Description
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dashlabsltd | YASR – Yet Another Star Rating Plugin for WordPress | < 2.0.2 | 2.0.2 |
| nicheaddons | Events Addon for Elementor | < 1.9.8 | 1.9.8 |
| dots | Fraud Prevention For WooCommerce and EDD | < 2.1.0 | 2.1.0 |
| wpengine | Gutenberg Blocks – ACF Blocks Suite | < 2.6.8 | 2.6.8 |
| bouncingsprout | Ultimeter | < 2.7.6 | 2.7.6 |
| toddhalfpenny | Past Events Extension | — | — |
| pootlepress | Pootle Pagebuilder – WordPress Page builder | < 5.7.1 | 5.7.1 |
| powerfulwp | Local Delivery Drivers for WooCommerce | < 1.8.5 | 1.8.5 |
| kkikuchi1220 | Ultimate Gutenberg – Custom Block Templates | — | — |
| josevega | WP Required Taxonomies – Categories and Tags Mandatory | < 1.1.8 | 1.1.8 |
| pmbaldha | Featured Products First for WooCommerce – A Extension of WooCommerce (WooCommerce Addon Plugin) | — | — |
| sslzen | SSL Zen — SSL Certificate Installer & HTTPS Redirects | ≤ 4.0.4 | — |
| wisersteps | Streak CRM For Gmail For Contact Form 7 – WordPress Plugin | < 1.0.9 | 1.0.9 |
| wpdevpowers | WordPress Dev Powers – ACF Color Coded Field Types Plugin | — | — |
| benmoreassynt | DancePress (TRWA) | ≤ 3.1.2 | — |
| dots | Product Size Charts Plugin for WooCommerce | < 2.2.3 | 2.2.3 |
| tribalnerd | Wp My Admin Bar | — | — |
| setka | A no-code page builder for beautiful performance-based content | < 2.1.17 | 2.1.17 |
| mikebels | LocalSEOMap | — | — |
| cromer12 | Easy Prayer | — | — |
| rafalosinski | AdFoxly – Ad Manager, AdSense Ads & Ads.txt | ≤ 1.8.4 | — |
| stevehenty | WP Get Personal | — | — |
| theafricanboss/ | Checkout with Cash App on EDD | — | — |
| usmanaliqureshi | Server Info | — | — |
| themelocation | Custom WooCommerce Checkout Fields Editor | ≤ 1.2.6 | — |
| krsp | KRSP Frontend File Uploader | — | — |
| bplugins | Panorama – 360 Virtual Tour, Panoramic image viewer and More | < 1.0.8 | 1.0.8 |
| janwyl | Bulk Attachment Download | < 1.3.5 | 1.3.5 |
| majick | AutoSave Net | — | — |
| premmerce | Premmerce Wholesale Pricing for WooCommerce | < 1.1.8 | 1.1.8 |
| jcodex | Any Popup – Popup Forms, Optins & Ads | — | — |
| theafricanboss/ | Checkout with Venmo on EDD | — | — |
| dreamfox | Payment Gateway Per Product for WooCommerce | < 3.1.6 | 3.1.6 |
| hqtheme | HQTheme Extra | — | — |
| vincoit | Vit Website Reviews | — | — |
| daigo75 | EU VAT Assistant for WooCommerce | < 2.0.28.220224 | 2.0.28.220224 |
| eedee | WordPress Slider Block Gutenslider | < 5.7.0 | 5.7.0 |
| surbma | HuCommerce | Magyar kiegészítések WooCommerce webáruházakhoz | < 30.3.0 | 30.3.0 |
| lostboy7 | KVoucher | — | — |
| bplugins | YT Player – Embed and Customize Video Players | < 1.5.1 | 1.5.1 |
| whiteshadow | Error Log Monitor | < 1.7.1 | 1.7.1 |
| slidedeck | SlideDeck: Responsive WordPress Slider Plugin | — | — |
| premmerce | Premmerce Multi-currency for Woocommerce | < 2.3.2 | 2.3.2 |
| mvvapps/ | Booking Addon for WooCommerce | < 4.2.0 | 4.2.0 |
| wpeventpartners/ | WP Event Partners – WordPress Plugin for Event and Conference Management | ≤ 1.2.4 | — |
| saadiqbal | WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce | < 4.2.1 | 4.2.1 |
| passionatebrains | AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization | < 2.6 | 2.6 |
| majick | ForceField | — | — |
| richard-b | FIT: Featured Image Toolkit | — | — |
| themekraft | All in One Invite Codes | < 1.0.13 | 1.0.13 |
| dots | Dynamic Pricing and Discount Rules for WooCommerce | < 2.2.3 | 2.2.3 |
| wordplus | Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages | < 1.9.9.170 | 1.9.9.170 |
| wpt00ls | Grid & Styler For Contact Form 7 And Divi | < 1.4.1 | 1.4.1 |
| protectyouruploads | Protect Uploads with Login – Protect Your Uploads | — | — |
| sakurapixel | Atlas – Knowledge Base | — | — |
| dgwyer | Simple Sitemap – Create a Responsive HTML Sitemap | < 3.5.5 | 3.5.5 |
