48 WP Security Plugin Vulnerabilities APR 2022 Threat

WP Security Plugin Vulnerabilities APR 2022

Be informed about the latest WP Security Plugin Vulnerabilities APR 2022 Threat Case Study, identified and reported publicly. These breaches create even more problems and vulnerability exploitation with a severe negative impact on any WordPress Security or WordPress Hosting. Contact us for our WP/Woo Security audit

A jaw-dropping approximated 1.188.000+ active WordPress sites are circumvented by WP Security Plugin Vulnerabilities APR 2022, as security relies on these measures. It is a whooping 243% INCREASE compared to last month. The estimated number can increase with premium versions and/or closed versions, as they are private purchases.

Furthermore, the initial estimation can multiply if we consider the already patched versions BUT NOT UPDATED by owners, as the vulnerability remains active within their domain. As these owners start changing their hosting provider (due to constant unexplained issues), they actively migrate these vulnerabilities behind protected areas, possibly exposing other clean WP to different attack types.

If you are serious about your business, then you need to pay attention to the WordPress Security best practices. In this post, we will share all the latest WordPress plugin vulnerability reports to help you protect your website against hackers and malware. The following cases made headlines PUBLICLY just last month in the WP Security Plugin Vulnerabilities APR 2022 category:



• WP Activity Log - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 100,000+

---

• WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to fix Insecure Content - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 50,000+

---

• Security Ninja – Secure Firewall & Secure Malware Scanner - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 9,000+

---

• WP Security Safe - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 700+

---

• Filr – Secure document library - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 500+

---

• BulletProof Security - Stored Cross-Site Scripting (XSS)
  • Active installations: 50,000+

---

• Anti-Malware Security and Brute-Force Firewall - Reflected Cross-Site Scripting (XSS)
  • Active installations: 200,000+

---

• Page Security & Membership - Stored Cross-Site Scripting (XSS)
  • This plugin has been closed as of March 25, 2022 and is not available for download. This closure is temporary, pending a full review.

---

• WordPress Persistent Login - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 4,000+

---

• Sky Login Redirect - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 2,000+

---

• EthPress – Web3 Login - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 1,000+

---

• Limit Login Attempts (Spam Protection) - Unauthenticated SQL Injection (SQLi)
  • Active installations: 300+

---

• Social Share, Social Login and Social Comments Plugin – Super Socializer - Reflected Cross-Site Scripting (XSS)
  • Active installations: 50,000+

---

• Custom Login Page Customizer - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 80,000+

---

• CAPTCHA 4WP - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 200,000+

---

• WP fail2ban - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 70,000+

---

• SSL Zen – Free SSL Certificate & HTTPS Redirect for WordPress - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 30,000+

---

• Restrict User Access – Membership Plugin with Force - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 20,000+

---

• New User Approve - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 20,000+

---

• Error Log Monitor - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 20,000+

---

• WP Data Access - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 10,000+

---

• Front End PM - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 10,000+

---

• WP SMS Plugin for WordPress - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 7,000+

---

• WP-Cron Status Checker - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 5,000+

---

• Easy Math Captcha for CF7 - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 3,000+

---

• Fraud Prevention Plugin for WooCommerce - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 2,000+

---

• Shared Files – Easy Download Manager and File Sharing Plugin with Frontend File Upload - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 2,000+

---

• Restrict – membership, site, content and user access restrictions for WordPress - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 2,000+

---

• Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 2,000+

---

• Stop WP Comment Spam - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 1,000+

---

• WP Free SSL – Free SSL Certificate for WordPress and force HTTPS - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 1,000+

---

• Bulk Attachment Download - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 1,000+

---

• HM Multiple Roles - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 1,000+

---

• Premmerce User Roles - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 1,000+

---

• WP Disable Sitemap - CrossSite Request Forgery (CSRF) + Sensitive Information Disclosure
  • Active installations: 200+

---

• WordPress File Upload Pro - Path Traversal vulnerability leading to Remote Code Execution (RCE)
  • Active installations: N/A

---

• WordPress File Upload - Path Traversal vulnerability leading to Remote Code Execution (RCE)
  • Active installations: 30,000+

---

• String locator - Arbitrary File Read
  • Active installations: 100,000+

---

• Drag and Drop Multiple File Upload – Contact Form 7 - Unauthenticated Stored Cross-Site Scripting (XSS)
  • Active installations: 40,000+

---

• Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection - Unauthenticated SQL Injection (SQLi)
• Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection - WordPress Options Update
  • Active installations: 10,000+

---

• Ninja Forms + File Uploads - Unauthenticated Arbitrary File Upload
• Ninja Forms + File Uploads - Unauthenticated Stored Cross-Site Scripting (XSS)
  • Active installations: N/A

---

• Simple Membership - Arbitrary Transaction Deletion via CSRF
  • Active installations: 50,000+

---

• Revision Manager TMC - Folders Disclosure via Outdated jQueryFileTree Library
  • Active installations: 1,000+

---

• Admin Page Framework - Folders Disclosure via Outdated jQueryFileTree Library
  • Active installations: 200+

---

• Library File Manager - Arbitrary File Creation/Upload/Deletion
  • This plugin has been closed as of February 28, 2022 and is not available for download. This closure is temporary, pending a full review.

---

• Members List Plugin - Reflected Cross-Site Scripting (XSS)
  • This plugin has been closed as of March 7, 2022 and is not available for download. This closure is temporary, pending a full review.

---

• WP Downgrade | Specific Core Version - Stored Cross-Site Scripting (XSS)
  • Active installations: 100,000+

---

• Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin - Unauthenticated SQL Injection (SQLi)
  • This plugin has been closed as of March 14, 2022 and is not available for download. This closure is temporary, pending a full review.

---

Why do you need updated security?

A WordPress Security plugin provides many valuable functions, but at its most basic, a WordPress security plugin protects your website from attacks during the time it is vulnerable. WordPress Security is a subject of big relevance for every single internet site proprietor. Google blacklists ~ daily 10,000+ internet domains for malware as well as ~ weekly 50,000 for phishing.

Even if your website starts protected, in time it will certainly come to be much less and less protected. It's important to secure on your own from hackers who are continuously seeking vulnerabilities within the popular WordPress CMS.

Once hackers find and exploit these vulnerabilities, then developers will patch those holes and release an update for their users. However, there’s a time gap of weeks or even months, between the time when the vulnerability is exploited and the patch is provided. During this time you’re exposed.

What is Vulnerability Knowledge?

As time passes, vulnerabilities are discovered in your plugins, theme and the version of WordPress core you are using. Those vulnerabilities (or Security holes) ALWAYS become public knowledge sooner rather, than later.

Can MY WordPress be hacked?

"No System Is Safe" and also WordPress is not an exemption. WordPress simply BY ITSELF is very secure. Stats reveal that 41% of hacked WordPress websites get hacked through WordPress hosting vulnerabilities, 29% through a theme, 22% through a plugin, and also 8% as a result of weak passwords. The Security of your site is only as good as the foundation it’s running on. That’s why it’s important to audit existing Security measures already in place, such as WP Security Plugin Vulnerabilities APR 2022.

MANAGED WP/Woo Security: WP Security Plugin Vulnerabilities APR 2022 | Case Study Related Posts