Security Archives - Plugin Security Certification (PSC) by CleanTalk

Plugin Security Certification (PSC-2026-64643): “Bug reporting tool & Website feedback. Spotfix” – Version 1.0.4

Bug reporting tool & Website feedback – Spotfix (v1.0.4) is a lightweight WordPress plugin that enables users to submit contextual feedback directly on website pages. By allowing visitors to highlight specific elements and attach comments (“Spots”), the plugin transforms feedback into structured, actionable tasks.

Designed for websites running on WordPress, Spotfix integrates frontend interaction with backend task management via external services, enabling teams to track and resolve issues efficiently.

Because the plugin processes user-generated content, interacts with external APIs, and injects frontend JavaScript widgets, a comprehensive security audit was conducted.

CVE-2025-15370 – Shield Security – IDOR in MFA action mfa_profile_toggle_ga allows any authenticated user to disable Google Authenticator – POC

CVE-2025-15370 affects Shield Security and it is a privilege boundary failure that weakens authentication rather than changing content or reading data. The vulnerability allows any authenticated user, including a Subscriber, to target another account and toggle that account’s Google Authenticator setting through a request parameter. That matters because MFA is one of the most important compensating controls in WordPress. When a plugin that is meant to harden security can be used by low privilege users to disable MFA on administrators, it becomes a security downgrade primitive. The practical consequence is that attackers only need a second ingredient like a password leak or phishing success to turn this downgrade into a full admin takeover.

CVE-2026-4267 – Query Monitor – Unauth Reflected XSS – POC

CVE-2026-4267 affects Query Monitor and it is a reflected cross site scripting vulnerability that can be triggered by an unauthenticated attacker and executed in the browser of a logged in user who can view Query Monitor output. Query Monitor is often installed on development and staging sites, but it is also frequently left enabled on production environments during troubleshooting, which increases the chance that administrators will have it active while browsing the dashboard. The bug is dangerous because it sits inside a diagnostic panel that administrators trust. Once script execution is achieved in an admin session, the attacker can move from a simple reflected injection to nonce theft and privileged state changing actions in the WordPress backend.

CVE-2026-1710 – WooPayments – Unauthenticated Checkout UI Cache Poisoning/DOS via Public save_upe_appearance AJAX Endpoint – POC

CVE-2026-1710 affects WooPayments and it is an unauthenticated cache poisoning and denial of service vulnerability that targets the checkout payment UI rather than the WordPress admin. The core issue is that a public AJAX endpoint allows any visitor to submit attacker controlled Stripe Elements appearance configuration, and the plugin stores that data in globally shared transients that are later consumed by all shoppers. This transforms a single anonymous request into site wide persistent checkout manipulation that can last for up to a day. On stores where card payments are a primary revenue path, disrupting the payment form is operationally severe because it blocks checkout completion for real customers while looking like a normal front end glitch.

CVE-2026-3098 – Smart Slider 3 – LFI (Subscriber+) – POC

CVE-2026-3098 affects Smart Slider 3 and it enables an authenticated low privilege user to turn normal slider and image management flows into an arbitrary local file read. The practical impact is not limited to viewing a file inside the WordPress UI. The vulnerability chain can package the contents of server files into an exported Smart Slider archive, which the attacker can then download and inspect offline. This is dangerous because the exported artifact becomes a clean exfiltration channel for configuration files, credentials, and application secrets that should never leave the server. With an install base around 800k plus, this is a realistic risk for many sites where Subscriber accounts exist through registration, memberships, or WooCommerce, and where plugin permissions are often assumed to be safe by default.

Plugin Security Certification (PSC-2026-64642): “MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor” – Version 4.1.3

MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor (v4.1.3) is a powerful drag-and-drop form builder plugin designed to extend Elementor with advanced form creation capabilities. It allows users to build complex forms such as contact forms, surveys, booking forms, payment forms, and more without writing code.

Built for websites running on WordPress, MetForm integrates deeply into both frontend and backend workflows, handling user input, data storage, AJAX submissions, file uploads, and third-party integrations.

With over 600,000+ active installations, the plugin operates in a highly sensitive layer of application logic, making security a critical factor. A comprehensive source-code audit was conducted to evaluate its safety.

Plugin Security Certification (PSC-2026-64641): “Speed Optimizer” – Version 7.7.7

Performance and caching plugins are security-relevant because they introduce high-impact configuration inside wp-admin and can directly affect availability and content delivery behavior. If access control, request integrity, or output handling is weak, attackers may force cache purges or mode changes via CSRF, expose sensitive diagnostics, or manipulate settings that change how pages and assets are cached and served. Speed Optimizer – The All-In-One Performance-Boosting Plugin version 7.7.7 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64641, confirming that the plugin was reviewed from a secure code perspective with attention to the most common exploitation paths for performance management and caching tooling.

Plugin Security Certification (PSC-2026-64640): “Modula Image Gallery” – Version 2.14.22

Gallery plugins are security-relevant because they render user-controlled presentation data (titles, captions, alt text, links) across public pages and often provide rich admin-side builders and lightbox features. If output handling, access control, or request integrity is weak, attackers can target stored XSS through captions or settings, force configuration changes via CSRF, or expose media metadata through misprotected endpoints. Modula Image Gallery – Photo Grid & Video Gallery version 2.14.22 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64640, confirming that the plugin was reviewed from a secure code perspective with attention to the most common exploitation paths for media gallery and front-end rendering plugins.

Plugin Security Certification (PSC-2026-64639): “Simple Author Box” – Version 2.59

Author box plugins are security-relevant because they render user-controlled profile data across the site, often including author bio text, website links, and social profiles. If output encoding, access control, or request integrity is weak, these surfaces can become a path to stored XSS, unauthorized profile metadata exposure, or CSRF-driven settings changes. Simple Author Box version 2.59 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64639, confirming that the plugin was reviewed from a secure code perspective with attention to the most common exploitation paths for author profile and bio display plugins.

Plugin Security Certification (PSC-2026-64638): “Filester” – Version 2.0.2

File manager plugins are security-relevant by design because they provide direct filesystem access from wp-admin, including upload, download, edit, delete, and archive operations that normally require FTP or hosting panel access. If access control, request integrity, or path handling is weak, these features can become a shortcut to data exposure, site defacement, or availability impact. File Manager Pro – Filester version 2.0.2 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64638, confirming that the plugin was reviewed from a secure code perspective with attention to the most common exploitation paths for WordPress file management tools.

« Previous