CSRF JUL 2021 – Cross-Site Request Forgery JUL 2021
Tailored WordPress Security Report
Be informed about the latest Cross-Site Request Forgery JUL 2021, identified and reported publicly. As these CSRF JUL 2021 vulnerabilities have a severe negative impact on any WordPress Security, consider our FREE security AUDIT.
An estimated 217.800+ active WordPress installations are susceptible to this attack type, considering only the publicly available numbers. The estimated number can increase by 5-10% with premium versions as they are private purchases.
Furthermore, the initial estimation can triple if we consider the already patched versions BUT NOT UPDATED by owners, as the vulnerability remains active within their domain. As these owners start changing their hosting provider (due to constant unexplained issues), they actively migrate these vulnerabilities behind protected areas, possibly exposing other clean WP to different attack types.
It is a mind-boggling 1225% increase compared to December 2020. We compare last month versus previous winter holiday season, which has the biggest shopping traffic and attack spike throughout the year. Read more about our previous reports here: 15 Abuses: CSRF JUN 2021 | Cross-Site Request Forgery JUN 2021 and 4 CSRF – Cross-Site Request Forgery – WordPress Security DEC. The following cases made headlines just last month in the CSRF JUL 2021 category:
Hire security geeks to protect your WordPress from publicly reported cases of CSRF JUL 2021 BEFORE IT’S TOO LATE! You will also protect your customers, your reputation and your online business!
- WOOSTIFY PRO – CSRF Bypass
- Woostify is fully optimized to make your website at the smallest size and fastest loading time, even without any optimization applied at all.
- Workreap – Freelance Marketplace and Directory WordPress Theme – Missing Authorization Checks in Ajax Actions
- Workreap – Freelance Marketplace and Directory WordPress Theme – Multiple CSRF + IDOR Vulnerabilities
- Workreap – Freelance Marketplace and Directory WordPress Theme – Unauthenticated Upload Leading to RCE
- Workreap is a Freelance Marketplace WordPress theme with some exciting features and excellent code quality. It has been designed and developed after thorough research to cater the requirements of people interested in building freelance marketplace or other similar projects. The design is contemporary but at the same time it focuses on the usability, visual hierarchy and aesthetics to ensure easy navigation for the end users.
- Migrate Users – CSRF to Stored Cross-Site Scripting
- This plugin has been closed as of May 25, 2022 and is not available for download. Reason: Security Issue.
- Adapta RGPD – Unauthorized Consent via CSRF
- Adapta RGPD es una herramienta que te ayuda a crear las páginas legales en español, adaptar tu sitio web al RGPD y cumplir la ley de Cookies de una forma clara y fácil. Active installations: 30,000+
- YITH Request a Quote for WooCommerce – Unauthorized AJAX call via CSRF
- YITH Request a Quote for WooCommerce is a powerful tool to hide prices and/or add to cart buttons and let your customers request a custom quote for every product. Active installations: 10,000+
- ReviewX – Unauthorized AJAX call via CSRF
- Boost Sales With The Power of Multicriteria Customer Reviews for WooCommerce Product Active installations: 9,000+
- Food Store – Unauthorized AJAX call via CSRF
- Food Store is created by extending the core functionalities of WordPress and WooCommerce, which make it very minimal, clutter free and very familiar to use. All your WooCommerce Categories, Settings and ease of setting up store and moving around the settings panel is still there. Active installations: 2,000+
- WP Prayer – Unauthorized AJAX call via CSRF
- Prayer request application that allows users to submit requests, or pray for existing requests. All requests can be moderated from the admin section. Active installations: 1,000+
- KONTXT Content Advisor – Unauthorized AJAX call via CSRF
- The KONTXT Content Advisor WordPress plugin provides in-depth text analysis on your posts, pages, and product listings. Experiment with your words and get an objective review of the tone and emotions of your language and identify hidden keywords and concepts buried inside your content. Use these discoveries to fine-tune your writing style to your target audience and optimize search engine indexing (SEO). Active installations: 900+
- Fontsampler – CSRF to Authenticated Reflected Cross-Site Scripting
- This is a plugin directed primarily at type designers, lettering artists, foundries or resellers using WordPress to showcase their fonts without the need for coding knowledge. Active installations: 900+
- MZ Mindbody API – Unauthorized AJAX call via CSRF
- Display special events, class schedules and instructors from Mindbody. Active installations: 40+
- Journey Analytics – Unauthorized AJAX call via CSRF
- Track your customer journeys by intent and by business goal. Identify your most lucrative paths and those where customers are dropping off. Active installations: 20+
- Alkubot – Unauthorized AJAX call via CSRF
- Say goodbye to intrusive, low converting pop-ups. Boost your revenue and optimize coupons/discounts with an intelligent gamified sales chatbot. Active installations: 10+
- BNG Gateway For Woocommerce – CSRF Bypass
- This plugin has been closed as of March 24, 2022 and is not available for download. Reason: Security Issue.
