Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update
Affected versions: [*, 1.9.3); *-1.0.1; *-0.1.9; *; *-1.0; *-1.0.0; [*, 1.1.4); *-1.0
Vulnerability type: CWE-862 Missing Authorization
Affected software, patched versions and attribution
The Freemius SDK for WordPress is vulnerable to authorization bypass due to a missing capability check on the _get_db_option and _set_db_option functions in versions up to, and including, 2.2.3. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change site settings and potentially take over the site.
Ultimeter
Affected versions: [*, 1.9.3)
Patched versions: 1.9.3
Past Events Extension
Affected versions: *-1.0.1
Patched versions: Not supplied
WordPress Cloaking – Show & Create Geo-Targeted Custom HTML Plugin – GeoRequest
Affected versions: *-0.1.9
Patched versions: Not supplied
Content Slider for WP Posts (Section Slider)
Affected versions: *
Patched versions: Not supplied
KRSP Frontend File Uploader
Affected versions: *-1.0
Patched versions: Not supplied
Online Booking for Barbershops and Salons
Affected versions: *-1.0.0
Patched versions: Not supplied
Premmerce Wholesale Pricing for WooCommerce
Affected versions: [*, 1.1.4)
Patched versions: 1.1.4
Any Popup – Popup Forms, Optins & Ads
Affected versions: *-1.0
Patched versions: Not supplied
enhanced-catalog-images-for-woocommerce
Affected versions: *-1.0.1
Patched versions: Not supplied
Error Log Monitor
Affected versions: [*, 1.6.5)
Patched versions: 1.6.5
FIT: Featured Image Toolkit
Affected versions: *-1.0.3
Patched versions: Not supplied
WP Advanced Comment
Affected versions: *-0.3
Patched versions: Not supplied
WP Private Media
Affected versions: *-1.0.1
Patched versions: Not supplied
Device Frame
Affected versions: *-1.0.0
Patched versions: Not supplied
ConsultPress Lite
Affected versions: *-1.2.3
Patched versions: Not supplied
WordPress Animation Plugin – Animated Everything
Affected versions: *-1.3.2
Patched versions: Not supplied
WooRocks Magic Content
Affected versions: *-1.0.17
Patched versions: Not supplied
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
Affected versions: [*, 1.8.3)
Patched versions: 1.8.3
Livemesh Addons by Elementor
Affected versions: [*, 2.6)
Patched versions: 2.6
DeMomentSomTres Address
Affected versions: *-2.1
Patched versions: Not supplied
Funnelmentals
Affected versions: [*, 1.2.9)
Patched versions: 1.2.9
Better Robots.txt – AI-Ready Crawl Control & Bot Governance
Affected versions: [*, 1.2.6)
Patched versions: 1.2.6
GFireM Fields
Affected versions: *-1.1.7
Patched versions: Not supplied
Simple Giveaways – Grow your business, email lists and traffic with contests
Affected versions: [*, 2.18.0)
Patched versions: 2.18.0
EDD Tab Manager
Affected versions: [*, 1.3.1)
Patched versions: 1.3.1
GFireM Action After
Affected versions: *-1.1.6
Patched versions: Not supplied
a-staff – Team member showcase plugin for WordPress
Affected versions: *-1.2.2
Patched versions: Not supplied
wGauge – Free Version
Affected versions: *-1.0.0
Patched versions: Not supplied
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)
Affected versions: [*, 2.3.2)
Patched versions: 2.3.2
Social Gallery Lite
Affected versions: *-3.1
Patched versions: Not supplied
Premmerce Wishlist for WooCommerce
Affected versions: [*, 1.1.3)
Patched versions: 1.1.3
Starfish Review Generation & Marketing for WordPress
Affected versions: [*, 2.0.1)
Patched versions: 2.0.1
Advanced Classifieds & Directory Pro
Affected versions: [*, 1.6.3)
Patched versions: 1.6.3
WooCommerce Next Order Coupon
Affected versions: *-0.4.0
Patched versions: Not supplied
Addendio LITE – Find WordPress plugins and themes
Affected versions: *-1.2.2
Patched versions: Not supplied
Price Bands for WooCommerce
Affected versions: *-1.0.4
Patched versions: Not supplied
Perelandra Sermons
Affected versions: *-1.1.0
Patched versions: Not supplied
WP Munich Blocks – Gutenberg Blocks for WordPress
Affected versions: [*, 0.7.3)
Patched versions: 0.7.3
go-fetch-jobs-jobengine
Affected versions: *-1.0
Patched versions: Not supplied
GFireM Advance Search
Affected versions: *-1.2.2
Patched versions: Not supplied
Speculor
Affected versions: *-1.2.0
Patched versions: Not supplied
