This entry was posted in Research, Vulnerabilities, WordPress Security on September 29, 2021 by Ram Gall 0 Replies
Today’s post is part two of a two part blog post. It describes a cross site scripting vulnerability in the Easy Social Icons plugin that exploits the PHP_SELF variable. In yesterday’s post, we described another plugin, underConstruction, suffering from a similar vulnerability related to the use of PHP_SELF. On August 16, 2021, the Wordfence Threat …
Read More
This entry was posted in Research, Vulnerabilities, WordPress Security on September 28, 2021 by Ram Gall 4 Replies
Today’s post is part one of a two part blog post. It describes a cross site scripting vulnerability that exploits the PHP_SELF variable. Tomorrow we will publish part two, which describes another plugin suffering from a similar vulnerability related to the use of PHP_SELF. So be sure to look out for that post via our …
Read More
This entry was posted in Research, Vulnerabilities, WordPress Security on September 22, 2021 by Chloe Chamberland 0 Replies
On August 3, 2021 the Wordfence Threat Intelligence team initiated the responsible disclosure process for two vulnerabilities that were discovered in Ninja Forms, a WordPress plugin installed on over 1,000,000 sites. These flaws made it possible for an attacker to export sensitive information and send arbitrary emails from a vulnerable site that could be used …
Read More
This entry was posted in Wordfence on September 04, 2021 by Mark Maunder 0 Replies
Wordfence is used by millions of free and paid customers around the world to secure their WordPress websites. We serve a broad range of customers across the globe, from diverse cultures, with diverse backgrounds, and who have diverse political views. As an organization, Defiant, the company that makes Wordfence, believes that everyone has the right …
Read More
This entry was posted in Research, Vulnerabilities, WordPress Security on September 01, 2021 by Ram Gall 3 Replies
On August 3, 2021, the Wordfence Threat Intelligence team initiated the disclosure process for two vulnerabilities we discovered in the Gutenberg Template Library & Redux Framework plugin, which is installed on over 1 million WordPress sites. One vulnerability allowed users with lower permissions, such as contributors, to install and activate arbitrary plugins and delete any …
Read More
This entry was posted in Research, Vulnerabilities, WordPress Security on August 25, 2021 by Ram Gall 0 Replies
On August 13, 2021, the Wordfence Threat Intelligence team responsibly disclosed two vulnerabilities in Nested Pages, a WordPress plugin installed on over 80,000 sites that provides drag and drop functionality to manage your page structure and post ordering. These vulnerabilities included a Cross-Site Request Forgery vulnerability that allowed posts and pages to be deleted, unpublished …
Read More
This entry was posted in Research, Vulnerabilities, WordPress Security on August 24, 2021 by Chloe Chamberland 12 Replies
On July 30, 2021 the Wordfence Threat Intelligence team initiated the responsible disclosure process for a vulnerability that we discovered in Booster for WooCommerce, a WordPress plugin installed on over 80,000 sites. This flaw made it possible for an attacker to log in as any user, as long as certain options were enabled in the …
Read More
This entry was posted in Research, Vulnerabilities, WordPress Security on August 16, 2021 by Chloe Chamberland 2 Replies
On July 29, 2021 the Wordfence Threat Intelligence team initiated the responsible disclosure process for a vulnerability that we discovered in SEOPress, a WordPress plugin installed on over 100,000 sites. This flaw made it possible for an attacker to inject arbitrary web scripts on a vulnerable site which would execute anytime a user accessed the …
Read More
This entry was posted in Research, WordPress Security on August 13, 2021 by Ned Andonov 21 Replies
In today’s post we discuss emerging techniques that attackers are using to hide the presence of malware. In the example we discuss below, the attacker’s goal is to make everything look routine to an analyst so that they do not dig deeper and discover the presence of malware and what it is doing. We describe …
Read More
This entry was posted in Research, WordPress Security on August 11, 2021 by Chloe Chamberland 0 Replies
Wordfence has collaborated with WPScan to conduct a 2021 mid-year review on the state of WordPress security. Using attack data from Wordfence’s internal threat intelligence platform, and vulnerability data from WPScan’s vulnerability database, we were able to analyze the current trend of attacks on WordPress and assess the current state of WordPress security. In the …
Read More