- BuddyPress Customer.io Analytics Integration – Arbitrary Plugin Settings Update via CSRF
- This plugin has been closed as of June 26, 2018 and is not available for download. This closure is permanent. Reason: Author Request.
- WooCommerce Custom Registration Form – Arbitrary Field Deletion and Form Modification via CSRF
- This plugin has been closed as of June 22, 2018 and is not available for download. This closure is permanent. Reason: Author Request.
- Woocommerce Tabs Plugin, Add Custom Product Tabs – Arbitrary Tab Deletion/Edition via CSRF
- This plugin has been closed as of June 22, 2018 and is not available for download. This closure is permanent. Reason: Author Request.
- Global Multisite Search – CSRF Bypass
- This plugin has been closed as of March 24, 2022 and is not available for download. Reason: Security Issue.
- Intimate Payments – CSRF Bypass
- This plugin has been closed as of June 24, 2022 and is not available for download. Reason: Security Issue.
- KONTXT Improves WordPress Search – CSRF Bypass
- This plugin has been closed as of October 5, 2020 and is not available for download. This closure is permanent. Reason: Author Request.
- Instantio – CSRF Bypass
- Instantio reduces your Cart Abandonment rate by minimizing the steps of Woocommerce Checkout process. With Instantio’s floating cart icon, your customer will be able to skip the cart page and go directly to the checkout page. Active installations: 20+
- Express Shop – CSRF Bypass
- Express Shop for WooCommerce displays all WooCommerce products as a one page store in gorgeous styles. Show your WooCommerce product table for quick shopping and easy bulk ordering. Faster shopping for Restaurant Online Order, Food Menu, Grocery Shops, Wholesale store, Music or video stores etc. Active installations: 40+
- SEO Wizard – Unauthorized robots.txt & .htaccess Edit via CSRF
- This plugin has been closed and is no longer available for download.
- Title Field Validation – Unauthorized AJAX call via CSRF
- This plugin has been closed as of March 24, 2022 and is not available for download. Reason: Security Issue.
- Unlimited Category slider for WooCommerce – CSRF Bypass
- Everything is customizable. if you need more style you can customize css. You will get Promotional slider, 2 types of Category slider, related product slider. Active installations: 10+
- NMI Gateway For WooCommerce – CSRF Bypass
- This plugin has been closed as of March 24, 2022 and is not available for download. Reason: Licensing/Trademark Violation.
- WPHEKA Request for Quote – CSRF Bypass
- This plugin has been closed as of March 24, 2022 and is not available for download. Reason: Licensing/Trademark Violation.
- WooCommerce Extra Cost – CSRF Bypass
- This plugin has been closed as of June 28, 2018 and is not available for download. This closure is permanent. Reason: Author Request.
- Woo MerchantX – CSRF Bypass
- This plugin has been closed as of March 24, 2022 and is not available for download. Reason: Security Issue.
