Log out
Get PRO

Latest

Code execution vulnerability in several plugins

  • Severity: critical
  • Status: Open
  • Publication: June 24, 2024

Several WordPress plugins available on WordPress.org have been compromised and now contain harmful code. Someone with bad intentions was able to change the code of these plugins and add a code that creates new, admin accounts.

Detected in:

Britetechs Companion fixed vulnerable versions: >= 2.2.7 <= 2.2.7
Contact Form Multi-Step Addon fixed vulnerable versions:
Pods – Custom Content Types and Fields fixed vulnerable versions: >= 3.2.3 <= 3.2.3
PowerPress Podcasting plugin by Blubrry fixed vulnerable versions: >= 11.9.3 <= 11.9.4
Twenty20 Image Before-After fixed vulnerable versions: >= 1.5.4 <= 1.5.4
WP Server Health Stats fixed vulnerable versions: >= 1.7.6 <= 1.7.6
Ad Invalid Click Protector (AICP) open vulnerable versions: >= 1.2.9 <= 1.2.9
BLAZE Retail Widget open vulnerable versions: >= 2.2.5 <= 2.5.2
Contact Form 7 Multi-Step Addon open vulnerable versions: >= 1.0.4 <= 1.0.5
Seo Optimized Images open vulnerable versions: >= 2.1.2 <= 2.1.2
Simply Show Hooks open vulnerable versions: >= 1.2.1 <= 1.2.1
Social Sharing Plugin – Social Warfare open vulnerable versions: >= 4.4.6.4 <= 4.4.7.1
WPCOM Member open vulnerable versions: >= 1.3.15 <= 1.3.15
Wrapper Link Elementor open vulnerable versions: >= 1.0.2 <= 1.0.3

This information is sourced from www.wpvulnerability.com. An open-source database of vulnerabilities maintained by the community. Help us out by submitting vulnerabilities!

Version compare shows which versions have a vulnerability. For example: >= 2.2.8 <= 2.2.21 means:

> from 2.2.8
= including 2.2.8 & 2.2.21
< to 2.2.21

  • Incorrect?

Is this information incorrect? Please leave us a message.

Join our mailing list - 6 Tips & Tricks in your inbox over the next days!

Plugins

© Really Simple Plugins
CoC 70461155
Kalmarweg 14-5
9723 JG, Groningen (NL)

Wordpress Linkedin Github

Get Started

About

Popular articles