Wordfence Intelligence Weekly WordPress Vulnerability Report (Mar 13, 2023 to Mar 19, 2023)
Last week, there were 92 vulnerabilities disclosed in 76 WordPress Plugins and 7 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 34 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface and vulnerability API are completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- UpdraftPlus 1.22.14 to 1.23.2 and UpdraftPlus (Premium) 2.22.14 to 2.23.2 – Privilege Escalation via updraft_central_ajax_handler
- WAF-RULE-565 – Data redacted while we work with the developer to ensure the vulnerability protected by this WAF rule gets patched.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
Patch Status | Number of Vulnerabilities |
Unpatched | 44 |
Patched | 48 |
Total Vulnerabilities by CVSS Severity Last Week
Severity Rating | Number of Vulnerabilities |
Low Severity | 0 |
Medium Severity | 80 |
High Severity | 11 |
Critical Severity | 1 |
Total Vulnerabilities by CWE Type Last Week
Vulnerability Type by CWE | Number of Vulnerabilities |
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) | 37 |
Cross-Site Request Forgery (CSRF) | 34 |
Missing Authorization | 13 |
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) | 3 |
Information Exposure | 3 |
Server-Side Request Forgery (SSRF) | 1 |
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) | 1 |
Researchers That Contributed to WordPress Security Last Week
Researcher Name | Number of Vulnerabilities |
Lana Codes | 10 |
Rio Darmawan | 7 |
Dave Jong | 6 |
rezaduty | 5 |
Mika | 4 |
minhtuanact | 3 |
Rafie Muhammad | 3 |
yuyudhn | 3 |
Rafshanzani Suhada | 3 |
Nithissh S | 3 |
Aman Rawat | 2 |
Marco Wotschka | 2 |
Cat | 2 |
TEAM WEBoB of BoB 11th | 2 |
Prasanna V Balaji | 2 |
Daniel Kelley | 2 |
Ayoub Safa | 2 |
Muhammad Daffa | 2 |
FearZzZz | 1 |
Bhuvanesh Jayaprakash | 1 |
Erwan LR | 1 |
Etan Imanol Castro Aldrete | 1 |
Dimas Aprilianto | 1 |
dc11 | 1 |
Shreya Pohekar | 1 |
Justiice | 1 |
Nguyen Anh Tien | 1 |
Vinay Kumar | 1 |
Abdi Pranata | 1 |
Brandon James Roldan | 1 |
Pavak Tiwari | 1 |
n0paew | 1 |
Fariq Fadillah Gusti Insani | 1 |
Le Ngoc Anh | 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and obtain a CVE ID through this form. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
Software Name | Software Slug |
Admin side data storage for Contact Form 7 | admin-side-data-storage-for-contact-form-7 |
Auto Rename Media On Upload | auto-rename-media-on-upload |
Backup Bank: WordPress Backup Plugin | wp-backup-bank |
Be POPIA Compliant | be-popia-compliant |
Branda – White Label WordPress, Custom Login Page Customizer | branda-white-labeling |
Bulk Resize Media | bulk-resize-media |
CF7 Invisible reCAPTCHA | cf7-invisible-recaptcha |
CMS Press | cms-press |
Calendar Event Multi View | cp-multi-view-calendar |
Chronoforms | chronoforms |
Contact Form 7 Redirect & Thank You Page | cf7-redirect-thank-you-page |
Contact Form 7 – PayPal & Stripe Add-on | contact-form-7-paypal-add-on |
Contact Form Email | contact-form-to-email |
Custom Options Plus | custom-options-plus |
Customify – Intuitive Website Styling | customify |
Data Tables Generator by Supsystic | data-tables-generator-by-supsystic |
Drag and Drop Multiple File Upload PRO – Contact Form 7 Standard | drag-n-drop-upload-cf7-pro |
Dynamics 365 Integration | integration-dynamics |
Easy Event calendar | easy-event-calendar |
Ecwid Ecommerce Shopping Cart | ecwid-shopping-cart |
Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files | embed-any-document |
Event Manager and Tickets Selling Plugin for WooCommerce | mage-eventpress |
Exxp | exxp-wp |
Fluid Checkout for WooCommerce – Lite | fluid-checkout |
Force First and Last Name as Display Name | force-first-last |
Google XML Sitemap for Images | google-image-sitemap |
Google XML Sitemap for Videos | xml-sitemaps-for-videos |
HT Feed | ht-instagram |
Hotel Booking Lite | motopress-hotel-booking-lite |
Import External Images | import-external-images |
Klaviyo | klaviyo |
LOGIN AND REGISTRATION ATTEMPTS LIMIT | login-attempts-limit-wp |
Modern Events Calendar Lite | modern-events-calendar-lite |
Modern Footnotes | modern-footnotes |
Open RDW kenteken voertuiginformatie | open-rdw-kenteken-voertuiginformatie |
PB SEO Friendly Images | pb-seo-friendly-images |
PhonePe Payment Solutions | phonepe-payment-solutions |
Photo Gallery, Images, Slider in Rbs Image Gallery | robo-gallery |
Popup Maker – Popup for opt-ins, lead gen, & more | popup-maker |
Print Invoice & Delivery Notes for WooCommerce | woocommerce-delivery-notes |
RapidLoad Power-Up for Autoptimize | unusedcss |
Redirection | redirect-redirection |
Return and Warranty Management System for WooCommerce | wc-return-warrranty |
Reusable Blocks Extended | reusable-blocks-extended |
SEO Plugin by Squirrly SEO | squirrly-seo |
SMTP2GO – Email Made Easy | smtp2go |
Shopping Cart & eCommerce Store | wp-easycart |
Site Reviews | site-reviews |
Slide Anything – Responsive Content / HTML Slider and Carousel | slide-anything |
Slideshow Gallery LITE | slideshow-gallery |
Solidres – Hotel booking plugin for WordPress | solidres |
Store Locator for WordPress with Google Maps – LotsOfLocales | store-locator |
Surbma | GDPR Proof Cookie Consent & Notice Bar | surbma-gdpr-proof-google-analytics |
Tags Cloud Manager | tags-cloud-manager |
UpdraftPlus WordPress Backup Plugin | updraftplus |
User Role by BestWebSoft – Add and Customize Roles and Capabilities in WordPress | user-role |
WH Testimonials | wh-testimonials |
WP Basic Elements | wp-basic-elements |
WP Express Checkout (Accept PayPal Payments Easily) | wp-express-checkout |
WP Job Portal – A Complete Job Board | wp-job-portal |
WP Popup Banners | wp-popup-banners |
WP Shortcode by MyThemeShop | wp-shortcode |
WP Simple Events | wp-simple-events |
WSB Brands | wsb-brands |
Website Monetization by MageNet | website-monetization-by-magenet |
WooCommerce Weight Based Shipping | weight-based-shipping-for-woocommerce |
WordPress Console | wordpress-console |
WordPress Email Marketing Plugin – WP Email Capture | wp-email-capture |
WordPress Mortgage Calculator Estatik | estatik-mortgage-calculator |
WordPress Online Booking and Scheduling Plugin – Bookly | bookly-responsive-appointment-booking-tool |
WordPress Plugin for Google Maps – WP MAPS | wp-google-map-plugin |
WordPress Simple Shopping Cart | wordpress-simple-paypal-shopping-cart |
WordPress WP-Advanced-Search | wp-advanced-search |
Yandex.News Feed by Teplitsa | yandexnews-feed-by-teplitsa |
eCommerce Product Catalog Plugin for WordPress | ecommerce-product-catalog |
wpml | wpml |
WordPress Themes with Reported Vulnerabilities Last Week
Software Name | Software Slug |
Brilliance | brilliance |
Chankhe | chankhe |
Mediciti Lite | mediciti-lite |
NewsMag | newsmag |
Real Estate Directory | real-estate-directory |
Regina Lite | regina-lite |
intrepidity | intrepidity |
Vulnerability Details
Be POPIA Compliant
Source: wordfence.com