WordPress 6.0 Released

The majority of our client sites have already been upgraded to WP 6.0. We’ll be upgrading the rest in the near future – once we have taken recent backups of the site at the current 5.9.3 version. To our knowledge only one site has had any problems, but do let us know if the upgrade has broken anything on your site!

Critical Privilege Escalation Vulnerability in Jupiter and JupiterX Premium Themes

The Wordfence Threat Intelligence team discovered a set of vulnerabilities in the Jupiter and JupiterX Premium themes and the required JupiterX Core companion plugin for WordPress, which included a critical privilege escalation vulnerability that allowed any user to become an administrator.

Fully patched versions of all vulnerable components were made available on May 10, 2022.

Full details at: https://www.wordfence.com/blog/2022/05/critical-privilege-escalation-vulnerability-in-jupiter-and-jupiterx-premium-themes

You Need to Update iOS, Android, and Chrome Right Now

APRIL HAS BEEN a big month for security updates, including emergency patches for Apple’s iOS and Google Chrome to fix vulnerabilities already being used by attackers.

Microsoft has released important fixes as part of its mid-April Patch Tuesday, while Android users across multiple devices need to make sure they are applying the latest update when it becomes available.

Apple iOS and iPadOS 15.4.1, macOS 12.3.1

Just two weeks after the launch of iOS 15.4, Apple issued iOS and iPad 15.4.1 to fix a vulnerability in AppleAVD that’s already being used to attack iPhones. By exploiting the vulnerability, labeled CVE-2022-22675, adversaries could execute arbitrary code with kernel privileges via an app, according to Apple’s support page. This could give an attacker full control over your device, so it’s important to apply the fix.

As an added bonus, iOS and iPadOS 15.4.1 fixes a battery drain issue affecting some iPhones on iOS 15.4. The updates are available for iPhone 6s and later, iPad Pro, iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch 7th generation.

Meanwhile, macOS Monterey 12.3.1 fixes the same issue in macOS, as well as another vulnerability in the Intel graphics driver, CVE-2022-22674, which could allow an app to read kernel memory. It’s another important fix—Apple says the issue may have been exploited by attackers.

Apple also released tvOS 15.4.1 and watchOS 8.5.1 including bug fixes.

Apple updates have been coming thick and fast over the past year, with the iPhone maker fixing a number of significant vulnerabilities, including the zero-click issue exploited by the Pegasus spyware, the highly targeted malware developed by Israeli firm NSO Group. This was the subject of a recent report by security researchers at Citizen Lab, who have detailed how Pegasus and other similar zero-click attacks targeted members of the European Parliament, legislators, political activists, and civil society organizations.

A zero-click attack is particularly scary because, as the name implies, it requires no interaction to work. That means an image sent via iMessage could infect your iPhone with spyware.

Citizen Lab detailed a previously undisclosed iOS zero-click vulnerability called HOMAGE used by NSO Group. Some iOS versions prior to iOS 13.2 could be at risk, making it all the more important your iPhone is up to date.Android’s April 2022 Patches

Android users also need to be on alert, as Google has patched 44 flaws in its mobile operating system this month. According to Google’s Android Security Bulletin, the most severe issue in the framework component could allow local privilege escalation without any interaction from the user.

The update is split into two parts: the 2022-04-01 security patch level for most Android devices, and the 2022-04-05 security patch level applying to specific phones and tablets. The later of the two fixes 30 issues in system and kernel components, among other areas. There are also patches for five security issues specific to Google’s Pixel smartphones, one of which could allow an app to escalate privileges and execute code on certain versions of Linux.

To find the update, you’ll need to check your device settings. Devices that have received the Android April update so far include Google’s Pixel devices and some third-party Android phones, including the Samsung Galaxy A32 5G, A51, A52 5G, A53 5G, A71, S10 series, S20 series, Note20 series, Z Flip 5G, Z Flip3, Z Fold, Z Fold2, and the Z Fold3, as well as the OnePlus 9 and OnePlus 9 Pro.Google Chrome Emergency Updates

As the world’s biggest browser with over 3 billion users, it’s no surprise attackers are targeting Google Chrome. Browser-based attacks are particularly worrying because they can potentially be chained together with other vulnerabilities and used to take over your device.

It has been a particularly busy month for the team behind Google’s Chrome browser, which has seen several security updates within weeks of each other. The latest, pushed out in mid-April, fixes two issues including a high-severity zero-day vulnerability, CVE-2022-1364, which is already being used by attackers.

The technical details aren’t currently available, but the timing of the fix—just a day after it was reported—indicates it’s pretty serious. If you use Chrome, your browser should now be on version 100.0.4896.127 to include the fix. You’ll need to restart Chrome after the update has installed to ensure it activates.

The Chrome issue also impacts other Chromium-based browsers, including Brave, Microsoft Edge, Opera, and Vivaldi, so if you use one of those, make sure you apply the patch.

But that’s not all. On April 27, Google announced another Chrome update, fixing 30 security vulnerabilities. None of these have been exploited yet, the company says, but seven are rated as being a high risk. The update takes the browser to version 101.0.4951.41.

Microsoft’s Busy April Patch Tuesday

Microsoft had a major Patch Tuesday in April, issuing fixes for over 100 vulnerabilities, including 10 critical RCE flaws. One of the most important, CVE-2022-24521, is already being exploited by attackers, according to the company.

Reported by the NSA and researchers at CrowdStrike, the issue in the Windows Common Log File system driver doesn’t require human interaction to be exploited and can be used to obtain administrative privileges on a logged-in system. Other notable fixes include CVE-2022-26904—a publicly known issue—and CVE-2022-26815, a severe DNS Server flaw.

