Hoch

Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update

Veröffentlicht: 25.02.2019
Aktualisiert: 11.10.2026 10:22

The Freemius SDK for WordPress is vulnerable to authorization bypass due to a missing capability check on the _get_db_option and _set_db_option functions in versions up to, and including, 2.2.3. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change site settings and potentially take over the site.

Betroffene Software

Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.

Plattform	Paket	Anfällige Versionen	Behoben in
WordPress-Plugin	404 to 301 – Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring	< 3.0.2	3.0.2
WordPress-Plugin	Addendio LITE – Find WordPress plugins and themes	<= 1.2.2	keine Korrektur
WordPress-Plugin	Livemesh Addons by Elementor	< 2.6	2.6
WordPress-Plugin	Add Pinterest conversion tags for Pinterest Ads + Site verification	< 1.0.2	1.0.2
WordPress-Plugin	Ant Admin Notices for Team	< 1.0.4	1.0.4
WordPress-Plugin	Advanced Classifieds & Directory Pro	< 1.6.3	1.6.3
WordPress-Plugin	WordPress Animation Plugin – Animated Everything	<= 1.3.2	keine Korrektur
WordPress-Plugin	Any Popup – Popup Forms, Optins & Ads	<= 1.0	keine Korrektur
WordPress-Plugin	a-staff – Team member showcase plugin for WordPress	<= 1.2.2	keine Korrektur
WordPress-Plugin	Automatic Post Categories	<= 1.0	keine Korrektur
WordPress-Plugin	Before and After Product Images for WooCommerce	<= 1.0.3	keine Korrektur
WordPress-Plugin	Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels	< 2.2.3.1	2.2.3.1
WordPress-Plugin	Better Robots.txt – AI-Ready Crawl Control & Bot Governance	< 1.2.6	1.2.6
WordPress-Plugin	BuddyForms	< 2.3.2	2.3.2
WordPress-Plugin	BuddyForms EasyPin	<= 1.0.1	keine Korrektur
WordPress-Plugin	ClimateClick: Climate Action for all	<= 1.0.9.21	1.0.9.22
WordPress-Plugin	Webheadcoder Multi-Step Forms for Contact Form 7	< 3.0.9	3.0.9
WordPress-Plugin	Content Aware Sidebars – Fastest Widget Area Plugin	< 3.8.1	3.8.1
WordPress-Plugin	Content Collector	<= 1.1.1	keine Korrektur
WordPress-Plugin	CP Image Gallery	<= 1.0.1	keine Korrektur
WordPress-Plugin	CP Simple Newsletter	<= 1.1	keine Korrektur
WordPress-Plugin	Cryptocurrency Portfolio Tracker	<= 0.0.17	keine Korrektur
WordPress-Plugin	Customer Chat Facebook	<= 1.1.1	keine Korrektur
WordPress-Plugin	Custom Registration and Custom Login Forms with New Recaptcha	<= 1.1	keine Korrektur
WordPress-Plugin	Delete Duplicate Posts	< 4.1.9.5	4.1.9.5
WordPress-Plugin	DeMomentSomTres Address	<= 2.1	keine Korrektur
WordPress-Plugin	DeMomentSomTres Categories	<= 201704251008	keine Korrektur
WordPress-Plugin	DeMomentSomTres Classify on Publish	<= 201703020805	keine Korrektur
WordPress-Plugin	DeMomentSomTres Grid Archive	<= 2.1	keine Korrektur
WordPress-Plugin	DeMomentSomTres Media Tools Auto	<= 2.0	keine Korrektur
WordPress-Plugin	Device Frame	<= 1.0.0	keine Korrektur
WordPress-Plugin	Drop Shadow Boxes	< 1.7.2	1.7.2
WordPress-Plugin	Easy Code Snippets	< 1.0.1	1.0.1
WordPress-Plugin	Easy Watermark	< 0.7.1	0.7.1
WordPress-Plugin	Easy Digital Downloads – Courses	< 0.1.1	0.1.1
WordPress-Plugin	EDD Tab Manager	< 1.3.1	1.3.1
WordPress-Plugin	enhanced-catalog-images-for-woocommerce	<= 1.0.1	keine Korrektur
WordPress-Plugin	Error Log Monitor	< 1.6.5	1.6.5
WordPress-Plugin	Expire tags	<= 1.1	keine Korrektur
