Category Archives: Patched

WordPress 7.1.2 Release

Posted on

This security release features a fix for a critical severity security vulnerability.

Because this is a security release, it is recommended that you update your sites immediately.

You can download WordPress 7.1.2 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. [All applicable clients of ProtectYourWP.com have already been updated.] If you have sites that support automatic background updates, the update process will begin automatically.

Security update included in this release

The security team would like to thank Robert Ressl for responsibly disclosing that an unauthenticated attacker can, under certain conditions, make page template resolution include a chosen readable local PHP file outside the active theme directories. If relevant pre-conditions for both the server environment and the active theme are met, this can lead to remote code execution (RCE).

Source: https://wordpress.org/news/2026/09/wordpress-7-1-2-release/

WordPress 7.1.1 Maintenance and Security Release

Posted on

This security and maintenance release features 17 bug fixes on Core, 19 bug fixes for the Block Editor, and 11 security fixes.

Because this is a security release, it is recommended that you update your sites immediately.

You can download WordPress 7.1.1 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. [All applicable client sites of ProtectYourWP.com have already been updated.] If you have sites that support automatic background updates, the update process will begin automatically.

WordPress 7.1.1 is a short-cycle release. The next major release will be version 7.2 and is currently planned for December.

For more information, please visit the WordPress 7.1.1 HelpHub site.

Security updates included in this release

The security team would like to thank the following people for responsibly reporting vulnerabilities, and allowing them to be fixed in this release:

  • Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.).
  • HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team.
  • Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team.
  • Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai.
  • Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil.
  • Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.
  • XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css, reported by Ben Bidner of the WordPress Security Team.
  • Contributor+ Arbitrary Post Overwrite, reported by Anthropic.
  • Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec.
  • Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by Jakub Herman.
  • Comments, including notes, can be reparented by any authenticated user, reported by Justin Hart, Viridis Security.

Source: https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/

WordPress Tourfic Plugin <= 2.22.7 is vulnerable to a high priority SQL Injection

Posted on

Risks

CVSS 9.3

This vulnerability is highly dangerous and expected to become exploited. Vulnerabilities like this one are used in mass-exploit campaigns. Attackers use these to attack thousands of websites at a time, regardless of traffic size or popularity. Learn more.

As immediate action, update the affected plugin. If you’re unable to do so, ask your hosting provider or web developer for help.

9.3

SQL Injection

This could allow a malicious actor to directly interact with your database, including but not limited to stealing information.

CVSS score is a way to evaluate and rank reported vulnerabilities in a standardized and repeatable way but which is not ideal for WordPress.

Solutions

Update to version 2.22.8 or later.

Update to version 2.22.8 or later to resolve the vulnerability. Patchstack users can turn on auto-update for vulnerable plugins only.

Source: https://patchstack.com/database/wordpress/plugin/tourfic/vulnerability/wordpress-tourfic-ai-powered-travel-booking-hotel-booking-car-rental-wordpress-plugin-plugin-2-22-7-unauthenticated-sql-injection-vulnerability

Interesting WordPress Malware Disguised as Legitimate Anti-Malware Plugin

Posted on

The Wordfence Threat Intelligence team recently discovered an interesting malware variant that appears in the file system as a normal WordPress plugin, often with the name ‘WP-antymalwary-bot.php’, and contains several functions that allow attackers to maintain access to your site, hide the plugin from the dashboard, and execute remote code. Pinging functionality that can report back to a Command & Control (C&C) server is also included, as is code that helps spread malware into other directories and inject malicious JavaScript responsible for serving ads.

This malware was first discovered by one of Wordfence’s security analysts during a site clean on January 22, 2025. A malware signature was developed on January 24, 2025 and released to Wordfence premium customers within three days after undergoing our QA process. Customers using the free version of Wordfence received the same signature on February 26, 2025 after a 30 day delay. New versions of the malware have since surfaced, all which are detected by the malware signature released back in January. However, for added protection Wordfence released a firewall rule on April 23, 2025 to all Wordfence paid users preventing execution of the file. Site owners using the free version of the Wordfence plugin will receive the same added coverage on May 23, 2025.

