On June 19th, 2024, the Wordfence team received a submission for a Remote Code Execution via Twig Server-Side Template Injection vulnerability in WPML, a WordPress plugin with more than 1,000,000 active installations. This vulnerability can be leveraged to execute code remotely by authenticated users with access to the post editor.

Props to stealthcopter who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $1,639.00 for this discovery.

Paid Wordfence users received a firewall rule to protect against any exploits targeting this vulnerability on June 27, 2024. Sites using the free version of Wordfence received the same protection 30 days later on July 27, 2024.

Wordfence contacted the WPML team via their security issues form on June 27, 2024, but we didn’t get a response. After that, they tried to get connected with the OnTheGoSystems team via email on July 17, 2024, and via contact form on July 29, 2024, and received a response on August 1, 2024. After providing full disclosure details, the developer released the patch on August 20, 2024.

We urge users to update their sites with the latest patched version of WPML, version 4.6.13 at the time of this writing, as soon as possible.

Source: https://www.wordfence.com/blog/2024/08/1000000-wordpress-sites-protected-against-unique-remote-code-execution-vulnerability-in-wpml-wordpress-plugin

On August 19th, 2024, the Wordfence Threat Intelligence team discovered that a critical vulnerability was patched in Litespeed Cache, a WordPress plugin installed on over 5,000,000 sites. They found that it is possible for an unauthenticated attacker to spoof their user ID in vulnerable versions, which ultimately makes it possible for them to register as an administrative-level user and completely take over a WordPress site.

Paid Wordfence users received a firewall rule to protect against any exploits targeting this vulnerability on August 20th, 2024. Sites using the free version of Wordfence will receive the same protection 30 days later on September 19th, 2024.

While this vulnerability was not reported to the Wordfence Bug Bounty Program, it would’ve likely been awarded a bounty of around $23,400 – $31,200 during our ongoing Superhero Challenge, given the information known about the vulnerability.

We strongly advise users to update their sites with the latest patched version of Litespeed Cache, version 6.4.1 at the time of this writing, as soon as possible. We have no doubts that this vulnerability will be actively exploited very soon.

Source and more details: https://www.wordfence.com/blog/2024/08/over-5000000-site-owners-affected-by-critical-privilege-escalation-vulnerability-patched-in-litespeed-cache-plugin

On May 26th, 2024, a submission was received by Wordfence for an unauthenticated PHP Object Injection to Remote Code Execution vulnerability in GiveWP, a WordPress plugin with more than 100,000 active installations. This vulnerability can be leveraged via an existing POP chain present in the plugin to execute code remotely and delete arbitrary files.

Props to villu164 who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $4,998.00 for this discovery.

All Wordfence customers are protected against any exploits targeting this vulnerability by the Wordfence firewall’s built-in PHP Object Injection protection.

We contacted the StellarWP team on June 13, 2024. After not receiving a reply, we escalated the issue to the WordPress.org Security Team on July 6, 2024. After that, the developer team released a patch on August 7, 2024.

We urge users to update their sites with the latest patched version of GiveWP, version 3.14.2 at the time of this writing, as soon as possible.

On June 25th, 2024, during the 0-day Threat Hunt Promo of the Wordfence Bug Bounty Program, a submission was received for an Arbitrary File Read and Delete vulnerability in the InPost PL and InPost for WooCommerce WordPress plugins with over 7,000 and 3,000 active installations. This vulnerability makes it possible for unauthenticated threat actors to read and delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.

Props to 1337_Wannabe who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $450.00 for this discovery during the 0-day Threat Hunt Promo.

All Wordfence users are protected against any exploits targeting this vulnerability by the Wordfence firewall’s built-in Local File Inclusion protection.

Wordfence provided full disclosure details to the Inspire Labs Team on July 4, 2024, and on July 10, 2024. The developer released a patch on July 10, 2024 for the InPost PL plugin, and removed the InPost for WooCommerce plugin from the repository on August 8, 2024.

We urge users to update their sites with the latest patched version of InPost PL, which is version 1.4.5, as soon as possible. We also recommend that users who are still using the removed InPost for WooCommerce plugin delete it from their sites and install the InPost PL plugin instead.

Source and more details: https://www.wordfence.com/blog/2024/08/10000-wordpress-sites-affected-by-arbitrary-file-read-and-delete-vulnerability-in-inpost-pl-and-inpost-for-woocommerce-wordpress-plugins

On July 11th, 2024, a submission was received by Wordfence for an unauthenticated Remote Code Execution vulnerability in JS Help Desk, a WordPress plugin with more than 5,000 active installations. This vulnerability can be leveraged to execute code remotely.

Props to Connor Billings who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $716.00 for this discovery.

Paid Wordfence users received a firewall rule to protect against any exploits targeting this vulnerability on July 25, 2024. Sites using the free version of Wordfence will receive the same protection 30 days later on August 24, 2024.

Wordfence contacted the JS Help Desk team on July 25, 2024, and received a response on the same day. After providing full disclosure details, the developer released the first patch on July 29, 2024, and the second patch on August 5, 2024. We would like to commend the JS Help Desk team for their prompt response and timely patch.

We urge users to update their sites with the latest patched version of JS Help Desk, version 2.8.7 at the time of this writing, as soon as possible.

Source and more details: https://www.wordfence.com/blog/2024/08/5000-wordpress-sites-affected-by-unauthenticated-remote-code-execution-vulnerability-in-js-help-desk-wordpress-plugin