WordPress-Plugin	Fast WordPress	<= 1.0.3	keine Korrektur
WordPress-Plugin	FIT: Featured Image Toolkit	<= 1.0.3	keine Korrektur
WordPress-Plugin	Get feedback from visitors – WP Feedback Suite Plugin	<= 1.0.5	keine Korrektur
WordPress-Plugin	Image Photo Gallery Final Tiles Grid	< 3.3.57	3.3.57
WordPress-Plugin	Lightbox & Modal Popup WordPress Plugin – FooBox	< 2.6.4	2.6.4
WordPress-Plugin	FooGallery Photo Gallery : Image, Video & Masonry Galleries	< 1.6.17	1.6.17
WordPress-Plugin	freemage	<= 1.0	keine Korrektur
WordPress-Plugin	WordPress Cloaking – Show & Create Geo-Targeted Custom HTML Plugin – GeoRequest	<= 0.1.9	keine Korrektur
WordPress-Plugin	GFireM Action After	<= 1.1.6	keine Korrektur
WordPress-Plugin	GFireM Advance Search	<= 1.2.2	keine Korrektur
WordPress-Plugin	GFireM Fields	<= 1.1.7	keine Korrektur
WordPress-Plugin	Simple Giveaways – Grow your business, email lists and traffic with contests	< 2.18.0	2.18.0
WordPress-Plugin	Giveaways for woocommerce	<= 1.0.0	keine Korrektur
WordPress-Plugin	Global Income Stats from Freemius	<= 1.0.0	keine Korrektur
WordPress-Plugin	go-fetch-jobs-jobengine	<= 1.0	keine Korrektur
WordPress-Plugin	Gravity Forms Sticky List	<= 1.5.2	keine Korrektur
WordPress-Plugin	Helpie FAQ — Accordion, Docs & Knowledge Base	< 0.7.2	0.7.2
WordPress-Plugin	Import Social Statistics	<= 1.0.2	keine Korrektur
WordPress-Plugin	Inbound Brew	<= 1.9.4	keine Korrektur
WordPress-Plugin	Insert or Embed Articulate Content into WordPress	< 4.2997	4.2997
WordPress-Plugin	Kanzu Support Desk – WordPress Helpdesk Plugin	<= 2.4.7	keine Korrektur
WordPress-Plugin	KRSP Frontend File Uploader	<= 1.0	keine Korrektur
WordPress-Plugin	Livemesh SiteOrigin Widgets	< 2.5.2	2.5.2
WordPress-Plugin	Master Blocks – Gutenberg Site Builder	<= 1.0.4	keine Korrektur
WordPress-Plugin	WP Mobile Menu – The Mobile-Friendly Responsive Menu	< 2.7.3	2.7.3
WordPress-Plugin	Multilist Subscribe for Sendy	<= 1.6.1	keine Korrektur
WordPress-Plugin	Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery	< 3.1.7	3.1.7
WordPress-Plugin	WooCommerce Next Order Coupon	<= 0.4.0	keine Korrektur
WordPress-Plugin	NEXUS	<= 2.0	keine Korrektur
WordPress-Plugin	Nitek Carousel Slider Cool Transitions	<= 1.1.0	keine Korrektur
WordPress-Plugin	Nugget by Ingot: Easy, automated and native A/B testing for everyone	<= 1.0.0	keine Korrektur
WordPress-Plugin	One Page Blocks	<= 1.0.0	keine Korrektur
WordPress-Plugin	Page Studio Lite Plugin	<= 1.0.6	keine Korrektur
WordPress-Plugin	Past Events Extension	<= 1.0.1	keine Korrektur
WordPress-Plugin	Perelandra Sermons	<= 1.1.0	keine Korrektur
WordPress-Plugin	Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder	< 1.8.3	1.8.3
WordPress-Plugin	Post Snippets – Custom WordPress Code Snippets Customizer	< 3.0.6	3.0.6
WordPress-Plugin	Premmerce Product Filter for WooCommerce	< 3.2	3.2
WordPress-Plugin	Premmerce Variation Swatches for WooCommerce	< 1.1	1.1
WordPress-Plugin	Premmerce Wholesale Pricing for WooCommerce	< 1.1.4	1.1.4
WordPress-Plugin	Premmerce Wishlist for WooCommerce	< 1.1.3	1.1.3
WordPress-Plugin	Press Elements – Widgets for Elementor	<= 1.7.2	keine Korrektur
WordPress-Plugin	Price Bands for WooCommerce	<= 1.0.4	keine Korrektur
WordPress-Plugin	Product Tables for WooCommerce: Quickster	<= 1.0.2	keine Korrektur
