Description (CNA)
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| dashlabsltd / YASR – Yet Another Star Rating Plugin for WordPress | affected 0 before 2.0.2 |
| nicheaddons / Events Addon for Elementor | affected 0 before 1.9.8 |
| dots / Fraud Prevention For WooCommerce and EDD | affected 0 before 2.1.0 |
| wpengine / Gutenberg Blocks – ACF Blocks Suite | affected 0 before 2.6.8 |
| bouncingsprout / Ultimeter | affected 0 before 2.7.6 |
| toddhalfpenny / Past Events Extension | affected 0 |
| pootlepress / Pootle Pagebuilder – WordPress Page builder | affected 0 before 5.7.1 |
| powerfulwp / Local Delivery Drivers for WooCommerce | affected 0 before 1.8.5 |
| kkikuchi1220 / Ultimate Gutenberg – Custom Block Templates | affected 0 |
| josevega / WP Required Taxonomies – Categories and Tags Mandatory | affected 0 before 1.1.8 |
| pmbaldha / Featured Products First for WooCommerce – A Extension of WooCommerce (WooCommerce Addon Plugin) | affected 0 |
| sslzen / SSL Zen — SSL Certificate Installer & HTTPS Redirects | affected 0 through 4.0.4 |
| wisersteps / Streak CRM For Gmail For Contact Form 7 – WordPress Plugin | affected 0 before 1.0.9 |
| wpdevpowers / WordPress Dev Powers – ACF Color Coded Field Types Plugin | affected 0 |
| benmoreassynt / DancePress (TRWA) | affected 0 through 3.1.2 |
| dots / Product Size Charts Plugin for WooCommerce | affected 0 before 2.2.3 |
| tribalnerd / Wp My Admin Bar | affected 0 |
| setka / A no-code page builder for beautiful performance-based content | affected 0 before 2.1.17 |
| mikebels / LocalSEOMap | affected 0 |
| cromer12 / Easy Prayer | affected 0 |
| rafalosinski / AdFoxly – Ad Manager, AdSense Ads & Ads.txt | affected 0 through 1.8.4 |
| stevehenty / WP Get Personal | affected 0 |
| theafricanboss/ / Checkout with Cash App on EDD | affected 0 |
| usmanaliqureshi / Server Info | affected 0 |
| themelocation / Custom WooCommerce Checkout Fields Editor | affected 0 through 1.2.6 |
| krsp / KRSP Frontend File Uploader | affected 0 |
| bplugins / Panorama – 360 Virtual Tour, Panoramic image viewer and More | affected 0 before 1.0.8 |
| janwyl / Bulk Attachment Download | affected 0 before 1.3.5 |
| majick / AutoSave Net | affected 0 |
| premmerce / Premmerce Wholesale Pricing for WooCommerce | affected 0 before 1.1.8 |
| jcodex / Any Popup – Popup Forms, Optins & Ads | affected 0 |
| theafricanboss/ / Checkout with Venmo on EDD | affected 0 |
| dreamfox / Payment Gateway Per Product for WooCommerce | affected 0 before 3.1.6 |
| hqtheme / HQTheme Extra | affected 0 |
| vincoit / Vit Website Reviews | affected 0 |
| daigo75 / EU VAT Assistant for WooCommerce | affected 0 before 2.0.28.220224 |
| eedee / WordPress Slider Block Gutenslider | affected 0 before 5.7.0 |
| surbma / HuCommerce | Magyar kiegészítések WooCommerce webáruházakhoz | affected 0 before 30.3.0 |
| lostboy7 / KVoucher | affected 0 |
| bplugins / YT Player – Embed and Customize Video Players | affected 0 before 1.5.1 |
| whiteshadow / Error Log Monitor | affected 0 before 1.7.1 |
| slidedeck / SlideDeck: Responsive WordPress Slider Plugin | affected 0 |
| premmerce / Premmerce Multi-currency for Woocommerce | affected 0 before 2.3.2 |
| mvvapps/ / Booking Addon for WooCommerce | affected 0 before 4.2.0 |
| wpeventpartners/ / WP Event Partners – WordPress Plugin for Event and Conference Management | affected 0 through 1.2.4 |
| saadiqbal / WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce | affected 0 before 4.2.1 |
| passionatebrains / AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization | affected 0 before 2.6 |
| majick / ForceField | affected 0 |
| richard-b / FIT: Featured Image Toolkit | affected 0 |
| themekraft / All in One Invite Codes | affected 0 before 1.0.13 |
| dots / Dynamic Pricing and Discount Rules for WooCommerce | affected 0 before 2.2.3 |
| wordplus / Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages | affected 0 before 1.9.9.170 |
| wpt00ls / Grid & Styler For Contact Form 7 And Divi | affected 0 before 1.4.1 |
| protectyouruploads / Protect Uploads with Login – Protect Your Uploads | affected 0 |
| sakurapixel / Atlas – Knowledge Base | affected 0 |
| dgwyer / Simple Sitemap – Create a Responsive HTML Sitemap | affected 0 before 3.5.5 |
