CVE-2019-17214

The CVE-2019-17214 entry concerns the WebARX WordPress plugin, version 1.3.0. Affected component: the plugin’s firewall logic; root cause described as firewall bypass achievable by appending &cc=1 to a URI. Documented impact indicates that the firewall protection can be bypassed, enabling an unau...

WordPress Theme Editor plugin <= 2.1 - Multiple vulnerabilities

Multiple vulnerabilities CSRF, insufficient permission checking, arbitrary file upload found by WebARX in WordPress Theme Editor plugin versions = 2.1. Solution Update the WordPress Theme Editor plugin to the latest available version at least 2.2...

WebARX — A Defensive Core For Your Website

Estonian based web security startup WebARX, the company who is also behind open-source plugin vulnerability scanner WPBullet and soon-to-be-released bug bounty platform plugbounty.com, has a big vision for a safer web. It built a defensive core for websites which is embedded deep inside the...

WordPress File Manager plugin <= 4.8 - Multiple Vulnerabilities

Multiple Vulnerabilities found by WebARX in WordPress File Manager plugin versions = 4.8. Solution Update the WordPress File Manager plugin to the latest available version at least 4.9...

WAFW00F v1.0.0 - Detect All The Web Application Firewall!

WAFW00F identifies and fingerprints Web Application Firewall WAF products. How does it work? To do its magic, WAFW00F does the following: Sends a normal HTTP request and analyses the response; this identifies a number of WAF solutions. If that is not successful, it sends a number of potentially...

Critical Unpatched Flaw Disclosed in WordPress WooCommerce Extension

If you own an eCommerce website built on WordPress and powered by WooCommerce plugin, then beware of a new, unpatched vulnerability that has been made public and could allow attackers to compromise your online store. A WordPress security company—called "Plugin Vulnerabilities"—that recently gone...

Critical WordPress Plugin Flaw Grants Admin Access to Any Registered Site User

Another day, another critical WordPress plugin vulnerability. The popular AMP for WP plugin, which helps WordPress sites load faster on mobile browsers, has a privilege-escalation flaw that allows WordPress site users of any level to make administrative changes to a website. The plugin, which has...

WordPress WebARX Website Firewall 4.9.8 XSS / Bypass Vulnerabilities

WordPress WebARX Website Firewall plugin version 4.9.8 suffers from bypass and cross site scripting vulnerabilities. Exploit Title: WordPress WebARX Website Firewall - Stored XSS and firewall bypass. Type: WordPress Plugin Exploit Author: ed0x21son Vendor Homepage: https://www.webarxsecurity.com...

WordPress WebARX Website Firewall 4.9.8 XSS / Bypass

Exploit Title: WordPress WebARX Website Firewall - Stored XSS and firewall bypass. Type: WordPress Plugin Date: 2018-09-27 Exploit Author: ed0x21son Vendor Homepage: https://www.webarxsecurity.com Software Link: http://update.webarxsecurity.com/wp-update-server/?action=download&slug=webarx Versio...