Remove WP Update Nags
Affected versions: [*, 1.4.0)
Patched versions: 1.4.0
Content Collector
Affected versions: *-1.1.1
Patched versions: Not supplied
Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel
Affected versions: [*, 1.6.17)
Patched versions: 1.6.17
Stop User Enumeration
Affected versions: [*, 1.3.20)
Patched versions: 1.3.20
Social Share Icons & Social Share Buttons
Affected versions: [*, 3.0.4)
Patched versions: 3.0.4
TinyMCE Annotate
Affected versions: *-1.1.2
Patched versions: Not supplied
Woo Admin Product Notes
Affected versions: *-1.0.0
Patched versions: Not supplied
Run time Image resizing
Affected versions: *-1.1
Patched versions: Not supplied
Add Pinterest conversion tags for Pinterest Ads + Site verification
Affected versions: [*, 1.0.2)
Patched versions: 1.0.2
One Page Blocks
Affected versions: *-1.0.0
Patched versions: Not supplied
Page Studio Lite Plugin
Affected versions: *-1.0.6
Patched versions: Not supplied
Shuban
Affected versions: *-1.1.2
Patched versions: Not supplied
DeMomentSomTres Grid Archive
Affected versions: *-2.1
Patched versions: Not supplied
Random Sorting Order for WooCommerce
Affected versions: *-1.0
Patched versions: Not supplied
Inbound Brew
Affected versions: *-1.9.4
Patched versions: Not supplied
WP Photo Effects
Affected versions: [*, 1.2.3)
Patched versions: 1.2.3
Turbo Widgets
Affected versions: *-2.0.0
Patched versions: Not supplied
Press Elements – Widgets for Elementor
Affected versions: *-1.7.2
Patched versions: Not supplied
BuddyForms EasyPin
Affected versions: *-1.0.1
Patched versions: Not supplied
WP Author Bio
Affected versions: *-1.5.5
Patched versions: Not supplied
RW Divi Unite Gallery
Affected versions: *-1.0
Patched versions: Not supplied
Revolution for Elementor
Affected versions: *-0.0.19
Patched versions: Not supplied
Product Tables for WooCommerce: Quickster
Affected versions: *-1.0.2
Patched versions: Not supplied
Get feedback from visitors – WP Feedback Suite Plugin
Affected versions: *-1.0.5
Patched versions: Not supplied
Content Aware Sidebars – Fastest Widget Area Plugin
Affected versions: [*, 3.8.1)
Patched versions: 3.8.1
Bani
Affected versions: *-1.0.7
Patched versions: Not supplied
Fast WordPress
Affected versions: *-1.0.3
Patched versions: Not supplied
Import Social Statistics
Affected versions: *-1.0.2
Patched versions: Not supplied
BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages
Affected versions: [*, 3.2.6.1)
Patched versions: 3.2.6.1
Affiliate Link Builder Plugin for Amazon Associates – Review Engine
Affected versions: *-1.0.41
Patched versions: Not supplied
BAVOKO SEO Tools – All-in-One WordPress SEO
Affected versions: [*, 2.1.9.8)
Patched versions: 2.1.9.8
Ultimate Widgets Light
Affected versions: *-1.5.9.4
Patched versions: Not supplied
Insert or Embed Articulate Content into WordPress
Affected versions: [*, 4.2997)
Patched versions: 4.2997
Nitek Carousel Slider Cool Transitions
Affected versions: *-1.1.0
Patched versions: Not supplied
WP Activity Log
Affected versions: [*, 3.3.1.2)
Patched versions: 3.3.1.2
Contact Form for WordPress- Cybrosys
Affected versions: *-5.0
Patched versions: Not supplied
Widgets for SiteOrigin
Affected versions: [*, 1.4.3)
Patched versions: 1.4.3
NEXUS
Affected versions: *-2.0
Patched versions: Not supplied
WordPress FAQ Plugin – WPWorx
Affected versions: *-2.0.0
Patched versions: Not supplied
Brand
Affected versions: *-1.9.1
Patched versions: Not supplied
Premmerce Variation Swatches for WooCommerce
Affected versions: [*, 1.1)
Patched versions: 1.1
Sprout Clients – CRM and Lead Management
Affected versions: *-3.1
Patched versions: 3.2
Kanzu Support Desk – WordPress Helpdesk Plugin
Affected versions: *-2.4.7
Patched versions: Not supplied
Expire tags
Affected versions: *-1.1
Patched versions: Not supplied
WordPress Reviews by ReviewPress
Affected versions: *-1.0.5
Patched versions: Not supplied
WP Mobile Menu – The Mobile-Friendly Responsive Menu
Affected versions: [*, 2.7.3)
Patched versions: 2.7.3
CP Simple Newsletter
Affected versions: *-1.1
Patched versions: Not supplied
DeMomentSomTres Categories
Affected versions: *-201704251008
Patched versions: Not supplied
WP Relevant Ads
Affected versions: *-1.0.0
