Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
- Two WordPress plugins found 18 security flaws
- Most of them are considered critical, since they allow RCE, among other things
- All have been patched, so be sure to update your plugins
Two premiums WordPress plugins were found to carry more than a dozen vulnerabilities, some of which were considered critical.
This is according to the WordPress cybersecurity platform Patchstack, which found the problems in the website builder at the end of March 2024, and reported them to the developers. Since then, all bugs have been mitigated.
Bugs were found in the WPLMS and VibeBP plugins.
Update plugins
WordPress enables Learning Management Systems (LMS), platforms that allow users to create, manage and sell online courses directly from their WordPress website. LMS plugins integrate educational features and functionality with WordPress, allowing instructors or organizations to deliver courses, track student progress, and engage students effectively.
One of the most popular LMS platforms around is WPLMS, built by a company called VibeThemes. Purchased over 28,000 times already, it comes with numerous features such as course creation and management, quizzes and assessments, membership and subscription support, and more.
VibeBP, on the other hand, is a WordPress plugin that integrates BuddyPress with WPLMS, enhancing its social learning features. Allows users to create communities by providing options for user profiles, activity streams, private messaging and notifications. It was also built by VibeThemes.
Patchstack says it found 18 vulnerabilities, most of which were critical in severity.
They allowed remote, unauthenticated attackers to upload arbitrary files, execute code, escalate privileges and perform SQL injections. In other words, they could use the bugs to take over websites, steal sensitive data, and more. One bug – CVE-2024-56046 – was also given the maximum score, 10/10, as it allows malicious actors to upload arbitrary files without authentication, potentially leading to remote code execution (RCE).
The full list of vulnerabilities, as well as the affected versions, can be found on this link.
WPLMS users should ensure their platform is updated to version 1.9.9.5.3 or newer, and VibeBP to 1.9.9.7.7 or newer.
Typically, site owners should enforce secure file uploads, SQL query sanitization, and role-based access controls, Patchstack said.
Via BleepingComputer