| bplugins | Super Video player – Fully Customizable Video Player with Playlist | < 1.6.11 | 1.6.11 |
| mhmrajib | WP Books Gallery – Build Stunning Book Showcases & Libraries in Minutes | < 3.6 | 3.6 |
| damian-gora | FiboSearch – Ajax Search for WooCommerce | < 1.17.0 | 1.17.0 |
| stevejburge | Tag Groups is the Advanced Way to Display Your Taxonomy Terms | < 1.43.10.1 | 1.43.10.1 |
| prasadkirpekar | WP Free SSL | < 1.2.7 | 1.2.7 |
| clickervolt | ClickerVolt – Affiliate Links & Click Tracking for Performance Marketers | — | — |
| proteusthemes | ConsultPress Lite | — | — |
| badhonrocks | Styler Mate for Contact Form 7 | < 1.3.0 | 1.3.0 |
| streamweasels | StreamWeasels Twitch Integration | < 1.3.4 | 1.3.4 |
| pagup | MOBILOOK — Mobile View & Mobile‑Friendly Test | < 1.2.4 | 1.2.4 |
| paulio21 | Zip Code Redirect | ≤ 4.0.1 | — |
| vohotv/ | Guestofy – Restaurant Reservations Plugin, Room Planer, Reservation Form | — | — |
| ahmed17 | CF7 Constant Contact Fields Mapping | — | — |
| stellarwp | Bookit — Booking & Appointment Calendar | < 2.2.9 | 2.2.9 |
| ethereumicoio | EthereumICO | < 2.3.11 | 2.3.11 |
| risetheme | RT Easy Builder – Advanced addons for Elementor | ≤ 1.4 | — |
| saadiqbal | WP Contact Slider – Contact Form Slider Widget | < 2.4.5 | 2.4.5 |
| ivan_paulin | Country Based Payments for WooCommerce | < 1.4.1 | 1.4.1 |
| wpchill | Filr – Secure document library | < 1.2.1 | 1.2.1 |
| nicheaddons | Elasta | < 1.0.8 | 1.0.8 |
| interactivegeomaps | MapGeo – Interactive Geo Maps | < 1.5.4 | 1.5.4 |
| galoover | WordPress Animation Plugin – Animated Everything | — | — |
| wpdever | WP Notification Bell | < 1.3.13 | 1.3.13 |
| melapress | Activity Log For MainWP | < 1.7.1 | 1.7.1 |
| oceas | Connected Sermons | — | — |
| josevega | Bulk Edit and Create User Profiles – WP Sheet Editor | < 1.5.13 | 1.5.13 |
| milukove/ | Кнопка ЮMoney | — | — |
| kartikparmar/ | Bulk WooCommerce Category Creator | — | — |
| alphabposervice | Easy Math Captcha for CF7 | — | — |
| litonice13 | Master Accordion ( Former WP Awesome FAQ Plugin ) | < 4.1.8 | 4.1.8 |
| wpdive | Better Addons for Elementor | < 1.3.1 | 1.3.1 |
| livemesh | Livemesh Addons by Elementor | < 7.1.4 | 7.1.4 |
| nitin247 | Place Order Without Payment for WooCommerce | < 2.2 | 2.2 |
| boriscolombier/ | STEWoo – Super Transactional Emails for WooCommerce | < 1.2.4 | 1.2.4 |
| marcqueralt | DeMomentSomTres Address | — | — |
| johnc1979 | Out of stock display for woocommerce | — | — |
| ultimateblocks | Ultimate Blocks – 25+ Gutenberg Blocks for Block Editor | < 2.4.13 | 2.4.13 |
| pagup | Bulk Auto Image Title Attribute (Image Title tag) optimizer (Image SEO) | < 1.2.3 | 1.2.3 |
| princeahmed | WP Radio – Worldwide Online Radio Stations Directory for WordPress | < 3.1.4 | 3.1.4 |
| blackandwhitedigital | BookPress – For Book Authors | < 1.2.3 | 1.2.3 |
| wpchill | Qyrr – simply and modern QR-Code creation | < 0.8 | 0.8 |
| wpeka-club | WordPress Directory Plugin For Business Listings – WP Local Plus | < 1.4.5 | 1.4.5 |
| equalizedigital | Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance | < 1.2.8 | 1.2.8 |
| therealwebdisrupt | Funnelmentals | — | — |
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/39fb0499-9ab4-4a2f-b0db-ece86bcf4d42?source=cve
- https://wpscan.com/vulnerability/6dae6dca-7474-4008-9fe5-4c62b9f12d0a
- https://freemius.com/blog/managing-security-issues-open-source-freemius-sdk-security-disclosure/
- https://wpdirectory.net/search/01FWPVWA7BC5DYGZHNSZQ9QMN5
- https://wpdirectory.net/search/01G02RSGMFS1TPT63FS16RWEYR
- https://web.archive.org/web/20220225174410/https%3A//www.pluginvulnerabilities.com/2022/02/25/our-security-review-of-wordpress-plugin-found-freemius-library-still-contained-vulnerabilities-3-years-after-major-security-incident/