Wysoka
Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update
The Freemius SDK for WordPress is vulnerable to authorization bypass due to a missing capability check on the _get_db_option and _set_db_option functions in versions up to, and including, 2.2.3. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change site settings and potentially take over the site.
Czego dotyczy
Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.
| Platforma | Paczka | Podatne wersje | Poprawka w wersji |
|---|---|---|---|
| Wtyczka WordPress | 404 to 301 – Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring | < 3.0.2 | 3.0.2 |
| Wtyczka WordPress | Addendio LITE – Find WordPress plugins and themes | <= 1.2.2 | brak poprawki |
| Wtyczka WordPress | Livemesh Addons by Elementor | < 2.6 | 2.6 |
| Wtyczka WordPress | Add Pinterest conversion tags for Pinterest Ads + Site verification | < 1.0.2 | 1.0.2 |
| Wtyczka WordPress | Ant Admin Notices for Team | < 1.0.4 | 1.0.4 |
| Wtyczka WordPress | Advanced Classifieds & Directory Pro | < 1.6.3 | 1.6.3 |
| Wtyczka WordPress | WordPress Animation Plugin – Animated Everything | <= 1.3.2 | brak poprawki |
| Wtyczka WordPress | Any Popup – Popup Forms, Optins & Ads | <= 1.0 | brak poprawki |
| Wtyczka WordPress | a-staff – Team member showcase plugin for WordPress | <= 1.2.2 | brak poprawki |
| Wtyczka WordPress | Automatic Post Categories | <= 1.0 | brak poprawki |
| Wtyczka WordPress | Before and After Product Images for WooCommerce | <= 1.0.3 | brak poprawki |
| Wtyczka WordPress | Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels | < 2.2.3.1 | 2.2.3.1 |
| Wtyczka WordPress | Better Robots.txt – AI-Ready Crawl Control & Bot Governance | < 1.2.6 | 1.2.6 |
| Wtyczka WordPress | BuddyForms | < 2.3.2 | 2.3.2 |
| Wtyczka WordPress | BuddyForms EasyPin | <= 1.0.1 | brak poprawki |
| Wtyczka WordPress | ClimateClick: Climate Action for all | <= 1.0.9.21 | 1.0.9.22 |
| Wtyczka WordPress | Webheadcoder Multi-Step Forms for Contact Form 7 | < 3.0.9 | 3.0.9 |
| Wtyczka WordPress | Content Aware Sidebars – Fastest Widget Area Plugin | < 3.8.1 | 3.8.1 |
| Wtyczka WordPress | Content Collector | <= 1.1.1 | brak poprawki |
| Wtyczka WordPress | CP Image Gallery | <= 1.0.1 | brak poprawki |
| Wtyczka WordPress | CP Simple Newsletter | <= 1.1 | brak poprawki |
| Wtyczka WordPress | Cryptocurrency Portfolio Tracker | <= 0.0.17 | brak poprawki |
| Wtyczka WordPress | Customer Chat Facebook | <= 1.1.1 | brak poprawki |
| Wtyczka WordPress | Custom Registration and Custom Login Forms with New Recaptcha | <= 1.1 | brak poprawki |
| Wtyczka WordPress | Delete Duplicate Posts | < 4.1.9.5 | 4.1.9.5 |
| Wtyczka WordPress | DeMomentSomTres Address | <= 2.1 | brak poprawki |
| Wtyczka WordPress | DeMomentSomTres Categories | <= 201704251008 | brak poprawki |
| Wtyczka WordPress | DeMomentSomTres Classify on Publish | <= 201703020805 | brak poprawki |
| Wtyczka WordPress | DeMomentSomTres Grid Archive | <= 2.1 | brak poprawki |
| Wtyczka WordPress | DeMomentSomTres Media Tools Auto | <= 2.0 | brak poprawki |
| Wtyczka WordPress | Device Frame | <= 1.0.0 | brak poprawki |
| Wtyczka WordPress | Drop Shadow Boxes | < 1.7.2 | 1.7.2 |
| Wtyczka WordPress | Easy Code Snippets | < 1.0.1 | 1.0.1 |
