Aktuelle WordPress-Sicherheitslücken

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the render_image function. This is due to unrestricted mass assignment of caller-supplied meta_data keys onto the image model combined with missing realpath containment in path construction and a bypassable signature check on the public image delivery route. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server. Exploitation requires the authenticated attacker to own at least one NextGEN gallery — a condition that can be satisfied by any Subscriber who was ever granted the 'NextGEN Manage gallery' capability, and that access is retained indefinitely due to the stored gallery-author equality fallback in _can_manage_gallery() even after the capability is revoked.

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery: Update to version 4.5.0, or a newer patched version

Prüfe die installierte Version und die Herstellerhinweise. Erstelle vor einem Update ein Backup und kontrolliere danach die Funktionen. Ist keine Fehlerbehebung verfügbar, prüfe eine vorübergehende Deaktivierung oder eine Alternative.

Originalmeldung bei Wordfence →

The Germanized for WooCommerce plugin for WordPress is vulnerable to Unauthorized Access of Private Data via Activation Token Reuse in versions up to, and including, 4.1.4. This is due to the `on_user_email_changed` hook — which is responsible for rotating the activation token and recording a pending-email-change marker on an unactivated Customer account — only being registered inside the `is_double_opt_in_login_enabled()` branch when "Disable login for unactivated customers" is set to Yes, leaving the original `?activate=` token valid and entirely unbound to the email address it was issued for when that setting is No. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change their account email to a victim's billing email via the standard `/my-account/edit-account/` form and then redeem their original activation token through `customer_account_activate()`, triggering `link_customer_past_orders()` to reassign any matching guest order to the attacker's account and exposing the original buyer's billing name, street address, phone number, and purchased items on the attacker's My Account order page. Exploitation requires the site to have double opt-in enabled with "Disable login for unactivated customers" explicitly set to No (a non-default configuration), public customer registration enabled, and the original activation token redeemed within its one-day expiry window.

Germanized for WooCommerce: Update to version 4.1.5, or a newer patched version

Prüfe die installierte Version und die Herstellerhinweise. Erstelle vor einem Update ein Backup und kontrolliere danach die Funktionen. Ist keine Fehlerbehebung verfügbar, prüfe eine vorübergehende Deaktivierung oder eine Alternative.

Originalmeldung bei Wordfence →

The WooCommerce Extra Product Options Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_start / _end' parameter in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This vulnerability is only exploitable on product pages where a Date & Time Range Picker extra field is configured, though the required field name is visible in the product page source and requires no prior knowledge to discover.

WooCommerce Extra Product Options Pro: Update to version 3.3.3, or a newer patched version

Prüfe die installierte Version und die Herstellerhinweise. Erstelle vor einem Update ein Backup und kontrolliere danach die Funktionen. Ist keine Fehlerbehebung verfügbar, prüfe eine vorübergehende Deaktivierung oder eine Alternative.

Originalmeldung bei Wordfence →

The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message (and pageUrl)' parameter in all versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that the site administrator has debug logging enabled with JS error logging active, and that the attacker can obtain the publicly emitted dlmVars.jsErrorLogging nonce — which is broadcast on every frontend page — to pass the nonce check on the unauthenticated endpoint.

Debug Log Manager – Conveniently Monitor and Inspect Errors: Update to version 2.5.3, or a newer patched version

Prüfe die installierte Version und die Herstellerhinweise. Erstelle vor einem Update ein Backup und kontrolliere danach die Funktionen. Ist keine Fehlerbehebung verfügbar, prüfe eine vorübergehende Deaktivierung oder eine Alternative.

Originalmeldung bei Wordfence →

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'idfield' parameter in all versions up to, and including, 1.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

WP Directory Kit: Update to version 1.6.1, or a newer patched version

Prüfe die installierte Version und die Herstellerhinweise. Erstelle vor einem Update ein Backup und kontrolliere danach die Funktionen. Ist keine Fehlerbehebung verfügbar, prüfe eine vorübergehende Deaktivierung oder eine Alternative.

Originalmeldung bei Wordfence →

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_images' parameter in all versions up to, and including, 2.8.197 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload does not fire for the attacker directly; it executes in the browser of any Administrator or Editor who opens the pending listing's edit screen, making this a privilege-escalation-capable stored XSS chain triggered through normal editorial workflow.

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Update to version 2.8.198, or a newer patched version

Prüfe die installierte Version und die Herstellerhinweise. Erstelle vor einem Update ein Backup und kontrolliere danach die Funktionen. Ist keine Fehlerbehebung verfügbar, prüfe eine vorübergehende Deaktivierung oder eine Alternative.

Originalmeldung bei Wordfence →