October’s critical WordPress plugin flaws, and the ones a small business is likely to run

The short version

Most of these are fixed in the plugin’s next release, so for most sites the answer is the same every month: keep plugins updated, and remove the ones you don’t use. The ones below matter most because they are critical, need no login (or only a basic account), and sit in the kinds of plugins we see on Grand Strand business sites. Versions listed are the affected ones, as published; the fix is any release newer than that.

Every flaw here is searchable in our vulnerability database, with links to the original reports.

Forms, popups and email

• MailOptin (popups and email sign-ups), up to 1.2.78.6: privilege escalation, CVSS 9.8.
• Super Forms, up to 6.3.316: privilege escalation, CVSS 9.8.
• Extensions For CF7 (Contact Form 7 database, conditional fields and redirects), up to 3.4.5: arbitrary file upload, CVSS 9.8.
• click5 CRM add-ons for Contact Form 7, Gravity Forms, WPForms and Ninja Forms: missing authorization checks, CVSS 9.8 each.
• SimpleForm, up to 3.10.0: privilege escalation, CVSS 9.8.

Stores, bookings and memberships

• Abandoned Cart Pro for WooCommerce, up to 10.8.0: SQL injection and an authentication bypass, CVSS 9.8 each.
• Divi Membership: privilege escalation (up to 2.2.0) and an authentication bypass (up to 2.3.0), CVSS 9.8 each.
• My Calendar (event calendar), up to 3.8.7: privilege escalation, CVSS 9.8.
• Sunshine Photo Cart (photographer galleries and proofing), up to 3.7.4: PHP object injection, CVSS 9.8.
• 3D Product configurator for WooCommerce, up to 2.16.2: remote code execution, CVSS 9.8.

Speed, security and site tools

• 10Web Booster (speed and caching), up to 2.34.10: arbitrary file upload, CVSS 9.8.
• Advanced IP Blocker (a security plugin), up to 8.13.13: authentication bypass, CVSS 9.8.
• Theme My Login, up to 7.2.1: account takeover on some multisite setups, CVSS 9.8.
• Bricksforge (Bricks builder add-on), up to 3.1.8.9: file upload with no login, CVSS 9.8.
• LearnPress (online courses), up to 4.4.10: PHP object injection, CVSS 9.8.

What to do

1. Update everything that has an updateIn WordPress, go to Dashboard, then Updates, and update plugins and themes. Take a backup first if your host doesn’t do it nightly.
2. Delete plugins you don’t useA deactivated plugin can still be attacked if its files are on the server. If you don’t use it, delete it.
3. Watch for plugins that stopped updatingIf a plugin hasn’t had an update in a year, or was pulled from WordPress.org, plan to replace it.
4. Run our free checkOur website check reads the plugin versions your pages show and flags the ones with known flaws.

Sources

• Our vulnerability database: critical WordPress flaws
• National Vulnerability Database
• Wordfence Intelligence
• WPScan vulnerability database
• Patchstack database