WordPress: Dangerous security hole in Gutenberg template plugin
The Wordfence security scanner warns of a security gap in the WordPress plugin Gutenberg Template Library & Redux Framework. (Photo: Shutterstock / monticello)
More than a million WordPress sites use the “Gutenberg Template Library & Redux Framework” plugin – but this can provide loopholes for attacks.
The WordPress plugin “Gutenberg Template Library & Redux Framework” offers the possibility to manage and use variously designed templates for WordPress. According to the official website of the manufacturer redux.io, the plugin has over a million active installations.
Contents
Gutenberg Template Library & Redux Framework: Wordfence has discovered 2 vulnerabilities
In the Gutenberg template version 4.2.11 and its predecessor variants, the team of the Wordfence security plugin recently discovered two problematic areas: The first security gap identified (CVE-2021-38312, CSS score 7.1), for example, could cause registered authors and Authors can install and activate any new plugins via the WordPress Rest API – although they are actually not authorized to do so. Software with malicious code could also be uploaded. In addition, the relevant users would have the option of deleting postings and pages.
The second vulnerability (CVE-2021-38314, CSS score 5.3) allows attackers to access sensitive configuration information from websites.
Gaps in WordPress Plugin: Here’s How to Fix the Problem
On the Wordfence blog, the team that has now resolved the problems in cooperation with the responsible persons at redux.io, in detail on the two gaps and their causes. Wordfence Premium users as well as users of the free version are now protected. Anyone who uses the “Gutenberg Template Library & Redux Framework” on their website should ensure that they are working with the latest version (4.2.14).