| bplugins / Super Video player – Fully Customizable Video Player with Playlist | affected 0 before 1.6.11 |
| mhmrajib / WP Books Gallery – Build Stunning Book Showcases & Libraries in Minutes | affected 0 before 3.6 |
| damian-gora / FiboSearch – Ajax Search for WooCommerce | affected 0 before 1.17.0 |
| stevejburge / Tag Groups is the Advanced Way to Display Your Taxonomy Terms | affected 0 before 1.43.10.1 |
| prasadkirpekar / WP Free SSL | affected 0 before 1.2.7 |
| clickervolt / ClickerVolt – Affiliate Links & Click Tracking for Performance Marketers | affected 0 |
| proteusthemes / ConsultPress Lite | affected 0 |
| badhonrocks / Styler Mate for Contact Form 7 | affected 0 before 1.3.0 |
| streamweasels / StreamWeasels Twitch Integration | affected 0 before 1.3.4 |
| pagup / MOBILOOK — Mobile View & Mobile‑Friendly Test | affected 0 before 1.2.4 |
| paulio21 / Zip Code Redirect | affected 0 through 4.0.1 |
| vohotv/ / Guestofy – Restaurant Reservations Plugin, Room Planer, Reservation Form | affected 0 |
| ahmed17 / CF7 Constant Contact Fields Mapping | affected 0 |
| stellarwp / Bookit — Booking & Appointment Calendar | affected 0 before 2.2.9 |
| ethereumicoio / EthereumICO | affected 0 before 2.3.11 |
| risetheme / RT Easy Builder – Advanced addons for Elementor | affected 0 through 1.4 |
| saadiqbal / WP Contact Slider – Contact Form Slider Widget | affected 0 before 2.4.5 |
| ivan_paulin / Country Based Payments for WooCommerce | affected 0 before 1.4.1 |
| wpchill / Filr – Secure document library | affected 0 before 1.2.1 |
| nicheaddons / Elasta | affected 0 before 1.0.8 |
| interactivegeomaps / MapGeo – Interactive Geo Maps | affected 0 before 1.5.4 |
| galoover / WordPress Animation Plugin – Animated Everything | affected 0 |
| wpdever / WP Notification Bell | affected 0 before 1.3.13 |
| melapress / Activity Log For MainWP | affected 0 before 1.7.1 |
| oceas / Connected Sermons | affected 0 |
| josevega / Bulk Edit and Create User Profiles – WP Sheet Editor | affected 0 before 1.5.13 |
| milukove/ / Кнопка ЮMoney | affected 0 |
| kartikparmar/ / Bulk WooCommerce Category Creator | affected 0 |
| alphabposervice / Easy Math Captcha for CF7 | affected 0 |
| litonice13 / Master Accordion ( Former WP Awesome FAQ Plugin ) | affected 0 before 4.1.8 |
| wpdive / Better Addons for Elementor | affected 0 before 1.3.1 |
| livemesh / Livemesh Addons by Elementor | affected 0 before 7.1.4 |
| nitin247 / Place Order Without Payment for WooCommerce | affected 0 before 2.2 |
| boriscolombier/ / STEWoo – Super Transactional Emails for WooCommerce | affected 0 before 1.2.4 |
| marcqueralt / DeMomentSomTres Address | affected 0 |
| johnc1979 / Out of stock display for woocommerce | affected 0 |
| ultimateblocks / Ultimate Blocks – 25+ Gutenberg Blocks for Block Editor | affected 0 before 2.4.13 |
| pagup / Bulk Auto Image Title Attribute (Image Title tag) optimizer (Image SEO) | affected 0 before 1.2.3 |
| princeahmed / WP Radio – Worldwide Online Radio Stations Directory for WordPress | affected 0 before 3.1.4 |
| blackandwhitedigital / BookPress – For Book Authors | affected 0 before 1.2.3 |
| wpchill / Qyrr – simply and modern QR-Code creation | affected 0 before 0.8 |
| wpeka-club / WordPress Directory Plugin For Business Listings – WP Local Plus | affected 0 before 1.4.5 |
| equalizedigital / Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance | affected 0 before 1.2.8 |
| therealwebdisrupt / Funnelmentals | affected 0 |
CWE
CWE-862
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/39fb0499-9ab4-4a2f-b0db-ece86bcf4d42?source=cve
- https://wpscan.com/vulnerability/6dae6dca-7474-4008-9fe5-4c62b9f12d0a
- https://freemius.com/blog/managing-security-issues-open-source-freemius-sdk-security-disclosure/
- https://wpdirectory.net/search/01FWPVWA7BC5DYGZHNSZQ9QMN5
- https://wpdirectory.net/search/01G02RSGMFS1TPT63FS16RWEYR
- https://web.archive.org/web/20220225174410/https%3A//www.pluginvulnerabilities.com/2022/02/25/our-security-review-of-wordpress-plugin-found-freemius-library-still-contained-vulnerabilities-3-years-after-major-security-incident/
ADP enrichment
No English description supplied.
No references supplied.