To ensure that your WordPress website is secure and stays that way, you need to have a security plugin.

One reason is that they report regularly on critical vulnerabilities of plugins you might use.

There are few available, although my preference goes to Wordfence.

Critical vulnerabilities in WordPress plugins – January 2022

The Wordfence Threat Intelligence team found sofar these vulnerabilities:

Three Plugins With The Same Vulnerability

Three plugins installed on over 80,000 sites.

All three of the affected plugins by XootiX provide enhanced features to WooCommerce sites. The Login/Signup Popup plugin added login and signup pop-ups to both standard sites and WooCommerce powered sites, while the Waitlist WooCommerce plugin was designed to add a product waitlist and notifier for out of stock items and Side Cart Woocommerce was designed to make shopping carts available from anywhere on a site all powered via AJAX.

The vulnerability is simple. All three plugins register the save_settings function which is initiated via a wp_ajax action. This function was missing a nonce check which meant that there was no validation on the integrity of who was conducting the request.

This made it possible for an attacker to craft a request that would trigger the AJAX action and execute the function. If the attacker could successfully trick a site’s administrator into performing an action like clicking on a link or browsing to a certain website, while the administrator was authenticated to the target site, then the request would be successfully sent and trigger the action which would allow the attacker to update arbitrary options on that website.

Wordfence strongly recommends that WordPress users immediately verify that their site has been updated to the latest patched version available for each of these plugins, which is version 2.3 for “Login/Signup Popup”, version 2.5.2 for “Waitlist WooCommerce ( Back in stock notifier )”, and version 2.1 for “Side Cart Woocommerce (Ajax)” at the time of this publication.

Read full details

Unauthenticated XSS Vulnerability in HTML Email Template Designer Plugin

A WordPress plugin that is installed on over 20,000 sites.

WP HTML Mail is a WordPress plugin developed to make designing custom emails simpler for WordPress site owners. It is compatible with various WordPress plugins like WooCommerce, Ninja Forms, BuddyPress, and more.

A flaw that made it possible for unauthenticated attackers to inject malicious web scripts that would execute whenever a site owner accessed the mail editor area plugin, which could lead to complete site compromise.

WordPress site owners immediately verify that they have updated their site to the latest patched version available, which is version 3.1.

Read full details

WordPress 5.9 Release Imminent.

In 3 days' time (January 25th 2022) there will be a new release of WordPress that contains some significant changes to the block editor.

Combine all the features that went live in 5.8 with those entering in 5.9, and you get Full Site Editing.

All the best,

Luc

Thank you for your time. All you have to do now is click one of the buttons below to share with people you know or leave a comment. I thank you if you do ?