WordPress Mesmerize and Materialis themes fixed an authenticated options change vulnerability.

The WordPress Mesmerize (60,000+ active installations) and Materialis (10,000+ active installations) themes fixed a vulnerability that could allow authenticated users to modify WordPress core options in the database.

Posted on November 10, 2019January 7, 2020
NinjaFirewall

Multiple vulnerabilities in WordPress IgniteUp/Coming Soon and Maintenance Mode plugin.

The WordPress IgniteUp/Coming Soon and Maintenance Mode plugin, which has 30,000+ active installations, was prone to multiple vulnerabilities in version 3.4 and below that could lead to arbitrary file deletion, stored XSS, information disclosure, HTML injection in email and CSRF, among a few other issues.

Posted on November 7, 2019November 7, 2019
NinjaFirewall

Privilege escalation vulnerability fixed in WordPress CartFlows plugin.

The WordPress Funnel Builder by CartFlows plugin, which has 30,000+ active installations, fixed a privilege escalation vulnerability affecting version 1.3.0 and below.

Posted on November 4, 2019November 4, 2019
Security

WordPress and the evil RELOCATE.

A few days ago I found the following directive inside the WordPress configuration file of one of our customers: define(‘RELOCATE’, true);

Posted on October 31, 2019October 31, 2019
NinjaFirewall

Authenticated settings change vulnerability in YIT Plugin Framework.

An authenticated settings change vulnerability in the YIT Plugin Framework v3.3.8 and below, used in several dozen WordPress plugins, could allow logged-in users to change the plugin options.