Nine WordPress plugins expose over 1.3 million sites to exploits


The United States Government Vulnerability Database and WordPress security researchers have issued alerts about WordPress plugin vulnerabilities. Of these plugins, nine of the most popular plugins affect over 1.3 million websites.

Vulnerabilities in nine WordPress plugins

Although there were many more plugins found to be vulnerable, the nine most popular plugins affected over 1.3 million websites. Vulnerabilities have been noted

The following items are on the list of nine vulnerable plugins:

  1. Header Footer Code Manager Over 300,000 installs
  2. Ad Inserter – Ad Manager and AdSense Ads Over 200,000 installs
  3. WordPress Popup Builder plugin Over 200,000 installs
  4. Brute-Force anti-malware and firewall security 200,000+ installs
  5. WP content copy protection and no right click 100,000+ installs
  6. Database backup for WordPress 100,000+ installs
  7. GiveWP – Donation plugin and fundraising platform Over 100,000 installs
  8. Download Manager Over 100,000 installs
  9. WordPress Advanced Database Cleaner Plugin Over 80,000 Installs

Header Footer Code Manager WordPress Plugin

Wordfence security researchers have discovered that the WordPress Header Footer Code Manager plugin has a Reflected Cross-Site Scripting vulnerability.

The vulnerability requires the hacker to trick an administrator into clicking a link or performing some other action in order to make them vulnerable to a full site takeover.

The researchers noted that because this plugin affects a sensitive area of ​​WordPress sites in that it is used to add code to websites, the variety of malicious actions could extend to adding backdoors and attack on site visitors.

Wordfence recommends that publishers update their installations to at least version 1.1.17.

Ad Inserter – Ad Manager & AdSense Ads (Free and Pro Versions)

WPScan reported that Ad Inserter – Ad Manager & AdSense Ads also had a vulnerability that could lead to a Reflected Cross-Site Scripting exploit.

Publishers are encouraged to update to at least version 2.7.10.

This plugin contains a vulnerability that could lead to an SQL injection exploit.

According to the National Vulnerability Database:

“The WordPress Popup Builder plugin prior to 4.0.7 does not properly validate and escape the orderby and order parameters before using them in an SQL statement in the admin dashboard, which could allow high-privileged users perform an SQL injection”

It is recommended that publishers update to at least version 4.0.7 of the WordPress plugin.

Anti-Malware Security and Brute-Force Firewall

This WordPress plugin also contains a thoughtful cross-site scripting vulnerability. An attacker must have administrator-level credentials to carry out the attack.

Publishers are encouraged to update to at least version 4.20.94.

WP content copy protection and no right click

This WordPress plugin was discovered by security Patchstack researchers who reported the plugin to have a Cross Site Request Forgery (CSRF) vulnerability.

Publishers are encouraged to update to at least version 3.4.5.

Database Backup for WordPress

WPScan security researchers have reported an SQL injection vulnerability affecting the Database Backup for WordPress plugin which manages the most sensitive part of any WordPress installation, the database.

Notes from WPScan:

“The plugin does not properly clean and escape the fragment parameter before using it in an SQL statement in the admin dashboard, resulting in an SQL injection issue”

The National Vulnerability Database advises publishers to update the Database Backup for WordPress plugin to at least version 2.5.1.

GiveWP – Donation plugin and fundraising platform

The GiveWP donation plugin contains a Reflected Cross-Site Scripting vulnerability. Publishers are encouraged to update to at least version 2.17.3 of the plugin.

Download Manager WordPress Plugin

This plugin contains an SQL injection exploit that could lead to a Reflected Cross-Site Scripting attack. Publishers are encouraged to update to at least version 3.2.34.

Advanced Database Cleaner WordPress Plugin

This plugin has been discovered by security researchers to contain an issue that could lead to a Reflected Cross-Site Scripting attack. Publishers are encouraged to update to at least version 3.0.4 of the plugin.

Several vulnerable WordPress plugins

Many plugins have been reported as having vulnerabilities. But these nine are the most popular plugins.

All plugins have received a patch that closes the vulnerability, but it is up to publishers to ensure they are using the latest versions to protect their websites and visitors.

Quotes

Header and footer code handler
https://www.wordfence.com/blog/2022/02/reflected-xss-in-header-footer-code-manager/

Ad Inserter – Ad Manager and AdSense Ads
https://nvd.nist.gov/vuln/detail/CVE-2022-0288

WordPress Popup Maker Plugin
https://nvd.nist.gov/vuln/detail/CVE-2022-0228

Anti-Malware Security and Brute-Force Firewall
https://nvd.nist.gov/vuln/detail/CVE-2021-25101
https://wpscan.com/vulnerability/5fd0380c-0d1d-4380-96f0-a07be5a61eba

WP content copy protection and no right click
https://nvd.nist.gov/vuln/detail/CVE-2022-23983

Database Backup for WordPress
https://nvd.nist.gov/vuln/detail/CVE-2022-0255

GiveWP – Donation plugin and fundraising platform
https://nvd.nist.gov/vuln/detail/CVE-2021-25100
https://nvd.nist.gov/vuln/detail/CVE-2021-25099

download manager
https://nvd.nist.gov/vuln/detail/CVE-2021-25069
https://wpscan.com/vulnerability/4ff5e638-1b89-41df-b65a-f821de8934e8

Advanced Database Cleaner WordPress Plugin
https://nvd.nist.gov/vuln/detail/CVE-2021-24921

Leave a Comment

Your email address will not be published.