Serious CVE-vulnerabilities got patched in our new release, so your hosted websites will be secured against various plugin vulnerabilities after updating your BitNinja agent.

Patch Management updates

10 CVE-vulnerabilities were added to our data collection across various WordPress plugins. Let’s see them in detail:

1.
Vulnerability: CVE-2023-6985
Affected plugin: 10Web AI Assistant – AI content writing assistant plugin (all versions up to, and including 1.0.18)

Missing authorization makes attackers able to do unauthorised modification of data due to a missing capability check on the install_plugin AJAX action. Authenticated attackers this way get subscriber-level access and above, being able to gain further access to a site.

2.
Vulnerability: CVE-2024-0699
Affected plugin: The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! (all versions up to, and including 2.1.4)

This WordPress plugin is vulnerable to arbitrary file uploads due to missing file type validation in the 'add_image_from_url' function. Authenticated attackers with Editor access or above, can upload arbitrary files by exploiting this vulnerability which can lead to remote code execution.

3.
Vulnerability: CVE-2024-0668
Affected plugin: Advanced Database Cleaner for WordPress (all versions up to, and including 3.1.3)

This vulnerability is applicable for deserialization of untrusted data in the 'process_bulk_action' function, ending in PHP Object Injection. Authenticated attackers with admin access can inject PHP Object and in case a POP chain is present - not in the plugin but via an additional plugin or theme installed - hackers can delete arbitrary files, retrieve sensitive data, or execute code

4.
Vulnerability: CVE-2024-0428
Affected plugin: Index Now for WordPress (all versions up to, and including 2.6.3)

This Cross-Site Request Forgery (CSRF) vulnerability is due to missing or incorrect nonce validation on the 'reset_form' function. This way, even unauthenticated intruders can delete arbitrary site options with multiple steps.

5.
Vulnerability: CVE-2024-0761
Affected plugin: File Manager (all versions up to, and including 7.2.1)

The naming convention (timestamp + 4 random digits) can end up for unauthenticated users to access sensitive data, like site backups in configs where .htaccess file doesn’t block access.

6.
Vulnerability: CVE-2024-0842
Affected plugin: Backuply – Backup, Restore, Migrate and Clone (all versions up to, and including 1.2.5)

There’s an ongoing vulnerability for DoS attacks due to direct access of the backuply/restore_ins.php file. This allows attackers to overload the server resources via excessive requests. 

7.
Vulnerability: CVE-2024-1072
Affected plugin: Website Builder by SeedProd (in all versions up to, and including 6.15.21)

This WordPress plugin is vulnerable to unauthorised modification of data due to a missing authorization. Coming-soon, maintenance, 404 and login pages’ content can be modified due to this issue. 

8.
Vulnerability: CVE-2024-0685
Affected plugin: Ninja Forms Contact Form (all versions up to, and including 3.7.1)

This drag & drop form builder is vulnerable to SQL Injection via the email address value submitted through their forms. This can easily end up with a personal data breach.

9.
Vulnerability: CVE-2023-6875
Affected plugin: POST SMTP Mailer (all versions up to, and including 2.8.7)

There’s a type juggling issue going on on the connect-app REST endpoint resulting in unauthorised access of data or data modification.  This way, unauthenticated attackers can reset the API key authenticating to the mailer and view logs, including password reset emails, allowing site takeover.

10.
Vulnerability: CVE-2023-6933
Affected plugin: Better Search Replace (all versions up to, and including 1.4.4)

Thai WordPress plugin is vulnerable to PHP Object Injection. If a POP chain is present via an additional plugin or theme installed on the target system, hackers can delete arbitrary files, retrieve sensitive data, or execute code.

Changelog

MalwareDetection:

• Fixed an issue where 400 Bad Request errors could have been happened when hashes uploaded to the API.

Vulnerability Patcher:

• Added new patches to the data collections, against the following CVE vulnerabilities:
• CVE-2023-6985, CVE-2024-0699, CVE-2024-0668, CVE-2024-0428, CVE-2024-0761, CVE-2024-0842, CVE-2024-1072, CVE-2024-0685, CVE-2023-6875, CVE-2023-6933

Please update your agent version or if you have specific settings or applications preventing automatic updates, you can follow our documentation on how to proceed to have the latest version installed.

If you'd like to read more about previous releases, check the Changelog anytime.

Alternatively, if you would like to see your feature request show up here, don't forget to cast your vote.