WordPress Trademark Applications Rejected By USPTO via @sejournal, @martinibuster

The United States Patent and Trademark Office has rejected the WordPress Foundation’s applications for trademarks on the phrases “Managed WordPress” and “Hosted WordPress.” But WordPress isn’t walking away just yet.

The Trademark Office published the following notice for the “Hosted WordPress” trademark application:

“A final Office action refusing registration has been sent (issued) because the applicant neither satisfied nor overcame all requirements and/or refusals previously raised….

SUMMARY OF ISSUES MADE FINAL that applicant must address:

• Disclaimer Requirement

• Identification of Goods and Services

• Applicant Domicile Requirement

DISCLAIMER REQUIREMENT Applicant must disclaim the wording ‘MANAGED’ because it is merely descriptive of an ingredient, quality, characteristic, function, feature, purpose, or use of applicant’s goods and services….

Applicant may respond by submitting a disclaimer in the following format: No claim is made to the exclusive right to use ‘MANAGED’ apart from the mark as shown.”

Screenshot of Document Close-Up

The USPTO also found that the WordPress Foundation’s description of goods and services is too vague and overly broad, especially regarding the phrase “website development software,” and asks them to clarify whether it is downloadable (Class 9) or offered as online services (Class 42). The USPTO suggested acceptable wording that they can adopt, as long as it accurately reflects what they provide.

The Trademark Office also issued the following response for the trademark application for Managed WordPress:

“DISCLAIMER REQUIREMENT
Applicant must disclaim the wording ‘MANAGED’ because it is merely descriptive of an ingredient, quality, characteristic, function, feature, purpose, or use of applicant’s goods and services…. Applicant may respond by submitting a disclaimer in the following format:

No claim is made to the exclusive right to use ‘MANAGED’ apart from the mark as shown.”

The Process Is Not Over

The WordPress Foundation is continuing its efforts to obtain trademarks for both “Managed WordPress” and “Hosted WordPress.” It has filed a Request for Reconsideration after Final Action for each trademark application, which asks the USPTO to reconsider its refusals based on amendments, arguments, or evidence. These requests are a final procedural step before an appeal, although they are not themselves appeals.

Common Hosting Defenses Ineffective Against WordPress Threats via @sejournal, @martinibuster

Patchstack published a case study that examined how well Cloudflare and other general firewall and malware solutions protected WordPress websites from common vulnerability threats and attack vectors. The research showed that while general solutions stopped threats like SQL injection or cross-site scripting, a dedicated WordPress security solution consistently stopped WordPress-specific exploits at a significantly higher rate.

WordPress Vulnerabilities

Due to the popularity of the WordPress platform, WordPress plugins and themes are a common focus for hackers, and vulnerabilities can quickly be exploited in the wild. Once proof-of-concept code is public, attackers often act within hours, leaving website owners little time to react.

This is why it is critical to be aware of the security provided by a web host and of how effective those solutions are in a WordPress environment.

Methodology

Patchstack explained their methodology:

“As a baseline, we have decided to host “honeypot” sites (sites against which we will perform controlled pentesting with a set of 11 WordPress-specific vulnerabilities) with 5 distinct hosting providers, some of which have ingrained features presuming to help with blocking WordPress vulnerabilities and/or overall security.

In addition to the hosting provider’s security measures and third-party providers for additional measures like robust WAFs or other patching providers, we have also installed Patchstack on every site, with our test question being:

• How many of these threats will bypass firewalls and other patching providers to ultimately reach Patchstack?
• And will Patchstack be able to block them all successfully?”

Testing process

Each website was set up the same way, with identical plugins, versions, and settings. Patchstack used a “exploitation testing toolkit” to run the same exploit tests in the same order on every site. Results were checked automatically and by hand to see if attacks were stopped, and whether the block came from the host’s defenses or from Patchstack.

General Overview: Hosting Providers Versus Vulnerabilities

The Patchstack case study tested five different configurations of security defenses, plus Patchstack.

1. Hosting Provider A Plus Cloudflare WAF

2. Hosting Provider B + Firewall + Monarx Server and Website Security

3. Hosting Provider C + Firewall + Imunify Web Server Security

4. Hosting Provider D + ConfigServer Firewall

5. Hosting Provider E + Firewall

The result of the testing showed that the various hosting infrastructure defenses failed to protect the majority of WordPress-specific threats, catching only 12.2% of the exploits. Patchstack caught 100% of all exploits.

Patchstack shared:

“2 out of the 5 hosts and their solutions failed to block any vulnerabilities at the network and server levels.

1 host blocked 1 vulnerability out of 11.

1 host blocked 2 vulnerabilities out of 11.

