The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is…
| Vendor | Product | Versions |
|---|---|---|
| paretodigital | YASR | Yet Another Star Rating Plugin for WordPress — * |
| nicheaddons | Events Addon for Elementor | * |
| dots | Fraud Prevention For WooCommerce and EDD | * |
| wpengine | Gutenberg Blocks | ACF Blocks Suite — * |
| bouncingsprout | Ultimeter | * |
| toddhalfpenny | Past Events Extension | * |
| pootlepress | Pootle Pagebuilder | WordPress Page builder — * |
| powerfulwp | Local Delivery Drivers for WooCommerce | * |
| kkikuchi1220 | Ultimate Gutenberg | Custom Block Templates — * |
| josevega | WP Required Taxonomies | Categories and Tags Mandatory — * |
| pmbaldha | Featured Products First for WooCommerce | A Extension of WooCommerce (WooCommerce Addon Plugin) — * |
| sslzen | SSL Certificate | Free SSL, HTTPS by SSL Zen — * |
| wisersteps | Streak CRM For Gmail For Contact Form 7 | WordPress Plugin — * |
| wpdevpowers | WordPress Dev Powers | ACF Color Coded Field Types Plugin — * |
| benmoreassynt | DancePress (TRWA) | * |
| dots | Product Size Charts Plugin for WooCommerce | * |
| tribalnerd | Wp My Admin Bar | * |
| setka | A no | code page builder for beautiful performance-based content — * |
| mikebels | LocalSEOMap | * |
| cromer12 | Easy Prayer | * |
| rafalosinski | AdFoxly | Ad Manager, AdSense Ads & Ads.txt — * |
| stevehenty | WP Get Personal | * |
| theafricanboss | / Checkout with Cash App on EDD | * |
| usmanaliqureshi | Server Info | * |
| themelocation | Custom WooCommerce Checkout Fields Editor | * |
| krsp | KRSP Frontend File Uploader | * |
| bplugins | Panorama Viewer | Best Plugin to Display Panoramic Images/Videos — * |
| janwyl | Bulk Attachment Download | * |
| majick | AutoSave Net | * |
| premmerce | Premmerce Wholesale Pricing for WooCommerce | * |
| jcodex | Any Popup | Popup Forms, Optins & Ads — * |
| theafricanboss | / Checkout with Venmo on EDD | * |
| dreamfox | Payment gateway per Product for WooCommerce | * |
| hqtheme | HQTheme Extra | * |
| vincoit | Vit Website Reviews | * |
| daigo75 | WooCommerce EU VAT Assistant | * |
| eedee | WordPress Slider Block Gutenslider | * |
| surbma | HuCommerce | Magyar WooCommerce kiegészítések | * |
| lostboy7 | KVoucher | * |
| bplugins | Video Player for YouTube | * |
| whiteshadow | Error Log Monitor | * |
| slidedeck | SlideDeck: Responsive WordPress Slider Plugin | * |
| premmerce | Premmerce Multi | currency for Woocommerce — * |
| mvvapps | / Booking Addon for WooCommerce | * |
| wpeventpartners | / WP Event Partners | WordPress Plugin for Event and Conference Management — * |
| wpexpertsio | WC Shop Sync | Square Payment Gateway for WooCommerce, Inventory Sync Between Square and WooCommerce, Ultimate WooCommerce Square Plugin — * |
| passionatebrains | Add Expires Headers & Optimized Minify | * |
| majick | ForceField | * |
| richard-b | FIT: Featured Image Toolkit | * |
| svenl77 | All in One Invite Codes | * |
Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.
For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.
Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.
No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.
No additional references available in the KB record.