WordPress Wordfence 7.4.5 Local File Disclosure Vulnerability

Exploit for php platform in category web applications - Tile: Wordpress Plugin wordfence.7.4.5 - Local File Disclosure - Author: mehran feizi - Category: webapps - Date: 2020.02.12 - vendor home page: https://wordpress.org/plugins/wordfence/...

WordPress Wordfence 7.4.5 Local File Disclosure

Tile: Wordpress Plugin wordfence.7.4.5 - Local File Disclosure - Author: mehran feizi - Category: webapps - Date: 2020.02.12 - vendor home page: https://wordpress.org/plugins/wordfence/ ============================================================================== Vulnerable Source: 5662:...

WordPress WP Database Reset plugin <= 3.1 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by WordFence in WordPress WP Database Reset plugin versions = 3.1. Solution Update the WordPress WP Database Reset plugin to the latest available version at least 3.15...

WordPress Minimal Coming Soon & Maintenance Mode plugin <= 2.10 - Insecure Permissions: Enable and Disable Maintenance Mode vulnerability

Insecure Permissions: Enable and Disable Maintenance Mode vulnerability discovered by WordFence in WordPress Minimal Coming Soon & Maintenance Mode plugin versions = 2.10. Solution Update the WordPress Minimal Coming Soon & Maintenance Mode plugin to the latest available version at least 2.15...

WordPress Email Subscribers & Newsletters plugin <=4.2.2 - Multiple security issues

Multiple security issues found by WordFence in WordPress Email Subscribers & Newsletters plugin versions =4.2.2. Solution Update the WordPress Email Subscribers & Newsletters plugin to the latest available version at least 4.2.3...

Open Redirect Bug in Bridge Theme Plugin Opens Admins to Spearphishing

Two open-redirect vulnerabilities in Bridge, a commercial WordPress theme purchased more than 120,000 times, would allow an attacker to mount spearphishing attacks against site administrators. An open redirect vulnerability can be used to hide malicious links behind URLs for legitimate domains. F...

WordPress Ad Inserter plugin <= 2.4.21 - Authenticated Remote Code Execution (RCE) vulnerability

Authenticated Remote Code Execution RCE vulnerability found by Sean Murphy WordFence in WordPress Ad Inserter plugin versions = 2.4.21. Solution Update the WordPress Ad Inserter plugin to the latest available version at least 2.4.22...

WordPress ConvertPlus plugin <= 3.4.2 - Unauthenticated Arbitrary User Role Creation vulnerability

Unauthenticated Arbitrary User Role Creation vulnerability found by WordFence in WordPress ConvertPlus plugin versions = 3.4.2. Solution Update the WordPress ConvertPlus plugin to the latest available version at least 3.4.3...

WordPress Plugin Has Unpatched Privilege Escalation Flaw, Warn Researchers

A WordPress plugin, Slick Popup, has a serious privilege escalation flaw – and it has yet to be patched. WordPress plugin Slick Popup, which has 7,000 active installs and provides a tool for displaying the Contact Form 7 as a popup on WordPress websites. However, researchers with Wordfence said...

WordPress WP Database Backup plugin <= 5.1.2 - Unauthenticated OS Command Injection vulnerability

Unauthenticated OS Command Injection vulnerability found by WordFence in WordPress WP Database Backup plugin versions = 5.1.2. Solution Update the WordPress WP Database Backup plugin to the latest available version at least 5.2...

WAFW00F v1.0.0 - Detect All The Web Application Firewall!

WAFW00F identifies and fingerprints Web Application Firewall WAF products. How does it work? To do its magic, WAFW00F does the following: Sends a normal HTTP request and analyses the response; this identifies a number of WAF solutions. If that is not successful, it sends a number of potentially...

WP Live Chat WordPress Plugin Re-Patches File Upload Flaw

A WordPress plugin vulnerability found in WP Live Chat could allow an attacker to upload arbitrary malicious files to vulnerable systems, according to researchers. WP Live Chat is a plugin for WordPress that equips websites with a small pop-up chat support window that site owners can use to...

CVE-2019-9669

The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector. NOTE: It has been asserted that this is not a valid vulnerability in the context of the Wordfence WordPress plugin as the firewall rules are not maintained as part of the Wordfence software but rather it is a set of...

CVE-2019-9669

The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector. NOTE: It has been asserted that this is not a valid vulnerability in the context of the Wordfence WordPress plugin as the firewall rules are not maintained as part of the Wordfence software but rather it is a set of...

Design/Logic Flaw

DISPUTED The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector. NOTE: It has been asserted that this is not a valid vulnerability in the context of the Wordfence WordPress plugin as the firewall rules are not maintained as part of the Wordfence software but rather it is a...

CVE-2019-9669

The documents describe CVE-2019-9669 as affecting Wordfence WordPress plugin version 7.2.3, indicating a potential XSS via a unique attack vector. The root discussion notes that firewall rules are hosted separately and pushed to the plugin, and that bypassing a WAF rule may not constitute a softw...

CVE-2019-9669

The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector. NOTE: It has been asserted that this is not a valid vulnerability in the context of the Wordfence WordPress plugin as the firewall rules are not maintained as part of the Wordfence software but rather it is a set of...

PT-2019-19788 · Wordfence · Wordfence

Name of the Vulnerable Software and Affected Versions: Wordfence plugin version 7.2.3 Description: The issue concerns a potential XSS attack vector in the Wordfence plugin for WordPress. However, it has been noted that this may not be considered a valid vulnerability within the context of the...

Wordpress Plugin Patched After Zero Day Discovered

UPDATE A popular WordPress plugin is urging users to update as soon as possible after it patched a vulnerability that was being exploited in the wild. If users cannot update, developers recommended they disable the plugin. The plugin, Social Warfare, lets users add social media sharing buttons to...

WordPress WP Cost Estimation plugin < 9.644 - Arbitrary File Upload and Delete vulnerability

Arbitrary File Upload and Delete vulnerability found by Wordfence in WordPress WP Cost Estimation versions 9.644. Solution All versions older than 9.644 vulnerable and you should update to the latest available version at least to 9.644...