Farid Narimanov

The Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 does not perform a capability check before disclosing order details through its calendar view AJAX actions, allowing users with a role as low as Contributor to view other customers' order information.

The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing its sequential identifier.

**Name of the Vulnerable Software and Affected Versions** Premium Packages WordPress plugin versions prior to 7.2.1 **Description** The plugin fails to verify the signature of webhooks received from PayPal when processing payment and subscription notifications. This allows unauthenticated attackers to forge payment confirmations and subscription-cancellation events for any order, provided they possess the transaction ID. A webhook is an automated message sent from one application to another to notify it about an event. **Recommendations** Update the Premium Packages WordPress plugin to version 7.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** WC Fields Factory WordPress plugin versions prior to 4.1.11 **Description** Insufficient access restrictions and missing nonce verification for a post-cloning action allow users with Contributor-level permissions or higher to duplicate arbitrary posts of any type or status. This includes the ability to clone private or draft content belonging to other users, granting the attacker read access to the duplicated copy. A nonce is a unique token used to protect against cross-site request forgery (CSRF) by ensuring that a request was intentionally sent by the user. **Recommendations** Update the WC Fields Factory WordPress plugin to version 4.1.11 or later.

**Name of the Vulnerable Software and Affected Versions** WC Fields Factory WordPress plugin versions prior to 4.1.11 **Description** Insufficient access restrictions on the field-management AJAX action allow authenticated users with Subscriber-level permissions or higher to create, modify, and delete arbitrary post meta on any post. This includes WooCommerce products, regardless of who owns them. An attacker can use this to manipulate stored pricing rules on a product to lower its price during checkout. **Recommendations** Update WC Fields Factory WordPress plugin to version 4.1.11 or later.

**Name of the Vulnerable Software and Affected Versions** Points and Rewards for WooCommerce WordPress plugin versions prior to 2.10.4 **Description** Authenticated users with Subscriber privileges or higher can credit their own accounts with an unlimited amount of loyalty points. This occurs because the plugin fails to validate the claimed reward amount or restrict access to the Win Wheel claim handler. Additionally, if a companion wallet is active, the user can also manipulate their wallet balance. **Recommendations** Update Points and Rewards for WooCommerce WordPress plugin to version 2.10.4 or later.

**Name of the Vulnerable Software and Affected Versions** Bookit — Booking & Appointment Calendar WordPress plugin versions prior to 2.6.0.5 **Description** An authorization check is missing in an appointment-retrieval action. This allows users with a low-privilege role specific to the plugin to access appointment records of other users, leading to the disclosure of personally identifiable information such as customer names, email addresses, phone numbers, and private booking comments. **Recommendations** Update to version 2.6.0.5 or later.

**Name of the Vulnerable Software and Affected Versions** Rox Appointment Booking WordPress plugin versions prior to 1.2.8 **Description** The plugin fails to perform authorization checks on endpoints that return booking service and category records. This allows unauthenticated attackers to access and read private internal notes associated with each service and category. **Recommendations** Update the plugin to version 1.2.8 or later.

**Name of the Vulnerable Software and Affected Versions** MultiVendorX WordPress plugin versions prior to 5.0.16 **Description** An issue exists where the plugin fails to verify store ownership within a REST API route. This allows any authenticated user, including those with subscriber privileges, to overwrite store details, modify payout settings, and change the ownership records of any store. **Recommendations** Update the plugin to version 5.0.16 or later.

**Name of the Vulnerable Software and Affected Versions** Rox Appointment Booking versions prior to 1.2.3 **Description** The plugin fails to perform authorization checks on the endpoint that returns booking confirmation details. Because bookings are identified by sequential numeric identifiers, unauthenticated attackers can use Insecure Direct Object Reference (IDOR)—a flaw where an application provides direct access to objects based on user-supplied input—to enumerate these identifiers and access sensitive customer information, including names, emails, phone numbers, booking details, and payment status. **Recommendations** Update to version 1.2.3 or later.

**Name of the Vulnerable Software and Affected Versions** The Orbit Fox versions prior to 3.0.9 **Description** Insufficient input sanitization and output escaping in a Beaver Builder widget allow users with contributor-level access and above to inject arbitrary web scripts. This occurs because the plugin fails to validate a user-supplied HTML tag name before echoing it into the rendered markup, resulting in Stored Cross-Site Scripting (XSS), where scripts execute when any visitor views the affected page. **Recommendations** Update to version 3.0.9 or later.

**Name of the Vulnerable Software and Affected Versions** Sunshine Photo Cart versions prior to 3.7 **Description** The plugin contains an Insecure Direct Object Reference (IDOR) flaw, which occurs when an application provides direct access to objects based on user-supplied input. The issue stems from missing validation of a client-supplied price identifier when an item is added to the cart. This allows unauthenticated users to manipulate the price by using an identifier defined elsewhere on the site, enabling them to purchase items at a lower cost and complete orders at that price. **Recommendations** Update to version 3.7 or later.

