https://ithemes.com/wordpress-vulnerability-roundup-september-2019-part-2/
Several new WordPress plugin and theme vulnerabilities were disclosed during the last half of September, so we want to keep you aware. In this post, we cover recent WordPress plugin and theme vulnerabilities and what to do if you are running one of the vulnerable plugins or themes on your website.
We divide the WordPress Vulnerability Roundup into four different categories:
- 1. WordPress core
- 2. WordPress Plugins
- 3. WordPress Themes
- 4. Breaches From Around the Web
*We include breaches from around the web because it is essential to also be aware of vulnerabilities outside of the WordPress ecosystem. Exploits to server software can expose sensitive data. Database breaches can expose the credentials for the users on your site, opening the door for attackers to access your site.
WordPress Core Vulnerabilities
WordPress Plugin Vulnerabilities
Several new WordPress plugin vulnerabilities have been discovered this August. Make sure to follow the suggested action below to update the plugin or completely uninstall it.
1. Woody Ad Snippets
Woody Ad Snippets version 2.2.8 and below is vulnerable to a Cross-Site Scripting attack.
What You Should Do
2. Easy FancyBox
Easy FancyBox version 1.8.17 and below is vulnerable to a Cross-Site Scripting attack.
What You Should Do
3. Advanced AJAX Product Filters
Advanced AJAX Product Filters version 1.3.6 and below is vulnerable to an Unauthenticated Settings Update. The vulnerability would allow an attacker to redirect traffic to a malicious site.
What You Should Do
4. Give
Give version 2.5.4 and below is vulnerable to an Authentication Bypass attack.
What You Should Do
5. Motors Car Dealer & Classified Ads
Motors Car Dealer & Classified Ads version 1.4.0 and below has multiple vulnerabilities including an Unauthenticated Settings Import and Export leading to a Stored Cross-Site Scripting attack. The vulnerability would allow an attacker to redirect traffic to a malicious site.
What You Should Do
6. Ultimate FAQ
Ultimate FAQ version 1.8.24 and below is vulnerable to an Unauthenticated Settings Import and Export attack.
What You Should Do
7. DELUCKS SEO
DELUCKS SEO version 2.1.7 and below have an Unauthenticated Option Update vulnerability.
What You Should Do
8. Rich Reviews
Rich Reviews version 1.7.4 and below has an Unauthenticated Plugin Options Update vulnerability.
What You Should Do
WordPress Themes
9. Selio – Real Estate Directory
Selio – Real Estate Directory version 1.1 and below has a SQL Injection and Persistent Cross-Site Scripting vulnerability.
What You Should Do
10. Nexos – Real Estate
Nexos – Real Estate version 1.1 and below has a SQL Injection and Persistent Cross-Site Scripting vulnerability.
What You Should Do
How to Be Proactive About WordPress Theme & Plugin Vulnerabilities
Running outdated software is the number one reason WordPress sites are hacked. It is crucial to the security of your WordPress site that you have an update routine. You should be logging into your sites at least once a week to perform updates.
Automatic Updates Can Help
Automatic updates are a great choice for WordPress websites that don’t change very often. Lack of attention often leaves these sites neglected and vulnerable to attacks. Even with recommended security settings, running vulnerable software on your site can give an attacker an entry point into your site.
Using the iThemes Security Pro plugin’s Version Management feature, you can enable automatic WordPress updates to ensure you are getting the latest security patches. These settings help protect your site with options to automatically update to new versions or to increase user security when the site’s software is outdated.
Version Management Update Options
- WordPress Updates –Automatically install the latest WordPress release.
- Plugin Automatic Updates – Automatically install the latest plugin updates. This should be enabled unless you actively maintain this site on a daily basis and install the updates manually shortly after they are released.
- Theme Automatic Updates – Automatically install the latest theme updates. This should be enabled unless your theme has file customizations.
- Granular Control over Plugin and Theme updates – You may have plugins/themes that you’d like to either manually update, or delay the update until the release has had time to prove stable. You can choose Custom for the opportunity to assign each plugin or theme to either update immediately (Enable), not update automatically at all (Disable) or update with a delay of a specified amount of days (Delay).
Strengthening and Alerting to Critical Issues
- Strengthen Site When Running Outdated Software – Automatically add extra protections to the site when an available update has not been installed for a month. The iThemes Security plugin will automatically enable stricter security when an update has not been installed for a month. First, it will force all users that do not have two-factor enabled to provide a login code sent to their email address before logging back in. Second, it will disable the WP File Editor (to block people from editing plugin or theme code), XML-RPC pingbacks and block multiple authentication attempts per XML-RPC request (both of which will make XML-RPC stronger against attacks without having to turn it off completely).
- Scan for Other Old WordPress Sites – This will checks for other outdated WordPress installs on your hosting account. A single outdated WordPress site with a vulnerability could allow attackers to compromise all the other sites on the same hosting account.
- Send Email Notifications – For issues that require intervention, an email is sent to admin-level users.
Breaches From Around the Web
1. DoorDash
DoorDash disclosed in a blog post that 4.9 million customers, merchants, and employees data was compromised during a breach that took place on May 4, 2019.
The breach included names, email addresses, physical addresses, phone numbers, and hashed passwords. Luckily they didn’t store the passwords in plain text so it will be very difficult for the attacker to decipher and use the passwords.
The last 4 digits of some credit cards were compromised but no full credit card numbers or CVV numbers were accessed.
Unfortunately, some of the employee drivers license numbers were included in the breach.
If you are a DoorDash customer you can contact them at the dedicated call center the setup for support at 855–646–4683
2. LastPass
Chrome Project Zero discovered and disclosed a vulnerability in the LastPass extension for Chrome and Opera. The vulnerability would allow a malicious website to generate a popup and bypass the do_popupregister() to gain the credentials of the last account logged in using LastPass.
There is no evidence that this vulnerability was ever exploited in the wild and LastPass did release a patch for the Chrome and Opera versions of their extension.
The vulnerability does highlight the importance of using two-factor authentication and makes me ever more excited about the passwordless future.
Get iThemes Security
The post WordPress Vulnerability Roundup: September 2019, Part 2 appeared first on iThemes.
Source: Security Feed