{"id":170716,"date":"2026-01-26T14:01:27","date_gmt":"2026-01-26T14:01:27","guid":{"rendered":"https:\/\/getshieldsecurity.com\/?p=170716"},"modified":"2026-01-26T14:03:25","modified_gmt":"2026-01-26T14:03:25","slug":"shieldnotes-92","status":"publish","type":"post","link":"https:\/\/getshieldsecurity.com\/blog\/shieldnotes-92\/","title":{"rendered":"ACF & Other Critical Flaws; & Keep WordPress Secure"},"content":{"rendered":"\n

New vulnerabilities this week range from recurring issues in popular plugins to a serious high\u2011risk threat in ACF.<\/p>\n\n\n\n

We also include a security checklist from our blog to help keep your WordPress site safe.<\/p>\n\n\n\n

#1 – High Security Risks in Popular Plugins<\/h2>\n\n\n\n

A critical vulnerability in this plugin could allow unauthorised high-level privilege access, potentially enabling full site compromise across 100,000+ installations.<\/p>\n\n\n\n

Advanced Custom Fields: Extended Plugin<\/a>
<\/strong>Privilege Escalation; 9.8<\/strong>\/10; Update to v0.9.2.2+

Editor Comment<\/strong>
It’s worth taking a few minutes each week to perform a sites review<\/a> to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade<\/a> feature for vulnerable plugins.<\/p>\n\n\n\n

#2 – Lower Security Risks in Popular Plugins<\/h2>\n\n\n\n

Small glitches aside, these widely used plugins remain critical to track, as they affect millions of sites.<\/p>\n\n\n\n

Happy Addons for Elementor Plugin<\/a>
<\/strong>SQL Injection; 8.5\/10; Update to v3.20.6+<\/p>\n\n\n\n

Beaver Builder Plugin<\/a>
<\/strong>Arbitrary Code Execution; 7.5\/10; Update to v2.9.4.2+<\/p>\n\n\n\n

BuddyPress Plugin<\/a>
<\/strong>Arbitrary Code Execution; 7.3\/10; Update to v14.3.4+<\/p>\n\n\n\n

Custom Fonts \u2013 Host Your Fonts Locally Plugin<\/a>
<\/strong>Broken Access Control; 6.5\/10; Update to v2.1.17+<\/p>\n\n\n\n

Schema & Structured Data for WP & AMP Plugin<\/a>
<\/strong>XSS; 6.5\/10; Update to v1.54.1+<\/p>\n\n\n\n

The Events Calendar Plugin<\/a>
<\/strong>Broken Access Control; 5.4\/10; Update to v6.15.13.1+<\/p>\n\n\n\n

Photo Gallery by 10Web Plugin<\/a>
<\/strong>Broken Access Control; 5.3\/10; Update to v1.8.37+<\/p>\n\n\n\n

Newsletter Plugin<\/a>
<\/strong>CSRF; 4.3\/10; Update to v9.1.1+<\/p>\n\n\n\n

Metform Plugin<\/a>
<\/strong>Broken Authentication; 3.7\/10; Update to v4.1.1+<\/p>\n\n\n\n

Editor Comment<\/strong>
It’s worth taking a few minutes each week to perform a sites review<\/a> to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade<\/a> feature for vulnerable plugins.<\/p>\n\n\n\n

#3 – High Security Risks in Less Popular Plugins<\/h2>\n\n\n\n

These plugins may be less common but are high risk wherever they are used.<\/p>\n\n\n\n

Real Homes CRM Plugin<\/a>
<\/strong>Arbitrary File Upload; 9.9<\/strong>\/10; Update to v1.0.1+<\/p>\n\n\n\n

LA-Studio Element Kit for Elementor Plugin<\/a>
<\/strong>Backdoor; 9.8<\/strong>\/10; Update to v1.6.0+<\/p>\n\n\n\n

Nexter Extension Plugin<\/a>
<\/strong>PHP Object Injection; 9.8<\/strong>\/10; Update to v4.4.7+<\/p>\n\n\n\n

Academy LMS Plugin<\/a>
<\/strong>Privilege Escalation; 9.8<\/strong>\/10; Update to v3.5.1+<\/p>\n\n\n\n

MailerLite \u2013 WooCommerce integration Plugin<\/a>
<\/strong>SQL Injection; 9.3<\/strong>\/10; Update to v3.1.3+<\/p>\n\n\n\n

Xpro Elementor Addons Plugin<\/a>
<\/strong>Arbitrary File Upload; 9.1<\/strong>\/10; Update to v1.4.20+<\/p>\n\n\n\n

Nelio AB Testing Plugin<\/a>
<\/strong>Arbitrary Code Execution; 9.1<\/strong>\/10; Update to v8.2.0+<\/p>\n\n\n\n

Editor Comment<\/strong>
It’s worth taking a few minutes each week to perform a sites review<\/a> to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade<\/a> feature for vulnerable plugins.<\/p>\n\n\n\n

#4 – Our blog: WordPress Security Checklist<\/h2>\n\n\n\n

Keeping your website secure can seem daunting at first. To make it easy for you we have put together a comprehensive checklist that you should look for when securing your WordPress website.<\/p>\n\n\n\n

More Info \u2192<\/a><\/p>\n\n\n\n

Thanks for reading, and have a wonderful week!<\/p>\n\n\n\n

Paul Goodchild<\/strong>
Shield Security for WordPres<\/em>s<\/p>\n","protected":false},"excerpt":{"rendered":"

New vulnerabilities this week range from recurring issues in popular plugins to a serious high\u2011risk threat in ACF. We also include a security checklist from our blog to help keep your WordPress site safe.<\/p>\n","protected":false},"author":27,"featured_media":163832,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[153,201],"tags":[69],"class_list":["post-170716","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security-wordpress-solutions","category-shieldnotes","tag-security"],"acf":[],"_links":{"self":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts\/170716","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/users\/27"}],"replies":[{"embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/comments?post=170716"}],"version-history":[{"count":3,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts\/170716\/revisions"}],"predecessor-version":[{"id":170719,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts\/170716\/revisions\/170719"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/media\/163832"}],"wp:attachment":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/media?parent=170716"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/categories?post=170716"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/tags?post=170716"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}