WordPress-Plugin	Random Sorting Order for WooCommerce	<= 1.0	keine Korrektur
WordPress-Plugin	Contact Form for WordPress- Cybrosys	<= 5.0	keine Korrektur
WordPress-Plugin	Remove WP Update Nags	< 1.4.0	1.4.0
WordPress-Plugin	Online Booking for Barbershops and Salons	<= 1.0.0	keine Korrektur
WordPress-Plugin	Affiliate Link Builder Plugin for Amazon Associates – Review Engine	<= 1.0.41	keine Korrektur
WordPress-Plugin	WordPress Reviews by ReviewPress	<= 1.0.5	keine Korrektur
WordPress-Plugin	Revolution for Elementor	<= 0.0.19	keine Korrektur
WordPress-Plugin	MailChimp Manager	<= 1.0.2	keine Korrektur
WordPress-Plugin	Run time Image resizing	<= 1.1	keine Korrektur
WordPress-Plugin	RW Divi Unite Gallery	<= 1.0	keine Korrektur
WordPress-Plugin	Content Slider for WP Posts (Section Slider)	alle Versionen	keine Korrektur
WordPress-Plugin	WP Author Bio	<= 1.5.5	keine Korrektur
WordPress-Plugin	SheetPress – Manage WordPress Meta data with Google Sheets	<= 1.1	keine Korrektur
WordPress-Plugin	SnazzyAdmin WP Admin Theme	<= 1.0.2	keine Korrektur
WordPress-Plugin	Social Gallery Lite	<= 3.1	keine Korrektur
WordPress-Plugin	Sprout Clients – CRM and Lead Management	<= 3.1	3.2
WordPress-Plugin	Starfish Review Generation & Marketing for WordPress	< 2.0.1	2.0.1
WordPress-Plugin	Stop User Enumeration	< 1.3.20	1.3.20
WordPress-Plugin	TinyMCE Annotate	<= 1.1.2	keine Korrektur
WordPress-Plugin	Turbo Widgets	<= 2.0.0	keine Korrektur
WordPress-Plugin	FTC Disclosure	<= 2.0	keine Korrektur
WordPress-Plugin	Social Share Icons & Social Share Buttons	< 3.0.4	3.0.4
WordPress-Plugin	Ultimate Widgets Light	<= 1.5.9.4	keine Korrektur
WordPress-Plugin	Ultimeter – the Ultimate Progress and Goals Meter	< 1.9.3	1.9.3
WordPress-Plugin	BuddyPress Integration for WooCommerce	< 3.2.6.1	3.2.6.1
WordPress-Plugin	Funnelmentals	< 1.2.9	1.2.9
WordPress-Plugin	wGauge – Free Version	<= 1.0.0	keine Korrektur
WordPress-Plugin	Widgets for SiteOrigin	< 1.4.3	1.4.3
WordPress-Plugin	Widgets on Pages and Posts	<= 1.4.0	keine Korrektur
WordPress-Plugin	Woo Admin Product Notes	<= 1.0.0	keine Korrektur
WordPress-Plugin	WooRocks Magic Content	<= 1.0.17	keine Korrektur
WordPress-Plugin	Magic Content for Siteorigins Pagebuilder	<= 1.0.1	keine Korrektur
WordPress-Plugin	WP Advanced Comment	<= 0.3	keine Korrektur
WordPress-Plugin	WP Affiliate Disclosure	< 1.1.4	1.1.4
WordPress-Plugin	wp-buddha-free-adwords	<= 1.0.0	keine Korrektur
WordPress-Plugin	WP fail2ban – Advanced Security	< 4.0.5	4.0.5
WordPress-Plugin	WP Munich Blocks – Gutenberg Blocks for WordPress	< 0.7.3	0.7.3
WordPress-Plugin	WP Photo Effects	< 1.2.3	1.2.3
WordPress-Plugin	WP Private Media	<= 1.0.1	keine Korrektur
WordPress-Plugin	WP Pro Counter	<= 1.1	keine Korrektur
WordPress-Plugin	WP Relevant Ads	<= 1.0.0	keine Korrektur
WordPress-Plugin	WP Activity Log	< 3.3.1.2	3.3.1.2
WordPress-Plugin	BAVOKO SEO Tools – All-in-One WordPress SEO	< 2.1.9.8	2.1.9.8
WordPress-Plugin	XPoster – Share to Bluesky and Mastodon	< 3.3.0	3.3.0
WordPress-Plugin	WordPress FAQ Plugin – WPWorx	<= 2.0.0	keine Korrektur
WordPress-Theme	Bani	<= 1.0.7	keine Korrektur
WordPress-Theme	Brand	<= 1.9.1	keine Korrektur
WordPress-Theme	ConsultPress Lite	<= 1.2.3	keine Korrektur
WordPress-Theme	Purus	<= 1.2.2	keine Korrektur
WordPress-Theme	Shuban	<= 1.1.2	keine Korrektur
WordPress-Theme	Speculor	<= 1.2.0	keine Korrektur