Source and more details: https://www.wordfence.com/blog/2025/04/interesting-wordpress-malware-disguised-as-legitimate-anti-malware-plugin

30,000 WordPress Sites Affected by Arbitrary File Upload Vulnerability in Security & Malware scan by CleanTalk WordPress Plugin

Posted on

On December 7th, 2024, Wordfence received a submission for an Arbitrary File Upload vulnerability in Security & Malware scan by CleanTalk, a WordPress plugin with more than 30,000 active installations. This vulnerability makes it possible for an unauthenticated attacker to upload arbitrary files to a vulnerable site and achieve remote code execution.

Props to Lucio Sá who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $1,716.00 for this discovery.

Paid Wordfence users received a firewall rule to protect against any exploits targeting this vulnerability on January 14, 2025. Sites using the free version of Wordfence will receive the same protection 30 days later on February 13, 2025.

Wordfence contacted the CleanTalk team on January 13, 2025, and received a response on the next day. After providing full disclosure details, the developer released a patch on January 27, 2025. We would like to commend the CleanTalk team for their prompt response and timely patch.

We urge users to update their sites with the latest patched version of Security & Malware scan by CleanTalk, version 2.150 at the time of this writing, as soon as possible.

Source and more details: https://www.wordfence.com/blog/2025/02/30000-wordpress-sites-affected-by-arbitrary-file-upload-vulnerability-in-security-malware-scan-by-cleantalk-wordpress-plugin

6,000,000 WordPress Sites Protected Against Payment Refund and Subscription Cancellation Vulnerability in WPForms WordPress Plugin

Posted on

On October 23th, 2024, Wordfence received a submission for a Missing Authorization to Payment Refund and Subscription Cancellation vulnerability in WPForms, a WordPress plugin with more than 6,000,000 active installations. This vulnerability makes it possible for an authenticated attacker, with subscriber-level access and above, to refund Stripe payments and cancel Stripe subscriptions.

Props to villu164 who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $2,376.00 for this discovery.

We’d also like to say a special congratulations to villu164, who became the first researcher to earn the WordPress Superhero badge through the Wordfence Bug Bounty Program!

Paid Wordfence users received a firewall rule to protect against any exploits targeting this vulnerability on November 15, 2024. Sites using the free version of Wordfence will receive the same protection 30 days later on December 15, 2024.

Wordfence sent the full disclosure details to the Awesome Motive team on November 14, 2024, and received a response on the next day. The developer released a patch on November 18, 2024. We would like to commend the Awesome Motive team for their prompt response and timely patch.

We urge users to update their sites with the latest patched version of WPForms, version 1.9.2.2 at the time of this writing, as soon as possible.

Source: https://www.wordfence.com/blog/2024/12/6000000-wordpress-sites-protected-against-payment-refund-and-subscription-cancellation-vulnerability-in-wpforms-wordpress-plugin

200,000 WordPress Sites Affected by Unauthenticated Critical Vulnerabilities in Anti-Spam by CleanTalk WordPress Plugin

Posted on

On October 30th, 2024, we received a submission for an Authorization Bypass via Reverse DNS Spoofing vulnerability in Anti-Spam by CleanTalk, a WordPress plugin with more than 200,000 active installations. This vulnerability makes it possible for an unauthenticated attacker to install and activate arbitrary plugins on a vulnerable site, which can be leveraged to achieve remote code execution. A few days later on November 4th, our Threat Intelligence Team discovered another vulnerability in the same functionality that could be leveraged to perform the same actions.

Props to mikemyers who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $4,095.00 for this discovery.

Paid Wordfence users received a firewall rule to protect against any exploits targeting the first vulnerability, Authorization Bypass via Reverse DNS Spoofing, on October 30, 2024. Sites using the free version of Wordfence will receive the same protection 30 days later on November 29, 2024.

Paid Wordfence users received a firewall rule to protect against any exploits targeting the second vulnerability, Authorization Bypass due to Missing Empty Value Check, on November 4, 2024. Sites using the free version of Wordfence will receive the same protection 30 days later on December 4, 2024.

Wordfence contacted the CleanTalk team on October 30, 2024, and received a response on the same day. After providing full disclosure details, the developer released the first patch on November 1, 2024, and the second patch on November 14, 2024. We would like to commend the CleanTalk team for their prompt response and timely patch.

