Amity Gilmour

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer accounts.

**Name of the Vulnerable Software and Affected Versions** Breeze Cache WordPress plugin versions prior to 2.5.15 **Description** The plugin fails to include specific tracking-related query parameters in its page-cache key while continuing to cache pages requested with those parameters. This allows an unauthenticated attacker to force a page rendered within their own request context to be stored and served from the clean URL cache entry to all subsequent visitors. **Recommendations** Update the Breeze Cache WordPress plugin to version 2.5.15 or later.

**Name of the Vulnerable Software and Affected Versions** WP Express Checkout versions prior to 2.4.9 **Description** Unauthenticated users can forge a completed order without making a payment because the software fails to verify server-side that a payment was actually completed before marking an order as paid. This issue occurs within the `wpec process payment()` function. **Recommendations** Update WP Express Checkout to version 2.4.9 or later.

**Name of the Vulnerable Software and Affected Versions** WP Fastest Cache versions 0.8.7.7 through 1.5.0 **Description** An issue exists where the plugin fails to include specific tracking-related query parameters in its page-cache key while continuing to cache pages requested with those parameters. This allows unauthenticated attackers to perform cache poisoning by forcing a page rendered under their own request context to be stored and served from the clean URL cache entry to all subsequent visitors. **Recommendations** Update WP Fastest Cache to version 1.5.1 or later.