Aktuelle WordPress-Sicherheitslücken

The Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Buffer in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the plugin's Remove mode to be active and the malicious comment to be published, either through auto-approval for known commenters or manual moderator approval.

Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

Prüfe die installierte Version und die Herstellerhinweise. Erstelle vor einem Update ein Backup und kontrolliere danach die Funktionen. Ist keine Fehlerbehebung verfügbar, prüfe eine vorübergehende Deaktivierung oder eine Alternative.

Originalmeldung bei Wordfence →

The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the `wcfmmp_profile_settings()` REST handler exposed at `POST /mobile-builder/v1/wcfm-profile-settings`. This is due to a PHP loose-comparison logic flaw in the meta key allow-list check — `strpos( $key, 'mobile_builder' ) == 0` evaluates to `true` for any key that does *not* contain the substring `'mobile_builder'` because `strpos()` returns `false` on no match and `false == 0` is `true` in PHP — combined with a `permission_callback` (`user_permissions_check`) that grants access to any authenticated user by only verifying `$user->exists()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to pass an unsanitized `data` array via the `key` and `data` parameters directly to `update_user_meta()`, overwriting arbitrary user meta on their own account — including the `wp_capabilities` meta key — to grant themselves Administrator-level privileges.

Mobile builder: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

Prüfe die installierte Version und die Herstellerhinweise. Erstelle vor einem Update ein Backup und kontrolliere danach die Funktionen. Ist keine Fehlerbehebung verfügbar, prüfe eine vorübergehende Deaktivierung oder eine Alternative.

Originalmeldung bei Wordfence →

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the `ACUI_Cron::save_settings()` function, which persists `acui_cron_activated`, `acui_cron_configured_by`, `acui_cron_user_id`, and `acui_cron_path_to_file` before reaching the authorization gate that calls `wp_die()` when a non-promoter submits a role. This makes it possible for authenticated attackers holding a custom delegated role with `create_users` but without `promote_users` or `edit_users` to escalate their privileges to Administrator, provided a prior administrator cron-tab save exists and no successful save intervenes before the next unattended cron tick processes the attacker's repointed CSV file.

Import and export users and customers: Update to version 2.5.12, or a newer patched version

Prüfe die installierte Version und die Herstellerhinweise. Erstelle vor einem Update ein Backup und kontrolliere danach die Funktionen. Ist keine Fehlerbehebung verfügbar, prüfe eine vorübergehende Deaktivierung oder eine Alternative.

Originalmeldung bei Wordfence →

The Slim Jetpack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'g-website (Website contact-field)' parameter in all versions up to, and including, 2.7.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce and authentication checks on form submission are only enforced for logged-in users, allowing unauthenticated visitors to store payloads via any page containing the [contact-form] shortcode.

Slim Jetpack: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

Prüfe die installierte Version und die Herstellerhinweise. Erstelle vor einem Update ein Backup und kontrolliere danach die Funktionen. Ist keine Fehlerbehebung verfügbar, prüfe eine vorübergehende Deaktivierung oder eine Alternative.

Originalmeldung bei Wordfence →

The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the [gravity-simple-turnstile] shortcode in versions up to, and including, 1.44.3 This is due to insufficient input sanitization and output escaping on the shortcode attribute in the cfturnstile_gravity_shortcode() function: the value is filtered only by esc_html() and sanitize_text_field() (neither of which touches parentheses or dots) and then emitted via esc_js() in a raw JavaScript expression context outside any string literal (esc_js only escapes quotes, backslashes, and newlines). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Simple CAPTCHA with Cloudflare Turnstile: Update to version 1.44.4, or a newer patched version

Prüfe die installierte Version und die Herstellerhinweise. Erstelle vor einem Update ein Backup und kontrolliere danach die Funktionen. Ist keine Fehlerbehebung verfügbar, prüfe eine vorübergehende Deaktivierung oder eine Alternative.

Originalmeldung bei Wordfence →

The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.3. The plugin caches the response of Core’s wp-activate.php without honoring its no-store/no-cache headers, the wp-activate-* cookie, or the WP_INSTALLING state, writing the credential-bearing activation response to a publicly accessible cache file. This makes it possible for unauthenticated attackers to retrieve the plaintext username and twelve-character password of the most recently activated Multisite registrant from that cached wp-activate.php response. Exploitation requires a Multisite subdirectory installation with public user and site registration enabled, and the credentials are only exposed after a genuine registrant follows their activation link.

WP Fastest Cache – WordPress Cache Plugin: Update to version 1.5.4, or a newer patched version

Prüfe die installierte Version und die Herstellerhinweise. Erstelle vor einem Update ein Backup und kontrolliere danach die Funktionen. Ist keine Fehlerbehebung verfügbar, prüfe eine vorübergehende Deaktivierung oder eine Alternative.

Originalmeldung bei Wordfence →