Vulnerability found in version <=2.2.7 | WordPress.org

Resolved Jos Klever
(@josklever)

1 week, 3 days ago

I’ve received a report from Wordfence Security, that there is a vulnerability in versions <= 2.2.7

Are you aware and working on a fix?

Information: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/donation-thermometer/donation-thermometer-227-missing-authorization

Viewing 6 replies - 1 through 6 (of 6 total)

johnclearmoonstudio
(@johnclearmoonstudio)

1 week, 3 days ago

Also wondering if a fix to this vulnerability is coming? Also see it reported here:

https://patchstack.com/database/wordpress/plugin/donation-thermometer/vulnerability/wordpress-donation-thermometer-plugin-2-2-7-broken-access-control-vulnerability

Plugin Author rhewlif
(@henryp)

1 week, 3 days ago

Ok, thanks for the notification. Patching is underway and the plugin will be updated shortly.

Plugin Author rhewlif
(@henryp)

1 week ago

Version 2.2.8 now addresses this issue. It looks like WordPress.org will release the update to sites in about 22 hours.

Thread Starter Jos Klever
(@josklever)

1 week ago

@henryp Thanks! You can email plugins@wordpress.org to tell that this is a security update and bypass the 24 hour delay.

Plugin Author rhewlif
(@henryp)

6 days, 12 hours ago

@josklever Ok, looks like it’s released now.

Thread Starter Jos Klever
(@josklever)

6 days, 12 hours ago

Thanks, I’ve installed the update.

Viewing 6 replies - 1 through 6 (of 6 total)

You must be logged in to reply to this topic.

7 replies
3 participants
Last reply from: Jos Klever
Last activity: 6 days, 12 hours ago
Status: resolved