Charles Vosburgh

**Name of the Vulnerable Software and Affected Versions** Razorpay for WooCommerce WordPress plugin versions prior to 4.8.8 **Description** An issue exists where the plugin fails to perform ownership or authorization checks on a REST API route used during the checkout process. This allows unauthenticated attackers to modify shipping information stored on arbitrary orders. **Recommendations** Update the plugin to version 4.8.8 or later.

**Name of the Vulnerable Software and Affected Versions** Apache HTTP Server versions 2.4.0 through 2.4.68 **Description** An improper privilege management issue exists in the `mod ssl` module. The flaw occurs when using `SSLRequire` in conjunction with file-related expressions via `ap expr` file functions, which can lead to improper privilege escalation without requiring authentication. **Recommendations** Update Apache HTTP Server to a version later than 2.4.68.

**Name of the Vulnerable Software and Affected Versions** Apache HTTP Server versions prior to 2.4.69 **Description** Improper validation of the FTP PASV reply address in the `mod proxy ftp` module allows an untrusted FTP server to force the proxy to open a data connection to an arbitrary third-party host. This occurs in forward proxy configurations when the server processes a crafted PASV response. **Recommendations** Upgrade to version 2.4.69.

**Name of the Vulnerable Software and Affected Versions** Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin versions prior to 19.9.7 **Description** An authorization check is missing in an AJAX action, which allows users with a subsite administrator role on a multisite network to write and delete arbitrary files within the network's shared filesystem. This flaw can lead to remote code execution, a situation where an attacker can execute arbitrary commands on the server. **Recommendations** Update the plugin to version 19.9.7 or later.

The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected, allowing unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn from the response whether an internal service answered. Versions below 7.8.8 are covered by CVE-2025-68600; this entry covers 7.8.8 through 7.9.5, where that fix was incomplete. Exploitation requires the site owner to have published the Link Library WordPress plugin before 7.9.6's public link submission form with reciprocal-link validation enabled.

**Name of the Vulnerable Software and Affected Versions** WPForms versions prior to 2.0.2 **Description** An issue exists where the plugin fails to verify if a Stripe payment object provided during a public form submission actually belongs to the plugin before processing it. This allows unauthenticated users to trigger full refunds and immediate subscription cancellations for payments generated by other applications linked to the site owner's Stripe account. **Recommendations** Update to version 2.0.2 or later.

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment.

**Name of the Vulnerable Software and Affected Versions** Payment Gateway for PayPal on WooCommerce WordPress plugin versions prior to 9.2.1 **Description** An issue exists where the plugin fails to verify if an incoming payment notification was confirmed within the store's configured payment environment or paid to the store's own merchant account before marking an order as complete. This allows unauthenticated users to mark their own orders as paid by using a genuine transaction from a payment sandbox they control. **Recommendations** Update the plugin to version 9.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** Secure Custom Fields WordPress plugin versions prior to 6.9.4 **Description** An issue exists where the plugin fails to properly verify that a front-end form submission matches the form rendered to the visitor. This allows unauthenticated users to submit data against a different registered form, enabling the modification of the title and content of the post associated with that form. **Recommendations** Update the Secure Custom Fields WordPress plugin to version 6.9.4 or later.

**Name of the Vulnerable Software and Affected Versions** All-in-One WP Migration and Backup WordPress plugin versions prior to 7.111 **Description** Several AJAX actions do not perform proper capability checks and are instead protected by an installation-wide secret. This secret is disclosed to any user with permission to export the site. Consequently, a user with export privileges can import an arbitrary site archive to gain administrator access. This issue occurs when an administrator grants export capabilities to a role that lacks the plugin's native import capability, which is not the default configuration. **Recommendations** Update to version 7.111 or later.

**Name of the Vulnerable Software and Affected Versions** Paid Membership Subscriptions versions prior to 3.0.9 **Description** An issue exists where the plugin fails to verify if the amount and currency reported by the payment provider match the pending payment before completion. This allows unauthenticated users to obtain a paid membership by paying an arbitrary lower amount. **Recommendations** Update to version 3.0.9 or later.