1 host blocked 4 vulnerabilities out of 11.”

Cloudflare And Other Solutions Failed

Solutions like Cloudflare WAF or bundled services such as Monarx or Imunify failed to consistently address WordPress specific vulnerabilities.

Cloudflare’s WAF stopped 4 of 11 exploits, Monarx blocked none, and Imunify did not prevent any WordPress-specific exploits. Firewalls such as ConfigServer, which are widely used in shared hosting environments, also failed every test.

These results show that while those kinds of products work reasonably well against broad attack types, they are not tuned to the specific security issues common to WordPress plugins and themes.

Patchstack is created to specifically stop WordPress plugin and theme vulnerabilities in real time. Instead of relying on static signatures or generic rules, it applies targeted mitigation through virtual patches as soon as vulnerabilities are disclosed, before attackers can act.

Virtual patches are mitigation for a specific WordPress vulnerability. This offers protection to users while a plugin or theme developer can create a patch for the flaw. This approach addresses WordPress flaws in a way hosting companies and generic tools can’t because they rarely match generic attack patterns, so they slip past traditional defenses and expose publishers to privilege escalation, authentication bypasses, and site takeovers.

Takeaways

• Standard hosting defenses fail against most WordPress plugin vulnerabilities (87.8% bypass rate).
• Many providers claiming “virtual patching” (like Monarx and Imunify) did not stop WordPress-specific exploits.
• Generic firewalls and WAFs caught some broad attacks (SQLi, XSS) but not WordPress-specific flaws tied to plugins and themes.
• Patchstack consistently blocked vulnerabilities in real time, filling the gap left by network and server defenses.
• WordPress’s plugin-heavy ecosystem makes it an especially attractive target for attackers, making effective vulnerability protection essential.

The case study by Patchstack shows that traditional hosting defenses and generic “virtual patching” solutions leave WordPress sites vulnerable, with nearly 88% of attacks bypassing firewalls and server-layer protections.

While providers like Cloudflare blocked some broad exploits, plugin-specific threats such as privilege escalation and authentication bypasses slipped through.

Patchstack was the only solution to consistently block these attacks in real time, giving site owners a dependable way to protect WordPress sites against the types of vulnerabilities that are most often targeted by attackers.

According to Patchstack:

“Don’t rely on generic defenses for WordPress. Patchstack is built to detect and block these threats in real-time, applying mitigation rules before attackers can exploit them.”

Read the results of the case study by Patchstack here.

Featured Image by Shutterstock/tavizta

Inspiro WordPress Theme Vulnerability Affects Over 70,000 Sites via @sejournal, @martinibuster

A vulnerability advisory was published for the Inspiro WordPress theme by WPZoom. The vulnerability arises due to a missing or incorrect security validation that enables an unauthenticated attacker to launch a Cross-Site Request Forgery (CSRF) attack.

Cross-Site Request Forgery (CSRF)

A CSRF vulnerability in the context of a WordPress site is an attack that relies on a user with admin privileges clicking a link, which in turn leverages that user’s credentials to execute a malicious action. The vulnerability has been assigned a CVSS threat rating of 8.1.

The advisory issued by Wordfence WordPress security company warned:

“This makes it possible for unauthenticated attackers to install plugins from the repository via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.”

The vulnerability affects Inspiro theme versions up to and including 2.1.2. Users are advised to update their theme to the latest version.

Featured Image by Shutterstock/Kazantseva Olga

WordPress Contact Form 7 Redirection Plugin Vulnerability Hits 300k Sites via @sejournal, @martinibuster

A vulnerability advisory was issued for a WordPress Contact Form 7 add-on plugin that enables unauthenticated attackers to “easily” launch a remote code execution. The vulnerability is rated high (8.8/10) on the CVSS threat severity scale.

Screenshot from Wordfence advisory showing 8.8 CVSS severity rating

Redirection for Contact Form 7 plugin

The vulnerability affects the Redirection for Contact Form 7 WordPress plugin, which is installed on over 300,000 websites. The plugin extends the functionality of the popular Contact Form 7 plugin. It enables a website publisher not only to redirect a user to another page but also to store the information in a database, send email notifications, and block spammy form submissions.

The vulnerability arises in a plugin function. WordPress functions are PHP code snippets that provide specific functionalities. The specific function that contains the flaw is called the delete_associated_files function. That function contains an insufficient file path validation flaw, which means it does not validate what a user can input into the function that deletes files. This flaw enables an attacker to specify a path to a file to be deleted.

