Really Simple Security logo

Log out
Get PRO

Latest

Code execution vulnerability in several plugins

  • Severity: critical
  • Status: Open
  • Publication: June 24, 2024

Several WordPress plugins available on WordPress.org have been compromised and now contain harmful code. Someone with bad intentions was able to change the code of these plugins and add a code that creates new, admin accounts.

Detected in:

BLAZE Retail Widget fixed vulnerable versions: >= 2.2.5 <= 2.5.2
Britetechs Companion fixed vulnerable versions: >= 2.2.7 <= 2.2.7
Contact Form 7 Multi-Step Addon fixed vulnerable versions: >= 1.0.4 <= 1.0.5
Contact Form Multi-Step Addon fixed vulnerable versions:
Pods – Custom Content Types and Fields fixed vulnerable versions: >= 3.2.3 <= 3.2.3
PowerPress Podcasting plugin by Blubrry fixed vulnerable versions: >= 11.9.3 <= 11.9.4
Simply Show Hooks fixed vulnerable versions: >= 1.2.1 <= 1.2.2
Twenty20 Image Before-After fixed vulnerable versions: >= 1.5.4 <= 1.5.4
WP Server Health Stats fixed vulnerable versions: >= 1.7.6 <= 1.7.6
WPCOM Member fixed vulnerable versions: >= 1.3.15 <= 1.3.15
Wrapper Link Elementor fixed vulnerable versions: >= 1.0.2 <= 1.0.3
Ad Invalid Click Protector (AICP) open vulnerable versions: >= 1.2.9 <= 1.2.9
Seo Optimized Images open vulnerable versions: >= 2.1.2 <= 2.1.2
Social Sharing Plugin – Social Warfare open vulnerable versions: >= 4.4.6.4 <= 4.4.7.1

This information is sourced from www.wpvulnerability.com. An open-source database of vulnerabilities maintained by the community. Help us out by submitting vulnerabilities!

Version compare shows which versions have a vulnerability. For example: >= 2.2.8 <= 2.2.21 means:

> from 2.2.8
= including 2.2.8 & 2.2.21
< to 2.2.21

  • Incorrect?

Is this information incorrect? Please leave us a message.