We urge users to update their sites with the latest patched version of Anti-Spam by CleanTalk, version 6.45 at the time of this writing, as soon as possible. All clients of ProtectYourWP.com were updated within 24 hrs of the patch releases.

Source and more details: https://www.wordfence.com/blog/2024/11/200000-wordpress-sites-affected-by-unauthenticated-critical-vulnerabilities-in-anti-spam-by-cleantalk-wordpress-plugin

Over 8,000 Exploit Attempts Already Blocked For Recently Patched Unauthenticated Arbitrary File Upload Vulnerability in 简数采集器 (Keydatas) WordPress Plugin

Posted on

On June 18th, 2024, during the 0-day Threat Hunt Promo of the Wordfence Bug Bounty Program, a submission was received for an Unauthenticated Arbitrary File Upload vulnerability in 简数采集器 (Keydatas), a WordPress plugin with more than 5,000 active installations. This vulnerability makes it possible for unauthenticated threat actors to upload arbitrary files to a vulnerable site and achieve remote code execution, which is typically leveraged for a complete site takeover.

Within a few days of the vulnerability record being published, Wordfence already started seeing active exploitation of this vulnerability in the wild with over 8,000 exploit attempts blocked as of this publication (July 31). This highlights the importance of keeping plugins and themes regularly up to date, conducting regular vulnerability scans, and trusting Wordfence for your firewall protection.

Props to Foxyyy who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $488.00 for this discovery during the 0-day Threat Hunt Promo.

Paid Wordfence users received a firewall rule to protect against any exploits targeting this vulnerability on June 20, 2024. Sites using the free version of Wordfence received the same protection 30 days later on July 20, 2024.

Wordfence contacted the Keydatas team on June 20, 2024. After not receiving a reply they escalated the issue to the WordPress.org Security Team on July 12, 2024 who closed the plugin on July 16, 2024. After that, the developer released a patch on July 29, 2024.

We urge users to update their sites with the latest patched version of 简数采集器 (Keydatas), version 2.6.1 at the time of this publication, as soon as possible.

Source and more details: https://www.wordfence.com/blog/2024/07/over-8000-exploit-attempts-already-blocked-for-recently-patched-unauthenticated-arbitrary-file-upload-vulnerability-in-keydatas-wordpress-plugin

Unauthenticated Privilege Escalation in Profile-Builder plugin

Posted on

During a routine audit of various WordPress plugins, we identified some issues in Profile Builder and Profile Builder Pro (50k+ active installs). Researchers discovered an Unauthenticated Privilege Escalation Vulnerability which could allow attackers to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions.

This vulnerability was fixed on July 11th, with version 3.11.9. All ProtectYourWP.com clients who use this plugin have been updated.

Source and more details: https://wpscan.com/blog/unauthenticated-privilege-escalation-in-profile-builder-plugin/

WordPress 6.5.5 Security Release – What You Need to Know

Posted on

WordPress Core 6.5.5 was released on June 24, 2024. Contained within this release are three security fixes addressing two Cross-Site Scripting (XSS) vulnerabilities and one Windows-specific Directory Traversal vulnerability. Despite these vulnerabilities being medium-severity, the worst of them (specifically, the XSS vulnerabilities) can allow for site takeover by an authenticated, contributor-level user if successfully exploited.

The Directory Traversal vulnerability has been backported to every version of WordPress since 4.1, with the XSS vulnerabilities being backported to the major version in which the functionality was released. WordPress has supported automatic core updates for security releases since WordPress 3.7, and the vast majority of WordPress sites should receive a patch for their major version of WordPress automatically over the next 24 hours. We recommend verifying that your site has been automatically updated to one of the patched versions. Patched versions are available for every major version of WordPress since 4.1, so you can update without risking compatibility issues.

The Wordfence Threat Intelligence Team released a new firewall rule the same day to protect paid customers for one of the XSS vulnerabilities that didn’t have adequate protection.This rule will be available to free Wordfence users in 30 days, on July 24th, 2024. All Wordfence users have protection for the remaining two vulnerabilities.

Source and more details: https://www.wordfence.com/blog/2024/06/wordpress-6-5-5-security-release-what-you-need-to-know and https://wordpress.org/news/2024/06/wordpress-6-5-5/