| Wtyczka WordPress | Easy Watermark | < 0.7.1 | 0.7.1 |
| Wtyczka WordPress | Easy Digital Downloads – Courses | < 0.1.1 | 0.1.1 |
| Wtyczka WordPress | EDD Tab Manager | < 1.3.1 | 1.3.1 |
| Wtyczka WordPress | enhanced-catalog-images-for-woocommerce | <= 1.0.1 | brak poprawki |
| Wtyczka WordPress | Error Log Monitor | < 1.6.5 | 1.6.5 |
| Wtyczka WordPress | Expire tags | <= 1.1 | brak poprawki |
| Wtyczka WordPress | Fast WordPress | <= 1.0.3 | brak poprawki |
| Wtyczka WordPress | FIT: Featured Image Toolkit | <= 1.0.3 | brak poprawki |
| Wtyczka WordPress | Get feedback from visitors – WP Feedback Suite Plugin | <= 1.0.5 | brak poprawki |
| Wtyczka WordPress | Image Photo Gallery Final Tiles Grid | < 3.3.57 | 3.3.57 |
| Wtyczka WordPress | Lightbox & Modal Popup WordPress Plugin – FooBox | < 2.6.4 | 2.6.4 |
| Wtyczka WordPress | FooGallery Photo Gallery : Image, Video & Masonry Galleries | < 1.6.17 | 1.6.17 |
| Wtyczka WordPress | freemage | <= 1.0 | brak poprawki |
| Wtyczka WordPress | WordPress Cloaking – Show & Create Geo-Targeted Custom HTML Plugin – GeoRequest | <= 0.1.9 | brak poprawki |
| Wtyczka WordPress | GFireM Action After | <= 1.1.6 | brak poprawki |
| Wtyczka WordPress | GFireM Advance Search | <= 1.2.2 | brak poprawki |
| Wtyczka WordPress | GFireM Fields | <= 1.1.7 | brak poprawki |
| Wtyczka WordPress | Simple Giveaways – Grow your business, email lists and traffic with contests | < 2.18.0 | 2.18.0 |
| Wtyczka WordPress | Giveaways for woocommerce | <= 1.0.0 | brak poprawki |
| Wtyczka WordPress | Global Income Stats from Freemius | <= 1.0.0 | brak poprawki |
| Wtyczka WordPress | go-fetch-jobs-jobengine | <= 1.0 | brak poprawki |
| Wtyczka WordPress | Gravity Forms Sticky List | <= 1.5.2 | brak poprawki |
| Wtyczka WordPress | Helpie FAQ — Accordion, Docs & Knowledge Base | < 0.7.2 | 0.7.2 |
| Wtyczka WordPress | Import Social Statistics | <= 1.0.2 | brak poprawki |
| Wtyczka WordPress | Inbound Brew | <= 1.9.4 | brak poprawki |
| Wtyczka WordPress | Insert or Embed Articulate Content into WordPress | < 4.2997 | 4.2997 |
| Wtyczka WordPress | Kanzu Support Desk – WordPress Helpdesk Plugin | <= 2.4.7 | brak poprawki |
| Wtyczka WordPress | KRSP Frontend File Uploader | <= 1.0 | brak poprawki |
| Wtyczka WordPress | Livemesh SiteOrigin Widgets | < 2.5.2 | 2.5.2 |
| Wtyczka WordPress | Master Blocks – Gutenberg Site Builder | <= 1.0.4 | brak poprawki |
| Wtyczka WordPress | WP Mobile Menu – The Mobile-Friendly Responsive Menu | < 2.7.3 | 2.7.3 |
| Wtyczka WordPress | Multilist Subscribe for Sendy | <= 1.6.1 | brak poprawki |
| Wtyczka WordPress | Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery | < 3.1.7 | 3.1.7 |
| Wtyczka WordPress | WooCommerce Next Order Coupon | <= 0.4.0 | brak poprawki |
| Wtyczka WordPress | NEXUS | <= 2.0 | brak poprawki |
| Wtyczka WordPress | Nitek Carousel Slider Cool Transitions | <= 1.1.0 | brak poprawki |
| Wtyczka WordPress | Nugget by Ingot: Easy, automated and native A/B testing for everyone | <= 1.0.0 | brak poprawki |
| Wtyczka WordPress | One Page Blocks | <= 1.0.0 | brak poprawki |
| Wtyczka WordPress | Page Studio Lite Plugin | <= 1.0.6 | brak poprawki |
| Wtyczka WordPress | Past Events Extension | <= 1.0.1 | brak poprawki |