- Travel Light – CSRF Bypass
- This plugin has been closed as of October 19, 2018 and is not available for download. Reason: Guideline Violation.
- Slider Hero with Animation, Video Background & Intro Maker – CSRF Bypass
- Slider Hero is a futuristic, responsive header Hero Slider plugin and Dyanmic Website Intro Advert maker with Youtube Video background and animated background effects for hero banners, hero sliders and Landing pages. Create awesome animation slider and animated header with text carousel and Call to Action buttons from Gutenberg Slider Block & Elementor Slider Widget. Use youtube video background or combine animation effect and youtube video. Active installations: 4,000+
- Amministrazione Trasparente – CSRF Bypass
- Complete software for the management of the Transparent Administration section pursuant to Legislative Decree n. 33 of 14/03/2013 and subsequent additions, concerning the reorganization of the discipline of the obligations of publicity, transparency and dissemination of information by public administrations, in implementation of art. 1, paragraph 35, of law no. 190/2012. Active installations: 2,000+
- Vuukle Comments, Reactions, Share Bar, Revenue – CSRF Bypass
- Vuukle is not just a comments platform, we are a fully featured user engagement platform. Our goal is to make engagement and user retention easier. Good engagement can help increase time spent by users that leads to decrease in bounce rate which translates to better revenues. Vuukle with its diverse portfolio of products can help you achieve your goals. Active installations: 1,000+
- WP EasyPay – CSRF Bypass
- WP EasyPay is a fast, and secure WordPress plugin designed to simplify the way your website accepts Square payments. With this plugin, you can start accepting online credit card payments instantly while skipping the complex procedures of setting up a shopping cart system. Active installations: 2,000+
- Abandoned Cart Recovery for WooCommerce – CSRF Bypass
- What is WooCommerce Abandoned Cart Recovery? WooCommerce Abandoned Cart Recovery is a WooCommerce extension which helps you to recovery unfinished order in your store. When a customer adds a product to cart but does not complete check out. After a scheduled time, the cart will be marked as “abandoned”. The plugin will start to send cart recovery email or facebook message to the customer, remind him/her to complete the order. Active installations: 5,000+
- Locations – CSRF Bypass
- Add a Locations page to your website to help your customers find the store closest to them. Create a Store Locator page on your website using Google Maps. Active installations: 1,000+
- WP HTML Mail – CSRF to XSS
- Custom designed WordPress emails for your WooCommerce and EDD transactional emails, contact form notifications, your WordPress core emails, BuddyPress and many more. Active installations: 20,000+
- WPCS – Arbitrary Plugin’s Settings Change via CSRF
- WordPress Currency Switcher (WPCS) is WordPress currency plugin, that allows your site visitors switch prices currencies in your site content according to set currencies rates in the real time! Active installations: 1,000+
- Leaflet Map – Arbitrary Settings Update via CSRF Leading to Stored XSS
- Add a map generated with LeafletJS: an open-source JavaScript library for mobile-friendly interactive maps. Map tiles are provided by default through OpenStreetMap, or MapQuest (with an app key). Can be set per map with shortcode attributes or through the dashboard settings. Active installations: 20,000+
- WP Upload Restriction – CSRF Bypass
- WP Upload Restriction – Missing Access Control in deleteCustomType
- WP Upload Restriction – Missing Access Control in getSelectedMimeTypesByRole
- This plugin has been closed as of July 1, 2022 and is not available for download. This closure is temporary, pending a full review.
- WordPress Meta Data and Taxonomies Filter – Arbitrary Settings Update via CSRF
- MDTF – WordPress Meta Data & Taxonomies Filter – Arbitrary Settings Update via CSRF
- WordPress Meta Data Filter & Taxonomies Filter (MDTF) wordpress filter plugin. The main idea of MDTF – make your WordPress site content is filterable and searchable by meta fields and taxonomies on the same time. Active installations: 5,000+
- Advanced Menu Manager – Unauthorised Menu Creation/Deletion
- Advanced Menu Manager – Unauthorised Menu CEdition via CSRF
- This plugin has been closed as of June 8, 2022 and is not available for download. This closure is temporary, pending a full review.
