In reviewing reports of vulnerabilities in WordPress plugins to provide our customers with the best data on vulnerabilities in plugins they use we often find that there are reports for things that don’t appear to be vulnerabilities. For more problematic reports we release posts detailing why the vulnerability reports are false, but there have been a lot of that we haven’t felt rose to that level. In particular are items that are not outright false, just the issue is probably more accurately described as a bug. For those that don’t rise to level of getting their own post we now place them in a weekly post when we come across them.

Authenticated Option Update Vulnerability in CF7 Customizer

The first changelog entry for versions “1.2.0/1/2” of the plugin CF7 Customizer is

TL;DR Major security update due to Freemius. (MUST UPDATE right now)

You would reasonably assume that means the plugin was impacted by the authenticated option updated vulnerability that was recently fixed in Freemius, but prior to that update the plugin was using a very out of date version of Freemius, from before the introduction of the vulnerable code, so this isn’t actually a “Major security update”. We would, as always, recommend updating plugins right away no matter if there is claimed to be a security fix in a new release.