Critical Vulnerability – arbitrary file upload

Viewing 6 replies - 1 through 6 (of 6 total)

  • As of Dec 4, 2023, my site still shows 1.0.8 as the latest version and WordFence still shows this critical security threat as not yet fixed. Until it is, I’ve uninstalled the plugin.

    ptday64

    (@ptday64)

    This critical vulnerability has me worried. It keeps coming up in my Wordfence scans. I’m thinking about deactivating and deleting this plugin for now (at least until it’s patched). Question (and I feel stupid for asking): If I delete this plugin, will it affect the child theme that I currently have enabled on my website? I feel like once the child theme is created and active it’s no longer tied to the plugin but I’m not 100% sure. Ugh.. any thoughts on that?

    Thanks!!

    Thread Starter freshpromo

    (@freshpromo)

    @ptday64 and @neville The change log states that the latest update 1.0.9 has fixed the issue.

    Wow, I was about to use this plugin, thanks guys for posting this, it seems plugin developer is not responsive to this issue and at minimum has not come into the thread with feedback to mitigate the concern, that is a red flag for me.

    Plugin Author WEN Solutions

    (@wen-solutions)

    Hello everyone,

    We apologize for the delay in responding and any inconvenience this may have caused. The critical vulnerability that allows arbitrary file uploads in the WP Child Theme Generator plugin has been fixed in the latest version. We encourage all users to update to this version to secure their sites.

    Thank you for your understanding, and we appreciate your patience.

Viewing 6 replies - 1 through 6 (of 6 total)
  • You must be logged in to reply to this topic.