| Wtyczka WordPress | Perelandra Sermons | <= 1.1.0 | brak poprawki |
| Wtyczka WordPress | Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder | < 1.8.3 | 1.8.3 |
| Wtyczka WordPress | Post Snippets – Custom WordPress Code Snippets Customizer | < 3.0.6 | 3.0.6 |
| Wtyczka WordPress | Premmerce Product Filter for WooCommerce | < 3.2 | 3.2 |
| Wtyczka WordPress | Premmerce Variation Swatches for WooCommerce | < 1.1 | 1.1 |
| Wtyczka WordPress | Premmerce Wholesale Pricing for WooCommerce | < 1.1.4 | 1.1.4 |
| Wtyczka WordPress | Premmerce Wishlist for WooCommerce | < 1.1.3 | 1.1.3 |
| Wtyczka WordPress | Press Elements – Widgets for Elementor | <= 1.7.2 | brak poprawki |
| Wtyczka WordPress | Price Bands for WooCommerce | <= 1.0.4 | brak poprawki |
| Wtyczka WordPress | Product Tables for WooCommerce: Quickster | <= 1.0.2 | brak poprawki |
| Wtyczka WordPress | Random Sorting Order for WooCommerce | <= 1.0 | brak poprawki |
| Wtyczka WordPress | Contact Form for WordPress- Cybrosys | <= 5.0 | brak poprawki |
| Wtyczka WordPress | Remove WP Update Nags | < 1.4.0 | 1.4.0 |
| Wtyczka WordPress | Online Booking for Barbershops and Salons | <= 1.0.0 | brak poprawki |
| Wtyczka WordPress | Affiliate Link Builder Plugin for Amazon Associates – Review Engine | <= 1.0.41 | brak poprawki |
| Wtyczka WordPress | WordPress Reviews by ReviewPress | <= 1.0.5 | brak poprawki |
| Wtyczka WordPress | Revolution for Elementor | <= 0.0.19 | brak poprawki |
| Wtyczka WordPress | MailChimp Manager | <= 1.0.2 | brak poprawki |
| Wtyczka WordPress | Run time Image resizing | <= 1.1 | brak poprawki |
| Wtyczka WordPress | RW Divi Unite Gallery | <= 1.0 | brak poprawki |
| Wtyczka WordPress | Content Slider for WP Posts (Section Slider) | wszystkie wersje | brak poprawki |
| Wtyczka WordPress | WP Author Bio | <= 1.5.5 | brak poprawki |
| Wtyczka WordPress | SheetPress – Manage WordPress Meta data with Google Sheets | <= 1.1 | brak poprawki |
| Wtyczka WordPress | SnazzyAdmin WP Admin Theme | <= 1.0.2 | brak poprawki |
| Wtyczka WordPress | Social Gallery Lite | <= 3.1 | brak poprawki |
| Wtyczka WordPress | Sprout Clients – CRM and Lead Management | <= 3.1 | 3.2 |
| Wtyczka WordPress | Starfish Review Generation & Marketing for WordPress | < 2.0.1 | 2.0.1 |
| Wtyczka WordPress | Stop User Enumeration | < 1.3.20 | 1.3.20 |
| Wtyczka WordPress | TinyMCE Annotate | <= 1.1.2 | brak poprawki |
| Wtyczka WordPress | Turbo Widgets | <= 2.0.0 | brak poprawki |
| Wtyczka WordPress | FTC Disclosure | <= 2.0 | brak poprawki |
| Wtyczka WordPress | Social Share Icons & Social Share Buttons | < 3.0.4 | 3.0.4 |
| Wtyczka WordPress | Ultimate Widgets Light | <= 1.5.9.4 | brak poprawki |
| Wtyczka WordPress | Ultimeter – the Ultimate Progress and Goals Meter | < 1.9.3 | 1.9.3 |
| Wtyczka WordPress | BuddyPress Integration for WooCommerce | < 3.2.6.1 | 3.2.6.1 |
| Wtyczka WordPress | Funnelmentals | < 1.2.9 | 1.2.9 |
| Wtyczka WordPress | wGauge – Free Version | <= 1.0.0 | brak poprawki |
| Wtyczka WordPress | Widgets for SiteOrigin | < 1.4.3 | 1.4.3 |
| Wtyczka WordPress | Widgets on Pages and Posts | <= 1.4.0 | brak poprawki |
| Wtyczka WordPress | Woo Admin Product Notes | <= 1.0.0 | brak poprawki |