Mozilla Thunderbird 91.8.0 Fix

On April 5, Mozilla released a patch to fix security issues in its Thunderbird email client as well as its Firefox browser. The details are scant, but Thunderbird 91.8 fixes four vulnerabilities rated as having a high impact, some of which could be exploited to run arbitrary code.

Firefox ESR 91.8 and Firefox 99 also fix multiple security issues.

Source: https://www.wired.com/story/ios-android-chrome-updates-april-2022/

PHP Object Injection Vulnerability in Booking Calendar Plugin

On April 18, 2022, the Wordfence Threat Intelligence team initiated the responsible disclosure process for an Object Injection vulnerability in the Booking Calendar plugin for WordPress, which has over 60,000 installations.

They received a response the same day and sent over their full disclosure early the next day, on April 19, 2022. A patched version of the plugin, 9.1.1, was released on April 21, 2022.

As usual, all our ProtectYourWP clients who use this plugin were updated to the patched version within 24 hrs of its release.

Source: https://www.wordfence.com/blog/2022/04/php-object-injection-in-booking-calendar-plugin

Critical Remote Code Execution Vulnerability in Elementor

WordFence discovered a critical vulnerability in the Elementor plugin that allowed any authenticated user to upload arbitrary PHP code. Elementor is one of the most popular WordPress plugins and is installed on over 5 million websites.

A patched version of the plugin, 3.6.3, was released on April 12, 2022.

This is a critical vulnerability that allows any authenticated user to upload and execute malicious code on a site running a vulnerable version of the Elementor plugin. The good news is that the vulnerability is not present in versions prior to 3.6.0 and was successfully patched in 3.6.3.

Source: https://www.wordfence.com/blog/2022/04/elementor-critical-remote-code-execution-vulnerability

WordPress Plugin ‘Social Warfare’ < 3.5.3 XSS

Malicious eval() is being inserted into the wp_options table, in the option_name: social_wafare_settings, in the Twitter field.

When the plugin is active, it causes the site to issue a JavaScript redirect to porn sites.

Deactivating the plugin disables the redirect, but the malicious eval() is still in the database.

The plugin has been pulled from the WordPress repository.

https://wordpress.org/support/topic/malware-into-new-update/

So far we have seen this exploited on live sites running 3.5.1 and 3.5.2.

Source: https://www.tenable.com/plugins/nessus/159570

See also: https://wpscan.com/vulnerability/9238

Critical Authentication Bypass Vulnerability Patched in SiteGround Security Plugin

On March 10, 2022 the Wordfence Threat Intelligence team initiated the responsible disclosure process for a vulnerability they discovered in “SiteGround Security”, a WordPress plugin that is installed on over 400,000 sites. This flaw makes it possible for attackers to gain administrative user access on vulnerable sites when two-factor authentication (2FA) is enabled but not yet configured for an administrator.

A patch was released the next day on March 11, 2022. While the plugin was partially patched immediately, it wasn’t optimally patched until April 7, 2022.

SiteGround Security is a plugin designed to enhance the security of WordPress installations via several features like login security including 2FA, general WordPress hardening, activity monitoring, and more. It’s also worth noting that it comes pre-installed on all SiteGround hosted WordPress sites. Unfortunately, the 2FA functionality of the plugin was insecurely implemented making it possible for unauthenticated attackers to gain access to privileged accounts.

Source & more details: https://www.wordfence.com/blog/2022/04/critical-authentication-bypass-vulnerability-patched-in-siteground-security-plugin

Reflected XSS in Spam protection, AntiSpam, FireWall by CleanTalk

CleanTalk is a WordPress plugin designed to protect websites from spam comments and registrations. One of the features it includes is the ability to check comments for spam and present the spammy comments for deletion.

Thanks to a quirk of how WordPress processes the page parameter and the default PHP request order, it is possible to use this parameter to perform a reflected cross-site scripting attack, which is almost identical to a vulnerability recently covered by the folks at WordFence.

The vulnerability can be used to execute JavaScript in the browser of a logged-in administrator, for instance, by tricking them into visiting a self-submitting form that sends a POST request to the site at wp-admin/edit-comments.php?page=ct_check_spam, with the $_POST[‘page’] parameter set to malicious JavaScript.

As with any Cross-Site Scripting vulnerability, executing JavaScript in an administrator’s session can be used to take over a site by adding a new malicious administrator or injecting a backdoor, among other potential methods.

A patched version was released on March 25th and installed on all our clients’ websites the same day.

WordPress 5.9.2 Security Update Released – Fixes XSS and Prototype Pollution Vulnerabilities

WordPress core team released WordPress version 5.9.2 on March 10 which contains security patches for a high-severity vulnerability as well as two medium-severity issues.

The high-severity issue affects version 5.9.0 and 5.9.1 and allows contributor-level users and above to insert malicious JavaScript into WordPress posts. The Wordfence Threat Intelligence team was able to create a Proof of Concept for this vulnerability fairly quickly and released a firewall rule early on March 11, 2022, to protect WordPress sites that have not yet been updated.

The two medium-severity vulnerabilities impact WordPress versions earlier than 5.9.2 and potentially allow attackers to execute arbitrary JavaScript in a user’s session if they can trick that user into clicking a link, though there are no known practical exploits for these two vulnerabilities affecting WordPress. All versions of WordPress since WordPress 3.7 have also been updated with the fix for these vulnerabilities.

More details:

https://www.wordfence.com/blog/2022/03/wordpress-5-9-2-security-update-fixes-xss-and-prototype-pollution-vulnerabilities