Verweise

https://www.wordfence.com/threat-intel/vulnerabilities/id/3fda31fa-efc9-44b9-99ba-9e3e23aa2ee0?source=api-prod

CVSS-Wert 8.8/10

CVSS-Vektor: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Schwäche (CWE): CWE-862
Plattform: WordPress
Paket: 404 to 301 – Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring, Addendio LITE – Find WordPress plugins and themes, Livemesh Addons by Elementor
Veröffentlicht: 25.02.2019
Aktualisiert: 11.10.2026 10:22

Quellen und Lizenzen

Wordfence Intelligence - 3fda31fa-efc9-44b9-99ba-9e3e23aa2ee0 - Wordfence Intelligence

This record contains material that is subject to copyright

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/

Wordfence Intelligence

Wordfence Intelligence - Defiant, Inc.
Copyright Defiant, Inc. All rights reserved except as granted below.
License grant, section 3.1 of the Wordfence Intelligence Terms and Conditions (January 26, 2026):

Subject to this Agreement, Company hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute the Service. Any copy you make for such purposes is authorized provided that you reproduce Company’s copyright designation, this license, and the license of any disclosed Company licensor in any such copy.

Full applicable Agreement: https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/

Schwachstellenhistorie: WordPress Animation Plugin – Animated Everything

Alle veröffentlichten Schwachstellen dieses Pakets (WordPress-Plugin), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.

Einträge insgesamt: 3
Erste → letzte: 02.2019 07.2023
Ohne Fix: 3
In Angriffen ausgenutzt: 0

Verteilung nach Schweregrad

Hoch 1
Mittel 2

Veröffentlichungen pro Jahr

2019: 1
2020: 0
2021: 0
2022: 1
2023: 1
2024: 0
2025: 0
2026: 0

18.07.2023

Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get

Mittel · 6.1 CVE-2023-33999 <= 1.3.2 keine Korrektur
04.03.2022

Freemius SDK <= 2.4.2 - Missing Authorization Checks

Mittel · 6.3 CVE-2022-4974 alle Versionen keine Korrektur
25.02.2019

Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update dieser Eintrag

Hoch · 8.8 3fda31fa-efc9-44b9-99ba-9e3e23aa2ee0 <= 1.3.2 keine Korrektur

Erkennen Sie Schwachstellen in Ihrer Anwendung

Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.

Anwendung verbinden