\n\n\n

#5 – Our blog: Keep Your Contact Form 7 Spam-Free<\/h2>\n\n\n\n

Spam in Contact Form 7 is a constant threat that simple CAPTCHAs and honeypots can\u2019t always stop. Modern spam tactics are more sophisticated, making single-layer defences ineffective.<\/p>\n\n\n\n

Advanced anti-spam strategies with layered defences, intelligent bot detection, and adaptive automation are crucial for keeping your forms secure.<\/p>\n\n\n\n

More Info \u2192<\/a><\/p>\n\n\n\n

Thanks for reading, and have a wonderful week!<\/p>\n\n\n\n

Paul Goodchild<\/strong>
Shield Security for WordPress<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

We bring the latest plugin security risks, including Elementor Pro and a recurring vulnerability in Ninja Forms. Hackers exploit outdated WordPress versions and plugins to spread malware. Plus, catch up on the new updates in the WordPress community and learn how to keep your Contact Form 7 spam-free, from our blog.<\/p>\n","protected":false},"author":27,"featured_media":163832,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[153,201],"tags":[69],"class_list":["post-167145","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security-wordpress-solutions","category-shieldnotes","tag-security"],"acf":[],"_links":{"self":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts\/167145","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/users\/27"}],"replies":[{"embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/comments?post=167145"}],"version-history":[{"count":4,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts\/167145\/revisions"}],"predecessor-version":[{"id":167149,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts\/167145\/revisions\/167149"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/media\/163832"}],"wp:attachment":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/media?parent=167145"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/categories?post=167145"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/tags?post=167145"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}