Thus, an attacker can specify a path (such as ../../wp-config.php) and delete a critical file like wp-config.php, clearing the way for a remote code execution (RCE) attack. An RCE attack is a type of exploit that enables an attacker to execute malicious code remotely (from anywhere on the Internet) and gain control of the website.

The Wordfence advisory explains:

“This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).”

The vulnerability affects all versions of the plugin up to and including version 3.2.4. Users of the affected plugin are advised to update the plugin to the latest version.

Featured Image by Shutterstock/Everyonephoto Studio

Critical Vulnerability Affects Tutor LMS Pro WordPress Plugin via @sejournal, @martinibuster

An advisory was issued about a critical vulnerability in the popular Tutor LMS Pro WordPress plugin. The vulnerability, rated 8.8 on a scale of 1 to 10, allows an authenticated attacker to extract sensitive information from the WordPress database. The vulnerability affects all versions up to and including 3.7.0.

Tutor LMS Pro Vulnerability

The vulnerability results from improper handling of user-supplied data, enabling attackers to inject SQL code into a database query. The Wordfence advisory explains:

“The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter used in the get_submitted_assignments() function in all versions up to, and including, 3.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. “

Time-Based SQL Injection

A time-based SQL injection attack is one in which an attacker determines whether a query is valid by measuring how long the database takes to respond. An attacker could use the vulnerable order parameter to insert SQL code that delays the database’s response. By timing these delays, the attacker can deduce information stored in the database.

Why This Vulnerability Is Dangerous

While exploitation requires authenticated access, a successful exploitation of the flaw could be used to access sensitive information. Updating to the latest version, 3.7.1 or higher is recommended.

Featured Image by Shutterstock/Ollyy

Vulnerability In 3 WordPress File Plugins Affects 1.3 Million Sites via @sejournal, @martinibuster

An advisory was issued for three WordPress file management plugins that are affected by a vulnerability that allows unauthenticated attackers delete arbitrary files. The three plugins are installed in over 1.3 million websites.

Outdated Version Of elFinder

The vulnerability is caused by outdated versions of the elFinder file manager, specifically versions 2.1.64 and earlier. These versions contain a Directory Traversal vulnerability that allows attackers to manipulate file paths to reach outside the intended directory. By sending requests with sequences such as example.com/../../../../, an attacker could make the file manager access and delete arbitrary files.

Affected Plugins

Wordfence named the following three plugins as affected by this vulnerability:

1. File Manager WordPress Plugin
Installations: 1 Million

2. Advanced File Manager – Ultimate WP File Manager And Document Library Solution
Installations: 200,000+

3. File Manager Pro – Filester
Installations: 100,000+

According to the Wordfence advisory, the vulnerability can be exploited without authentication, but only if a site owner has made the file manager publicly accessible, which mitigates the possibility of exploitation. That said, two of the plugins indicated in their changelogs that an attacker needs at least a subscriber level authentication, the lowest level of website credentials.

Once exploited, the flaw allowed deletion of arbitrary files. Users of the named WordPress plugins should consider updating to the latest versions.

Featured Image by Shutterstock/Lili1992

WordPress Contact Form Entries Plugin Vulnerability Affects 70K Websites via @sejournal, @martinibuster

A vulnerability advisory was issued for a WordPress plugin that saves contact form submissions. The flaw enables unauthenticated attackers to delete files, launch a denial of service attack, or perform remote code execution. The vulnerability was given a severity rating of 9.8 on a scale of 1 to 10, indicating the seriousness of the issue.

Database for Contact Form 7, WPForms, Elementor Forms Plugin

The Database for Contact Form 7, WPForms, Elementor Forms, also apparently known as the Contact Form Entries Plugin, saves contact form entries into the WordPress database. It enables users to view contact form submissions, search them, mark them as read or unread, export them, and perform other functions. The plugin has over 70,000 installations.

The plugin is vulnerable to PHP Object Injection by an unauthenticated attacker, which means that an attacker does not need to log in to the website to launch the attack.

A PHP object is a data structure in PHP. PHP objects can be turned into a sequence of characters (serialized) in order to store them and then deserialized (turned back into an object). The flaw that gives rise to this vulnerability is that the plugin allows an unauthenticated attacker to inject an untrusted PHP object.

If the WordPress site also has the Contact Form 7 plugin installed, then it can trigger a POP chain during deserialization.

According to the Wordfence advisory:

“This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in the Contact Form 7 plugin, which is likely to be used alongside, allows attackers to delete arbitrary files, leading to a denial of service or remote code execution when the wp-config.php file is deleted.”

All versions of the plugin up to and including 1.4.3 are vulnerable. Users are advised to update their plugin to the latest version, which as of this date is version 1.4.5.

Featured Image by Shutterstock/tavizta