The Ninja Technologies Network
The WordPress Mesmerize (60,000+ active installations) and Materialis (10,000+ active installations) themes fixed a vulnerability that could allow authenticated users to modify WordPress core options in the database.
The WordPress IgniteUp/Coming Soon and Maintenance Mode plugin, which has 30,000+ active installations, was prone to multiple vulnerabilities in version 3.4 and below that could lead to arbitrary file deletion, stored XSS, information disclosure, HTML injection in email and CSRF, among a few other issues.
The WordPress Funnel Builder by CartFlows plugin, which has 30,000+ active installations, fixed a privilege escalation vulnerability affecting version 1.3.0 and below.
A few days ago I found the following directive inside the WordPress configuration file of one of our customers: define(‘RELOCATE’, true);
An authenticated settings change vulnerability in the YIT Plugin Framework v3.3.8 and below, used in several dozen WordPress plugins, could allow logged-in users to change the plugin options.