Critical flaws in eight WordPress booking, checkout and CRM plugins. All have updates.

Bookings and appointments

• Amelia (90,000+ sites): two SQL injection flaws with no login needed, in versions up to 2.4.10 and up to 2.4.11. An attacker can read, change or delete the site’s database. Update to 2.4.12 or later. CVSS 9.3 each.
• LatePoint (100,000+ sites), up to 5.7.4: someone who knows a customer’s email address or phone number can beat the one-time sign-in code and log in as that customer. Update to 5.7.5. CVSS 9.1.

Checkout, CRM and automation

• SureCart (80,000+ sites), up to 4.9.5: an attacker can log in as other users without their password, no login needed. Update to 4.9.6 or later. CVSS 9.8.
• FluentCRM (80,000+ sites), up to 3.2.5: privilege escalation to administrator, full control of the site. Update to 3.2.6. CVSS 9.8.
• OttoKit, formerly SureTriggers (90,000+ sites), up to 1.1.40: privilege escalation to administrator. Update to 1.1.41 or later. CVSS 9.8.

Galleries, search and email lists

• The Grid, up to 2.8.1: no login needed to run any command on the server. Update to 2.8.2. CVSS 10.0. It isn’t listed on WordPress.org, so check its version on your Plugins page by hand.
• WP Mailster (300+ sites), up to 1.9.1.0: no login needed to upload malicious files and take over the server. Update to 1.9.2.0. CVSS 10.0.
• Ajax Search Lite (70,000+ sites), up to 4.14.6: SQL injection with no login needed. Update to 4.14.7. CVSS 9.3.

What to do

1. Check your Plugins pageIn WordPress, open Plugins and look for any name above. The version is under each plugin’s name.
2. Update, then confirmUpdate anything listed, then reload the Plugins page and check the version number actually changed. Take a backup first if your host doesn’t do it nightly.
3. Check for accounts you didn’t createFive of these let an attacker sign in as someone else or make themselves an administrator. Open Users and remove any administrator you don’t recognize.
4. Run our free checkOur plugin check tells you whether a plugin version has known flaws, and our website check reads the versions your pages show.

Scores are from the organizations that issued each CVE (Patchstack, and Wordfence for LatePoint); the National Vulnerability Database hasn’t scored them yet. Install counts are from WordPress.org.

Sources

• Patchstack: Amelia 2.4.10, SQL injection
• Patchstack: Amelia 2.4.11, SQL injection
• Wordfence: LatePoint 5.7.4, authentication bypass
• Patchstack: SureCart 4.9.5, broken authentication
• Patchstack: FluentCRM 3.2.5, privilege escalation
• Patchstack: OttoKit 1.1.40, privilege escalation
• Patchstack: The Grid 2.8.1, remote code execution
• Patchstack: WP Mailster 1.9.1.0, arbitrary file upload
• Patchstack: Ajax Search Lite 4.14.6, SQL injection