We wanted to inform you right away about an important and urgent update we made to GiveWP in version 2.24.0. The details are below, but the short version is that you should update to the latest version as soon as possible.
Here are the details:
What was the Vulnerability?
GiveWP 2.23.2 and earlier contain an unauthorized SQL Injection vulnerability that is considered critical.
The vulnerability was immediately addressed and a patch has been included in the 2.24.0 release. Please update to the latest version to make sure the vulnerability is patched and cannot be exploited on your site.
How was the Vulnerability Discovered and Fixed?
The vulnerability was discovered by a reputable security researcher and responsibly disclosed through WPScan. We truly appreciate the effort for responsible disclosure from the WordPress community to keep WordPress site owners safe.
What does this Mean for Your Website?
As of the publication of this alert, there are no known instances of this vulnerability being exploited by malicious hackers. As such, there is no reason to worry about your site.
However, you should check your website for any anomalies. This includes but is not limited to:
- Check to see if there are any unexpected users or admin accounts on your website.
- Look at your site’s content to determine if any unexplained changes have been made.
- Use Sucuri’s free site check to look for any indicators of compromise.
- Use iThemes Security to monitor for any unexpected file changes.
- Monitor Google Search Console for any indicators of unwanted site changes or malicious content.
If you’re still concerned and wish to check your site further, consult an expert. But, as stated previously, there is no reason to suspect this vulnerability has been exploited at the time of publication.
How to Update to the latest GiveWP Version
GiveWP core is simple to update. It’s free for all users, so there is no need to check for licensing.
To update GiveWP and ensure you have the latest version:
- Log into your website admin area and navigate to “Updates.”
- Look for GiveWP and choose to update the plugin.
That’s it! Now your website is secure and the previous vulnerability in GiveWP is no longer there.
Stay Safe and Reach Out If You Have Questions
As always, the security of your website and data is our utmost priority. Stay safe out there, keep your sites backed-up and updated.
If you’re not already using a service like Cloudflare, consider registering.Their service protects against most bot attacks and their web application firewall (WAF) protects against SQL injection attack attempts as well as many other generic attempts to compromise unknown vulnerabilities.
If you have questions at all, feel free to reach out to us via our contact form. For more information on why your website might be hacked or hacking prevention, check out our advice from the blog.
Your success with online donations is always our number one priority!
About the Author