**Name of the Vulnerable Software and Affected Versions** Tutor LMS WordPress plugin versions prior to 4.0.8 **Description** The plugin fails to correctly determine if an incoming request is directed to its own REST API and does not enforce permissions associated with API credentials. This allows a user possessing a read-only key to perform actions with the privileges of the administrator account that issued the key. **Recommendations** Update the plugin to version 4.0.8 or later.

**Name of the Vulnerable Software and Affected Versions** Really Simple Security versions prior to 9.8.1 **Description** The plugin fails to prevent unauthenticated requests from resetting a completed email two-factor enrolment for an account. This allows an attacker who possesses the account password to bypass the second factor of authentication and obtain a user session, which could potentially grant administrator privileges. **Recommendations** Update to version 9.8.1 or later.

**Name of the Vulnerable Software and Affected Versions** Simple Membership versions prior to 4.7.8 **Description** The Simple Membership WordPress plugin fails to validate if the membership level provided in a PayPal payment notification corresponds to the level configured for the payment button. This flaw allows users to pay for a lower-priced membership while obtaining a higher, more privileged membership level. **Recommendations** Update to version 4.7.8 or later.

**Name of the Vulnerable Software and Affected Versions** BackWPup versions 5.2.2 through 5.7.4 **Description** An authorization flaw exists in the REST API routes used for managing backup jobs, backup destinations, and backup execution. This issue allows an authenticated user with a limited role assigned by an administrator to bypass intended permission boundaries. An attacker can exploit this gap to create or modify backup jobs and redirect a full WordPress database backup to a destination under their control, leading to data exfiltration. **Recommendations** Update BackWPup to version 5.7.5 or later. Review all users with BackWPup capabilities, recently created backup jobs, and newly added destinations for unauthorized activity. Rotate credentials if an unauthorized database copy is suspected to have been exfiltrated.

The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.

**Name of the Vulnerable Software and Affected Versions** RegistrationMagic versions prior to 6.0.9.9 **Description** An issue exists where the plugin fails to validate the total price of a paid registration on the server side. This lack of server-side payment verification allows unauthenticated users to bypass the payment process and obtain an activated account without paying. **Recommendations** Update RegistrationMagic to version 6.0.9.9 or later.

**Name of the Vulnerable Software and Affected Versions** Really Simple Security versions prior to 9.8.0 **Description** In WordPress Multisite environments, a privilege escalation flaw exists where the software fails to verify if a user has the necessary permissions before installing a plugin from a user-supplied URL. This allows a subsite administrator to bypass the security boundary and install and execute arbitrary PHP code within the network-shared plugin directory, a location normally reserved for the network administrator. Exploitation is possible only if the network administrator has enabled the Really Simple Security administration menu for subsites, which is not the default configuration. **Recommendations** Update Really Simple Security to version 9.8.0 or later. Restrict network-level administrative capabilities to trusted accounts only.

**Name of the Vulnerable Software and Affected Versions** Stripe Payment Forms by WP Full Pay versions prior to 8.5.1 **Description** An Insecure Direct Object Reference (IDOR) exists where the plugin fails to verify if a subscription belongs to the customer associated with the active customer-portal session. This allows an authenticated user with a valid portal session to cancel, reactivate, or modify subscriptions belonging to other customers. **Recommendations** Update Stripe Payment Forms by WP Full Pay to version 8.5.1 or later.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات AI Engine الأقدم من 3.6.1 **الوصف** يؤدي عدم كفاية التحقق من الصلاحيات أثناء عمليات إدارة المستخدمين ذوي الصلاحيات الخاصة إلى تمكين مستخدم يحمل دور «المسؤول» في أحد المواقع الفرعية ضمن نظام «Multisite» من الاستيلاء على أي حساب داخل الشبكة، بما في ذلك حساب «مسؤول الشبكة». **التوصيات** تحديث AI Engine إلى الإصدار 3.6.1 أو أحدث.