$493 Bounty Awarded for Arbitrary Options Update Vulnerability Patched in WP Datepicker WordPress Plugin
🎉 Did you know we’re running a Bug Bounty Extravaganza again?
Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through May 27th, 2024 when you opt to have Wordfence handle responsible disclosure!
On April 14th, 2024, during our Bug Extravaganza, we received a submission for an Arbitrary Options Update vulnerability in WP Datepicker, a WordPress plugin with more than 10,000 active installations. This vulnerability could be used by authenticated attackers, with subscriber-level access and above, to update arbitrary options which can easily be leveraged for privilege escalation.
Props to Lucio Sá who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $493.00 for this discovery during our Bug Bounty Program Extravaganza. Our mission is to Secure the Web, which is why we are investing in quality vulnerability research and collaborating with researchers of this caliber through our Bug Bounty Program. We are committed to making the WordPress ecosystem more secure, which ultimately makes the entire web more secure.
Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against any exploits targeting this vulnerability on April 16, 2024. Sites using the free version of Wordfence will receive the same protection 30 days later on May 16, 2024.
We contacted the developer Fahad Mahmood on April 16, 2024, and received a response on the same day. After providing full disclosure details the next day, the developer released the first patch on the same day. A fully patched version, 2.1.1, was released on April 19, 2024. We would like to commend Fahad Mahmood for their prompt response and timely patch.
We urge users to update their sites with the latest patched version of WP Datepicker, which is version 2.1.1, as soon as possible.
Vulnerability Summary from Wordfence Intelligence
Description: WP Datepicker
Source: wordfence.com