A few new WordPress plugin and theme vulnerabilities were disclosed during the second half of November, so we want to keep you aware. In this post, we cover recent WordPress plugin, theme and core vulnerabilities and what to do if you are running one of the vulnerable plugins or themes on your website.

The WordPress Vulnerability Roundup is divided into four different categories:

  • 1. WordPress core
  • 2. WordPress plugins
  • 3. WordPress themes
  • 4. Breaches from around the web

Note: You can skip ahead to the Vulnerability Summary Chart for the second part of November 2019 listed below.

WordPress Core Vulnerabilities

No WordPress vulnerabilities were disclosed in the second half of November 2019.

WordPress Plugin Vulnerabilities

Several new WordPress plugin vulnerabilities have been discovered this November. Make sure to follow the suggested action below to update the plugin or completely uninstall it.

1. Sassy Social Share

WP Social Sharing Logo

Sassy Social Share version 3.3.3 and below is vulnerable to a Cross-Site Scripting attack.

What You Should Do

The vulnerability has been patched, and you should update it to version 3.3.4.

2. WP Maintenance

WP Maintenance Logo

WP Maintenance version 5.0.5 and below is vulnerable to a Cross-Site Request Forgery to Stored Cross-Site Scripting attack.

What You Should Do

The vulnerability has been patched, and you should update it to version 5.0.6.

3. Jetpack

Jetpack Logo

Jetpack versions 5.1-7.9 have a vulnerability in the Shortcode Embed Code.

What You Should Do

The vulnerability has been patched, and you should update it to version 7.9.1.

WordPress Themes

No new WordPress Theme vulnerabilities disclosed in the second half of November.

How to Be Proactive About WordPress Theme & Plugin Vulnerabilities

Running outdated software is the number one reason WordPress sites are hacked. It is crucial to the security of your WordPress site that you have an update routine. You should be logging into your sites at least once a week to perform updates.

Automatic Updates Can Help

Automatic updates are a great choice for WordPress websites that don’t change very often. Lack of attention often leaves these sites neglected and vulnerable to attacks. Even with recommended security settings, running vulnerable software on your site can give an attacker an entry point into your site.

Using the iThemes Security Pro plugin’s Version Management feature, you can enable automatic WordPress updates to ensure you are getting the latest security patches. These settings help protect your site with options to automatically update to new versions or to increase user security when the site’s software is outdated.

Version Management Update Options
  • WordPress Updates –Automatically install the latest WordPress release.
  • Plugin Automatic Updates – Automatically install the latest plugin updates. This should be enabled unless you actively maintain this site on a daily basis and install the updates manually shortly after they are released.
  • Theme Automatic Updates – Automatically install the latest theme updates. This should be enabled unless your theme has file customizations.
  • Granular Control over Plugin and Theme updates – You may have plugins/themes that you’d like to either manually update, or delay the update until the release has had time to prove stable. You can choose Custom for the opportunity to assign each plugin or theme to either update immediately (Enable), not update automatically at all (Disable) or update with a delay of a specified amount of days (Delay).
Strengthening and Alerting to Critical Issues
  • Strengthen Site When Running Outdated Software – Automatically add extra protections to the site when an available update has not been installed for a month. The iThemes Security plugin will automatically enable stricter security when an update has not been installed for a month. First, it will force all users that do not have two-factor enabled to provide a login code sent to their email address before logging back in. Second, it will disable the WP File Editor (to block people from editing plugin or theme code), XML-RPC pingbacks, and block multiple authentication attempts per XML-RPC request (both of which will make XML-RPC stronger against attacks without having to turn it off completely).
  • Scan for Other Old WordPress Sites – This will checks for other outdated WordPress installs on your hosting account. A single outdated WordPress site with a vulnerability could allow attackers to compromise all the other sites on the same hosting account.
  • Send Email Notifications – For issues that require intervention, an email is sent to admin-level users.

Managing Multiple WP Sites? Update Plugins, Themes & Core At Once from the iThemes Sync Dashboard

iThemes Sync is our central dashboard to help you manage multiple WordPress sites. From the Sync dashboard, you can view available updates for all your sites and then update plugins, themes and WordPress core with one click. You can also get daily email notifications when a new version update is available.

Breaches From Around the Web

We include breaches from around the web because it is essential to also be aware of vulnerabilities outside of the WordPress ecosystem. Exploits to server software can expose sensitive data. Database breaches can expose the credentials for the users on your site, opening the door for attackers to access your site.

1. T-Mobile Breach

T-Mobile Logo

T-Mobile is the latest company to fall victim to a data breach. T-Mobile’s cybersecurity team discovered that an attacker had gained unauthorized access to data related to T-Mobile prepaid wireless customers. The Security team was able to revoke the attacker’s access.

Thankfully no financial data, social security numbers, or passwords were compromised in the breach. However, the attackers would have had access to names, billing addresses, phone numbers, and account numbers.

If you are a prepaid T-Mobile customer you can reach out to T-Mobile support at 1-800-T-MOBILE.

Summary of WordPress Vulnerabilities for
November 2019, Part 2

Type
Vulnerability
Fix
Core
No WordPress Core vulnerabilities were disclosed in the second half of October 2019.
Plugins

Sassy Social Share version 3.3.3 and below is vulnerable to a Cross-Site Scripting attack.

The vulnerability has been patched, and you should update it to version 3.3.4.

WP Maintenance version 5.0.5 and below is vulnerable to a Cross-Site Request Forgery to Stored Cross-Site Scripting attack.

The vulnerability has been patched, and you should update it to version 5.0.6.

Jetpack versions 5.1-7.9 have a vulnerability in the Shortcode Embed Code.

The vulnerability has been patched, and you should update it to version 7.9.1.

A WordPress Security Plugin Can Help Secure Your Website

iThemes Security Pro, our WordPress security plugin, offers 30+ ways to secure and protect your website from common WordPress security vulnerabilities. With WordPress, two-factor authentication, brute force protection, strong password enforcement, and more, you can add an extra layer of security to your website.

Get iThemes Security

The post WordPress Vulnerability Roundup: November 2019, Part 2 appeared first on iThemes.