Unauthenticated WP DEC 2024
Tailored WP/Woo Security Report
Be informed about the latest Unauthenticated WP DEC 2024 - WP Security Circumvention, identified and reported publicly. It is a +44% INCREASE compared to previous month, as specifically going around existing security. Consider for your online safety, a managed WP/Woo security AUDIT, – OR – switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for tailored WP Security.
WHO needs tailored WP security? EVERYBODY!
Today's reality needs a Web Application Firewall (WAF) plus an Intrusion Prevention System (IPS) to mitigate "gazillion" different threats in your WordPress. Get your Unauthenticated WP DEC 2024 Patch Management.
The following cases made headlines PUBLICLY just last month in the Unauthenticated WP DEC 2024 category:
| Activity Log | Unauthenticated Cross-Site Scripting (XSS) from Event Context |
| Advanced Order Export For WooCommerce | Unauthenticated PHP Object Injection (BAC) |
| Anonymous Restricted Content | Unauthenticated Content Restriction Bypass (BAC) to Private Information Exposure |
| AppPresser | Unauthenticated Privilege Escalation (BAC) from Password Reset |
| Automation By Autonami | Unauthenticated SQL Injection (SQLi) |
| Backup and Staging by WP Time Capsule | Unauthenticated Arbitrary File Upload (BAC) |
| Blogger 301 Redirect | Unauthenticated SQL Injection (SQLi) |
| Booking calendar, Appointment Booking System | Unauthenticated Cross-Site Scripting (XSS) from SVG File Upload (BAC) |
| Category Ajax Filter | Unauthenticated Local File Inclusion (LFi) |
| CE21 Suite | Missing Authorization (BAC) to Unauthenticated Plugin Settings Change (BAC) |
| Chartify | Unauthenticated Local File Inclusion (LFi) from source |
| Clone | Unauthenticated PHP Object Injection (BAC) from 'recursive_unserialized_replace' |
| Contest Gallery | Unauthenticated SQL Injection (SQLi) |
| Contest Gallery | Unauthenticated Arbitrary Password Reset (BAC) to Privilege Escalation (BAC)and Account Takeover (BAC) |
| Debug Tool | Unauthenticated Arbitrary File Creation (BAC) |
| FluentSMTP | Unauthenticated PHP Object Injection (BAC) |
| GamiPress | Unauthenticated Arbitrary Shortcode Execution (BAC) from gamipress_get_user_earnings |
| Hash Elements | Missing Authorization (BAC) to Unauthenticated Draft Post Title Exposure |
| Hide Links | Unauthenticated Shortcode Execution (BAC) |
| Hustle | Missing Authorization (BAC) to Unauthorized Form Submission |
| Jobify - Job Board WordPress Theme | Unauthenticated Arbitrary File Read (BAC) |
| JobSearch | Unauthenticated Arbitrary File Upload (BAC) |
| Luna Web Radio Player | Unauthenticated Arbitrary File Read (BAC) |
| MP3 Sticky Player | Unauthenticated Arbitrary File Read (BAC)and Download (BAC) |
| My Contador lesr | Missing Authorization (BAC) to Unauthenticated User Registration (BAC) CSV Export (BAC) |
| Otter - Gutenberg Block | Unauthenticated Path Traversal (BAC) to Arbitrary Image View |
| Paid Member Subscriptions | Unauthenticated Arbitrary Shortcode Execution (BAC) |
| Popup box | Missing Authorization (BAC) to UnauthenticatedOptions Update (BAC) |
| ProfilePress | Unauthenticated Content Restriction Bypass (BAC) to Private Information Exposure |
| Quform | Unauthenticated Private Information Exposure |
| RegistrationMagic | Unauthenticated Privilege Escalation (BAC) from Password Recovery |
| Registrations for the Events Calendar | Unauthenticated Cross-Site Scripting (XSS) |
| Request a Quote for WooCommerce and Elementor | Unauthenticated Arbitrary Shortcode Execution (BAC) from fire_contact_form |
| School Management | Unauthenticated Arbitrary File Upload (BAC) |
| Security & Malware scan by CleanTalk | Authorization Bypass (BAC) from Reverse DNS Spoofing to Unauthenticated SQL Injection (SQLi) |
| Simple Membership | Exposure of Private Personal Information to an Unauthorized Actor |
| System Dashboard | Unauthenticated Cross-Site Scripting (XSS) |
| Tickera | Unauthenticated Arbitrary Shortcode Execution (BAC) |
| Tutor LMS | Unauthenticated SQL Injection (SQLi) from rating_filter |
| Tutor LMS | User Registration (BAC) Setting Bypass (BAC) to Unauthorized User Registration (BAC) |
| Uix Slideshow | Unauthenticated Arbitrary Shortcode Execution (BAC) |
| User Extra Fields | Unauthenticated Arbitrary File Upload (BAC) |
| User Extra Fields | Unauthenticated Arbitrary File Deletion (BAC) |
| Video Gallery for WooCommerce | Missing Authorization (BAC) to UnauthenticatedFile Deletion (BAC) |
| WooCommerce Product Table Lite | Unauthenticated Arbitrary Shortcode Execution (BAC) & Cross-Site Scripting (XSS) |
| WooCommerce Support Ticket System | Unauthenticated Arbitrary File Deletion (BAC) |
| WooCommerce Support Ticket System | Unauthenticated Arbitrary File Upload (BAC) |
| WooCommerce Upload (BAC) Files | Unauthenticated Arbitrary File Upload (BAC) |
| WOOCS – WooCommerce Currency Switcher | Unauthenticated Arbitrary Shortcode Execution (BAC) |
| WordPress GDPR & CCPA | Missing Authorization (BAC) to Unauthenticated Arbitrary User Deletion (BAC) |
| WordPress GDPR & CCPA | Unauthenticated Cross-Site Scripting (XSS) |
| WP Activity Log | Unauthenticated Cross-Site Scripting (XSS) |
| WP Membership | Unauthenticated Arbitrary File Upload (BAC) |
| WP Photo Album Plus | Unauthenticated Arbitrary Shortcode Execution (BAC) from getshortcodedrenderedfenodelay |
| WP Project Manager | Insecure Direct Object Reference (IDOR) to Unauthenticated Authorization Bypass (BAC) |
| WPB Popup for Contact Form 7 | Unauthenticated Arbitrary Shortcode Execution (BAC) from wpb_pcf_fire_contact_form |
| WPGYM | Unauthenticated Arbitrary File Upload (BAC) |
| WPLMS Theme | Unauthenticated Arbitrary File Read (BAC) and Deletion (BAC) |
| WPvivid Backup and Migration | Unauthenticated PHP Object Injection (BAC) |
| Unauthenticated WordPress reported in 2023: | 235 |
| Unauthenticated WordPress reported in 2024: | 568 |
WHO needs tailored WP Maintenance? EVERYBODY!
Today’s reality requires daily clean-ups with database optimisations, weekly updates and upgrades for both free & premium modules, plus the occasional emergency changes when critical vulnerabilities are publicly disclosed without patches. Order Unauthenticated WP DEC 2024 Patch Management.
Security is not a single-task job
Need tailored WP Security and got no clue where to start? Hire an expert. Pay a coffee per week or figure it out yourself.