Patched versions: Not supplied
Giveaways for woocommerce
Affected versions: *-1.0.0
Patched versions: Not supplied
DeMomentSomTres Media Tools Auto
Affected versions: *-2.0
Patched versions: Not supplied
Drop Shadow Boxes
Affected versions: [*, 1.7.2)
Patched versions: 1.7.2
404 to 301 – Redirect Manager, 404 Error Logs & Notifications
Affected versions: [*, 3.0.2)
Patched versions: 3.0.2
Before and After Product Images for WooCommerce
Affected versions: *-1.0.3
Patched versions: Not supplied
Customer Chat Facebook
Affected versions: *-1.1.1
Patched versions: Not supplied
Delete Duplicate Posts
Affected versions: [*, 4.1.9.5)
Patched versions: 4.1.9.5
Post Snippets – Custom WordPress Code Snippets Customizer
Affected versions: [*, 3.0.6)
Patched versions: 3.0.6
Helpie FAQ — Accordion, Docs & Knowledge Base
Affected versions: [*, 0.7.2)
Patched versions: 0.7.2
Livemesh SiteOrigin Widgets
Affected versions: [*, 2.5.2)
Patched versions: 2.5.2
Gravity Forms Sticky List
Affected versions: *-1.5.2
Patched versions: Not supplied
WP fail2ban – Advanced Security
Affected versions: [*, 4.0.5)
Patched versions: 4.0.5
Image Photo Gallery Final Tiles Grid
Affected versions: [*, 3.3.57)
Patched versions: 3.3.57
Lightbox & Modal Popup WordPress Plugin – FooBox
Affected versions: [*, 2.6.4)
Patched versions: 2.6.4
Contact Form 7 Multi-Step Forms
Affected versions: [*, 3.0.9)
Patched versions: 3.0.9
DeMomentSomTres Classify on Publish
Affected versions: *-201703020805
Patched versions: Not supplied
wp-buddha-free-adwords
Affected versions: *-1.0.0
Patched versions: Not supplied
Purus
Affected versions: *-1.2.2
Patched versions: Not supplied
MailChimp Manager
Affected versions: *-1.0.2
Patched versions: Not supplied
Automatic Post Categories
Affected versions: *-1.0
Patched versions: Not supplied
Global Income Stats from Freemius
Affected versions: *-1.0.0
Patched versions: Not supplied
Cryptocurrency Portfolio Tracker
Affected versions: *-0.0.17
Patched versions: Not supplied
Magic Content for Siteorigins Pagebuilder
Affected versions: *-1.0.1
Patched versions: Not supplied
Master Blocks – Gutenberg Site Builder
Affected versions: *-1.0.4
Patched versions: Not supplied
Widgets on Pages and Posts
Affected versions: *-1.4.0
Patched versions: Not supplied
SheetPress – Manage WordPress Meta data with Google Sheets
Affected versions: *-1.1
Patched versions: Not supplied
FTC Disclosure
Affected versions: *-2.0
Patched versions: Not supplied
WP Pro Counter
Affected versions: *-1.1
Patched versions: Not supplied
Nugget by Ingot: Easy, automated and native A/B testing for everyone
Affected versions: *-1.0.0
Patched versions: Not supplied
XPoster – Share to Bluesky and Mastodon
Affected versions: [*, 3.3.0)
Patched versions: 3.3.0
Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces
Affected versions: [*, 2.2.3.1)
Patched versions: 2.2.3.1
Custom Registration and Custom Login Forms with New Recaptcha
Affected versions: *-1.1
Patched versions: Not supplied
freemage
Affected versions: *-1.0
Patched versions: Not supplied
ClimateClick: Climate Action for all
Affected versions: *-1.0.9.21
Patched versions: 1.0.9.22
SnazzyAdmin WP Admin Theme
Affected versions: *-1.0.2
Patched versions: Not supplied
Ant Admin Notices for Team
Affected versions: [*, 1.0.4)
Patched versions: 1.0.4
Easy Digital Downloads – Courses
Affected versions: [*, 0.1.1)
Patched versions: 0.1.1
WP Affiliate Disclosure
Affected versions: [*, 1.1.4)
Patched versions: 1.1.4
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
Affected versions: [*, 3.1.7)
Patched versions: 3.1.7
Multilist Subscribe for Sendy
Affected versions: *-1.6.1
Patched versions: Not supplied
Easy Code Snippets
Affected versions: [*, 1.0.1)
Patched versions: 1.0.1
Premmerce Product Filter for WooCommerce
Affected versions: [*, 3.2)
Patched versions: 3.2
Easy Watermark
Affected versions: [*, 0.7.1)
Patched versions: 0.7.1
CP Image Gallery
Affected versions: *-1.0.1
Patched versions: Not supplied
Applicable copyright and licence notices
This record contains material that is subject to copyright
Copyright 2012-2026 Defiant Inc.
Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.
- Published
- February 25, 2019
- CVSS
- 8.8