- WOWRestro – CSRF Bypass
- WOWRestro is an online ordering system powered by WooCommerce. WOWRestro Allows you to offer both Takeaway/Pickup and Delivery. With WOWRestro you can easily have a nice looking ordering interface with option to choose required service options. Active installations: 10+
- Social Tape – CSRF to Stored XSS
- This plugin has been closed as of June 15, 2022 and is not available for download. This closure is temporary, pending a full review.
- Telugu Bible Verse Daily – CSRF to Stored XSS
- This plugin has been closed as of June 14, 2022 and is not available for download. This closure is temporary, pending a full review.
- Verse-O-Matic – CSRF to Stored XSS
- This plugin has been closed as of June 23, 2022 and is not available for download. This closure is temporary, pending a full review.
- Custom Login Redirect – CSRF to Stored XSS
- This plugin has been closed as of June 14, 2022 and is not available for download. This closure is temporary, pending a full review.
- Light Messages – CSRF to Stored XSS
- This plugin has been closed as of June 9, 2022 and is not available for download. This closure is temporary, pending a full review.
- Light Messages – CSRF to Stored XSS
- This plugin has been closed as of June 9, 2022 and is not available for download. This closure is temporary, pending a full review.
- Shantz WordPress QOTD – Arbitrary Setting Update via CSRF
- This plugin has been closed as of June 4, 2022 and is not available for download. Reason: Security Issue.
- RestroPress – Unauthorised AJAX Calls
- RestroPress – Cart Manipulation via CSRF
- RestroPress is an Online Food Ordering system for WordPress. It is a standalone WordPress plugin which allows you to easily add Food Ordering System to your WordPress Website. Using RestroPress you can easily receive both PickUp/Takeaway and Delivery orders. Active installations: 3,000+
- Elementor Addon Elements – CSRF Bypass
- Enhance your Elementor Page Builder experience by using our free addon – Elementor Addon Elements. This addon comes with 24+ widgets and extensions that will give more power to your Elementor based website. It has an easy-to-use interface that will allow you to create any design with just a few clicks! Active installations: 100,000+
- NewsPlugin – CSRF to Stored Cross-Site Scripting
- This plugin has been closed as of July 20, 2022 and is not available for download. This closure is temporary, pending a full review.
Stay Healthy! A healthier online business starts today and it begins with you. Hire security experts to solve all your CSRF JUL 2021 issues.
BRIEF: Cross-Site Request Forgery JUL 2021 is a type of malicious exploit of a website where unauthorised commands are submitted from a user that the web application trusts. Cross-site request forgery is also known as one-click attack, session riding, CSRF, XSRF, Sea Surf, Session Riding, Cross-Site Reference Forgery, or Hostile Linking.
What is Cross-Site Request Forgery JUL 2021?
Cross-site request forgery (also known as CSRF) is a web security vulnerability that allows an attacker to induce users to perform actions that they do not intend to perform. It allows an attacker to partly circumvent the same-origin policy, which is designed to prevent different websites from interfering with each other. Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated.
With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker’s choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state-changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application.
What is the impact of a CSRF JUL 2021 attack?
In a successful CSRF attack, the attacker causes the victim user to act unintentionally. Example: this might be to change the email address on their account, to change their password, or to make a funds transfer. Depending on the nature of the action, the attacker might be able to gain full control over the user’s account. If the compromised user has a privileged role within the application, then the attacker might be able to take full control of all the application’s data and functionality.
CONTACT US TODAY with any reported CSRF JUL 2021 vulnerability! Do you suspect any Cross-Site Request Forgery JUL 2021 in your WordPress?
