New WordPress plugin and theme vulnerabilities were disclosed during the first half of February. This post covers the recent WordPress plugin, theme, and core vulnerabilities and what to do if you run one of the vulnerable plugins or themes on your website.
The WordPress Vulnerability Roundup is divided into three different categories: WordPress core, WordPress plugins, and WordPress themes.
Each vulnerability will have a severity rating of Low, Medium, High, or Critical. The severity ratings are based on the Common Vulnerability Scoring System.
WordPress Core Vulnerabilities
WordPress Plugin Vulnerabilities
1. uListing – Critical
uListing versions below 1.7 have multiple vulnerabilities, including Unauthenticated SQL Injections, Unauthenticated Arbitrary Account Creation, and Unauthenticated WordPress Options Change.
2. Super Forms – Critical
3. Modern Events Calendar Lite – Critical
4. Ivory Search – Medium
5. WP Editor – Critical
6. MStore API – High
7. Popup Builder – Medium
8. Gift Voucher – Critical
9. Name Directory – Medium
10. Contact Form 7 Style – High
11. Ultimate GDPR & CCPA Compliance Toolkit – Critical
12. Like Button Rating ? LikeBtn – High
13. Paid Membership Pro – Medium
14. Backup by Supsystic – Critical
15. Contact Form by Supsystic – Critical
16. Data Tables Generator by Supsystic – Critical
17. Digital Publications by Supsystic – Medium
18. Membership by Supsystic – Critical
19. Newsletter by Supsystic – Critical
20. Pricing Table by Supsystic – Critical
21. Ultimate Maps by Supsystic – Critical
22. NextGen Gallery – Critical
23. Map Block for Google Maps – Medium
WordPress Theme Vulnerabilities
1. Wyzi – Medium
2. Multiple Parallelus Themes – Medium
February Security Tip: Why You Should Be Logging Website Security Activity
Security logging should be an essential part of your WordPress security strategy. Why?
Insufficient logging and monitoring can lead to a delay in the detection of a security breach. Most breach studies show that the time to detect a breach is over 200 days!
That amount of time allows an attacker to breach other systems, modify, steal, or destroy more data. For this reason, “insufficient logging” landed on the OWASP top 10 of web application security risks.
WordPress security logs have several benefits in your overall security strategy, helping you:
- Identity and stop malicious behavior.
- Spot activity that can alert you of a breach.
- Assess how much damage was done.
- Aid in the repair of a hacked site.
If your site does get hacked, you will want to have the best information to aid in a quick investigation and recovery.
The good news is that iThemes Security Pro can help you implement website logging. iThemes Security Pro’s WordPress security logs tracks all these website activities for you:
Stats from your logs are then displayed in a real-time WordPress security dashboard that you can view from your WordPress admin dashboard.
Check out this feature spotlight post where we unpack all the steps of adding WordPress security logs to your website using iThemes Security Pro.
See how it works
A WordPress Security Plugin Can Help Secure Your Website
iThemes Security Pro, our WordPress security plugin, offers 50+ ways to secure and protect your website from common WordPress security vulnerabilities. With WordPress, two-factor authentication, brute force protection, strong password enforcement, and more, you can add an extra layer of security to your website.
Get iThemes Security Pro
