Issue WP Toolkit email false-positive: patched plugin version is higher than notification describes

[pleskuser67553]

Server operating system version

AlmaLinux 9.8 (Olive Jaguar)

Plesk version and microupdate number

Plesk Obsidian 18.0.80 Update #9

Plugin Avada Builder was auto-updated with a patch on 1st October from version 3.16.1 to 3.16.2.

WP Toolkit on 10th October sends this false-positive email with the subject Site vulnerabilities found. Note the versions I have highlighted:



I have confirmed the two sites it references were both updated to 3.16.2 on 1st October. Both the links to Patchstack and Wordfence confirm the patched version is 3.16.2. So if both sites are already patched over a week ago, I should not receive a Site vulnerabilities found email - this is a bug. Please forward to devs.

Arbitrary Code Execution in WordPress Fusion Builder Plugin

Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.

patchstack.com

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/fusion-builder/avada-fusion-builder-7161-unauthenticated-arbitrary-wordpress-action-invocation-via-action-hook-dynamic-data-token-in-form-field

WP Toolkit version now: 6.11.4-10853
WP Toolkit version on 1 Oct, likely: 6.11.3

 

[Sebahat.hadzhi]

Thank you for the report, @pleskuser67553 . I will bring the matter to the attention of the WP Toolkit team. I will follow up with more details as soon as possible. Thank you for your patience in the meantime.

 

[Sebahat.hadzhi]

@pleskuser67553 , our team confirmed that they have a bug (EXTWPTOOLK-14844) registered for the behavior, which has already been addressed. The fix will be introduced in WP Toolkit version 6.12.