Protect Your Website: PTA Reports Severe Security Issues in WordPress Plugins

The PTA has released the Cyber Security Advisory No. 360, cautioning website managers about serious security risks concerning various WordPress plugins. The Advisory emphasizes four critical weaknesses that allow cyberattacks on websites and recommends a security update as soon as possible.

Affected WordPress Plugins

The advisory specifically identifies vulnerabilities in the following plugins:

• Advance Menu Manager (v3.1.1 and earlier)

• WooCommerce PDF Vouchers (versions below 4.9.9)

• WPLMS (versions earlier than 1.9.9.5.2)

These vulnerabilities can allow;

• Unauthorized access
• Privilege escalation
• Execution of malicious code puts websites at serious risk.

Identified Security Threats

1. CVE-2024-54381 (Advanced Menu Manager Plugin)

   • A Missing Authorization flaw that enables unauthorized users to access restricted functions.

2. CVE-2024-54383 (WooCommerce PDF Vouchers Plugin)

   • An Incorrect Privilege Assignment issue that allows lower-level users to gain higher permissions.

3. CVE-2024-56055 (WPLMS Plugin)

   • A Path Traversal vulnerability that lets attackers access restricted files.

4. CVE-2024-56051 (WPLMS Plugin)

   • An Improper Control of Code Generation flaw, which could allow attackers to inject and execute harmful code.

Urgent Security Measures