| Wtyczka WordPress | WooRocks Magic Content | <= 1.0.17 | brak poprawki |
| Wtyczka WordPress | Magic Content for Siteorigins Pagebuilder | <= 1.0.1 | brak poprawki |
| Wtyczka WordPress | WP Advanced Comment | <= 0.3 | brak poprawki |
| Wtyczka WordPress | WP Affiliate Disclosure | < 1.1.4 | 1.1.4 |
| Wtyczka WordPress | wp-buddha-free-adwords | <= 1.0.0 | brak poprawki |
| Wtyczka WordPress | WP fail2ban – Advanced Security | < 4.0.5 | 4.0.5 |
| Wtyczka WordPress | WP Munich Blocks – Gutenberg Blocks for WordPress | < 0.7.3 | 0.7.3 |
| Wtyczka WordPress | WP Photo Effects | < 1.2.3 | 1.2.3 |
| Wtyczka WordPress | WP Private Media | <= 1.0.1 | brak poprawki |
| Wtyczka WordPress | WP Pro Counter | <= 1.1 | brak poprawki |
| Wtyczka WordPress | WP Relevant Ads | <= 1.0.0 | brak poprawki |
| Wtyczka WordPress | WP Activity Log | < 3.3.1.2 | 3.3.1.2 |
| Wtyczka WordPress | BAVOKO SEO Tools – All-in-One WordPress SEO | < 2.1.9.8 | 2.1.9.8 |
| Wtyczka WordPress | XPoster – Share to Bluesky and Mastodon | < 3.3.0 | 3.3.0 |
| Wtyczka WordPress | WordPress FAQ Plugin – WPWorx | <= 2.0.0 | brak poprawki |
| Motyw WordPress | Bani | <= 1.0.7 | brak poprawki |
| Motyw WordPress | Brand | <= 1.9.1 | brak poprawki |
| Motyw WordPress | ConsultPress Lite | <= 1.2.3 | brak poprawki |
| Motyw WordPress | Purus | <= 1.2.2 | brak poprawki |
| Motyw WordPress | Shuban | <= 1.1.2 | brak poprawki |
| Motyw WordPress | Speculor | <= 1.2.0 | brak poprawki |
Odnośniki
Ocena CVSS
8.8/10
- Wektor CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- Słabość (CWE)
CWE-862- Platforma
- WordPress
- Paczka
404 to 301 – Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring, Addendio LITE – Find WordPress plugins and themes, Livemesh Addons by Elementor- Ujawniono
- 25.02.2019
- Aktualizacja
- 11.10.2026 10:22
Źródła i licencje
Wordfence Intelligence - 3fda31fa-efc9-44b9-99ba-9e3e23aa2ee0 - Wordfence Intelligence
Copyright 2012-2026 Defiant Inc.
This record contains material that is subject to copyright
Copyright 2012-2026 Defiant Inc.
Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.
https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/Wordfence Intelligence
Wordfence Intelligence - Defiant, Inc. Copyright Defiant, Inc. All rights reserved except as granted below. License grant, section 3.1 of the Wordfence Intelligence Terms and Conditions (January 26, 2026): Subject to this Agreement, Company hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute the Service. Any copy you make for such purposes is authorized provided that you reproduce Company’s copyright designation, this license, and the license of any disclosed Company licensor in any such copy. Full applicable Agreement: https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Historia podatności: Ant Admin Notices for Team
Wszystkie opisane podatności tej paczki (Wtyczka WordPress), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.
- Wszystkich wpisów
- 2
- Pierwsza → ostatnia
- 02.2019 03.2022
- Bez poprawki
- 1
- Wykorzystywana w atakach
- 0
Rozkład istotności
- Wysoka 1
- Średnia 1
Ujawnienia w latach
- 2019: 1
- 2020: 0
- 2021: 0
- 2022: 1
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update ten wpis
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.