Critical flaws in WordPress plugins and themes: what you need to know

This week, what you shouldn't ignore

Imagine you have a physical store and suddenly discover that the main door lock has a flaw: anyone who knows about it can enter without a key. That's more or less what's happening with some WordPress plugins. This week, 90 critical vulnerabilities have been identified in WordPress plugins and themes, and that means if your website uses any of these tools without updating, it could be exposed to attacks. It's not an exaggeration: it's a reality affecting thousands of websites worldwide. But don't worry, we'll explain what to do.

What's happening in the world

This week, 368 vulnerabilities in WordPress plugins and themes have been collected. Of these, 90 are considered serious or critical. This means attackers can do things like upload malicious files, execute commands on the server, or even take control of the website. These figures come from public sources like Wordfence, CISA KEV, Nuclei, and others, and are not specific to SWPanel. However, we keep a close eye on them so you don't have to.

The cards

1. Plugin: Mobile Login & Register Woocommerce

• What it is: Allows logging in with a verification code.
• How it's attacked: An attacker can take control of accounts without needing credentials.
• What could happen: Theft of user accounts, including sensitive data.
• Severity (CVSS): 9.8
• Public exploit: No
• Already exploited (KEV): No

2. Plugin: WP Mailster

• What it is: Manages bulk email sending.
• How it's attacked: An attacker can upload any file to the server, including malicious code.
• What could happen: Server infection, spam sending, or visitor redirection.
• Severity (CVSS): 9.8
• Public exploit: No
• Already exploited (KEV): No

3. Plugin: Prime Mover

• What it is: Tool for migrating websites between servers.
• How it's attacked: An attacker can inject malicious code during migration.
• What could happen: Command execution on the server, possible takeover.
• Severity (CVSS): 9.8
• Public exploit: No
• Already exploited (KEV): No

4. Plugin: MDTF – Meta Data and Taxonomies Filter

• What it is: Allows filtering content by metadata and taxonomies.
• How it's attacked: An attacker can execute arbitrary code on the server.
• What could happen: Server infection, possible data theft.
• Severity (CVSS): 9.8
• Public exploit: No
• Already exploited (KEV): No

5. Plugin: The Grid

• What it is: Plugin for displaying images and visual content.
• How it's attacked: An attacker can execute arbitrary code on the server.
• What could happen: Server infection, possible takeover.
• Severity (CVSS): 9.8
• Public exploit: No
• Already exploited (KEV): No

And in SWPanel, what?

SWPanel actively monitors these vulnerabilities and cross-references them with the analysis of our clients' websites. If we detect that your website is using any of these vulnerable tools, we'll notify you in the Security 360 section. Additionally, if you installed your website from SWPanel, you can enable automatic updates for WordPress and its plugins. If not, we recommend checking for available updates and applying them as soon as possible.

How we got here

This week, 90 critical vulnerabilities were identified, which is a high number. Although it doesn't compare to previous peaks, it does indicate a consistent trend of new flaws in WordPress plugins and themes. If the trend continues, it's likely we'll continue to see new vulnerability announcements in the coming weeks. The optimistic scenario would be that plugin developers respond quickly with patches and updates. The pessimistic scenario would be that some of these flaws are already being actively exploited before solutions are published. Warning signs to watch for include an increase in attacks targeting websites with outdated plugins.

What's happening behind the numbers

These flaws don't appear out of nowhere. Many are discovered by researchers and security professionals who work with developers to fix them. However, once the information is published, attackers can exploit it quickly. What we see is a constant race between patches and attacks: for every update, someone is looking for ways to exploit it before it's applied. This doesn't mean your website is in danger, but it does mean you should stay alert.

What we can expect

If the trend continues, it's likely we'll continue to see new vulnerability announcements in the coming weeks. The optimistic scenario would be that plugin developers respond quickly with patches and updates. The pessimistic scenario would be that some of these flaws are already being actively exploited before solutions are published. Warning signs to watch for include an increase in attacks targeting websites with outdated plugins.

How it can affect your website or business

Imagine you have an online store and use a WordPress plugin with a critical flaw. An attacker could exploit that flaw to:

• Steal customer data: If the plugin handles user information, such as addresses or emails, it could fall into the wrong hands.
• Infect your website: Your site could display unwanted ads, redirect to malicious pages, or even be used to send spam.
• Lose time and money: If your website is infected, you'll have to spend hours cleaning it up, and if you don't do it in time, you could lose customers or even face fines for non-compliance with regulations like the GDPR.

How to protect yourself and prevent attacks

1. Update plugins and themes regularly: Updates often include security patches. If you installed your website from SWPanel, you can enable automatic updates.
2. Use only plugins and themes from trusted sources: Avoid unknown or unverified developers.
3. Enable two-factor authentication (2FA): This adds an extra layer of security to your WordPress account.
4. Use strong and unique passwords: Don't reuse passwords across sites and avoid simple passwords.
5. Enable your hosting firewall: Filters attacks before they reach your website.
6. Set up automatic backups: In case of infection, you can easily restore your website.
7. Monitor SWPanel security alerts: If you installed your website from SWPanel, we'll notify you when a plugin or theme you use has a critical flaw.
8. Use the Security 360 security analysis: Helps detect if your website has plugins or versions with known flaws.
9. Avoid using unsupported versions: If your website uses a version of WordPress or a plugin that no longer receives updates, it's vulnerable. Switch to a supported version from the hosting panel.
10. Use tools like BotLock: Controls malicious bots and crawlers trying to attack your website.

What SWPanel tools help you

• Security 360 security analysis: Detects CMS, plugins, and versions with known flaws and marks your website in the panel.
• Security 360 security alerts: Notifies you when a flaw affecting you is released.
• BotLock: Controls and blocks malicious bots and crawlers from your website.
• FireWall: Filters web attacks before they reach your application.
• CMS automatic update: If you installed your website from SWPanel, you can enable automatic updates for WordPress and its plugins.
• Backups: In case of infection, you can easily restore your website.
• PHP version change: From the hosting service, you can switch to a supported version.
• Ticket support: If you have questions or need help, you can contact us.

Quick summary

• Update plugins and themes regularly.
• Use only plugins from trusted sources.
• Enable two-factor authentication.
• Use strong and unique passwords.

Sources

This week's data comes from public catalogs like CISA KEV, Wordfence, Nuclei, Exploit-DB, Emerging Threats, and EPSS.