**Name of the Vulnerable Software and Affected Versions** B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More versions prior to 5.2.40 **Description** Unauthenticated users can assign themselves to restricted B2B customer groups and bypass the manual account-approval workflow during self-registration. This occurs because the plugin fails to validate whether the registration role submitted by the user is actually among the publicly available, published, and selectable roles offered on the registration form. **Recommendations** Update to version 5.2.40 or later.

**Name of the Vulnerable Software and Affected Versions** Stripe Payment Forms by WP Full Pay versions prior to 8.5.5 **Description** An Insecure Direct Object Reference (IDOR) exists where the plugin fails to verify if a subscription belongs to the customer associated with the active customer-portal session before processing a cancellation. This allows an authenticated user with a valid portal session to cancel subscriptions belonging to other customers, provided they know the specific subscription identifier. This identifier is high-entropy, meaning it is a complex string that is difficult to guess or enumerate. **Recommendations** Update Stripe Payment Forms by WP Full Pay to version 8.5.5 or later.

**Name of the Vulnerable Software and Affected Versions** WP OAuth Server ( Login with WordPress ) versions prior to 6.3.1 **Description** When debug logging is enabled, the plugin fails to restrict access to its debug log. Because the log is stored at a fixed and publicly reachable location, unauthenticated users can read sensitive information, including issued OAuth tokens, authorization codes, and user records containing password hashes. **Recommendations** Update to version 6.3.1 or later. As a temporary mitigation, disable debug logging to prevent the creation of the publicly accessible log file.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات Masteriyo LMS الأقدم من 2.3.3 **الوصف** يفشل المكون الإضافي في تنقية حقل الاختبار وتشفيره قبل عرضه على الصفحة. وهذا يسمح للمستخدمين الذين يشغلون دور المدرب بتخزين كود HTML غير مرشح، مما يتيح شن هجمات البرمجة النصية عبر المواقع المخزنة (XSS) — وهي تقنية يتم فيها تخزين البرامج النصية الخبيثة بشكل دائم على الخادم وتنفيذها في متصفح أي زائر، بما في ذلك المسؤولون. تؤثر هذه المشكلة على التثبيتات الافتراضية لموقع واحد؛ ومع ذلك، لا تتأثر التثبيتات متعددة المواقع أو المواقع التي تحدد `DISALLOW UNFILTERED HTML`. **التوصيات** قم بتحديث Masteriyo LMS إلى الإصدار 2.3.3 أو أحدث.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات «Premium Packages» الأقدم من 7.0.7 **الوصف** توجد مشكلة تتمثل في عدم التحقق من صحة طلبات السحب مقارنة بالرصيد الفعلي المكتسب للمستخدم الطالب. وهذا يسمح لأي مستخدم تمت مصادقته، بما في ذلك أولئك الذين يشغلون دور المشترك وليس لديهم سجل مبيعات، بتقديم طلب سحب لمبلغ تعسفي. إذا وافق المسؤول على الطلب، فقد يتم دفع الأموال. **التوصيات** تحديث حزم Premium Packages إلى الإصدار 7.0.7 أو أحدث.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات Simple JWT Login الأقدم من 3.6.8 **الوصف** يفشل المكون الإضافي في التحقق من صحة جمهور رموز الهوية المقبولة من Google. وهذا يسمح للمستخدمين غير المصادق عليهم بالمصادقة كأي مستخدم، بما في ذلك المسؤولون، من خلال تقديم رمز يحتوي على عنوان البريد الإلكتروني للمستخدم المستهدف. **التوصيات** قم بتحديث Simple JWT Login إلى الإصدار 3.6.8 أو أحدث.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات Visualizer الأقدم من 4.0.7 **الوصف** تسمح الصلاحيات غير الكافية في المكون الإضافي للمستخدمين الذين يحملون دور «المساهم» (Contributor) أو أعلى بقراءة التكوين الكامل لأي مخطط بياني على الموقع. ويشمل ذلك المخططات البيانية التي تقيدها الواجهة عادةً، كما يسمح باسترداد جميع تكوينات المخططات البيانية في طلب واحد. قد تحتوي التكوينات المكشوفة على بيانات اعتماد لمصادر البيانات البعيدة التي تستخدمها المخططات البيانية. **التوصيات** التحديث إلى الإصدار 4.0.7 أو أحدث.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** Extra Product Options Builder لـ WooCommerce، الإصدارات الأقدم من 1.2.176 **الوصف** توجد مشكلة تتمثل في فشل المكون الإضافي في التحقق مما إذا كان الطالب مخولًا بالوصول إلى ملف قام العميل بتحميله قبل عرضه. وهذا يسمح للمستخدمين غير المصادق عليهم باسترداد الملفات في حال حصلوا على اسم الملف المخزن. يعتمد استغلال هذه المشكلة على تكوين خادم الويب؛ فهي تؤثر على الخوادم التي تطبق قواعد «رفض الكل» (deny-all) في مجلدات التحميل، مثل Apache. أما على الخوادم التي تتجاهل هذه القواعد، مثل الإعدادات الافتراضية لـ nginx، فإن الملفات تكون متاحة بالفعل عبر عناوين URL المباشرة الخاصة بها، ولا تشكل نقطة النهاية `getpublicfileupload` أي خطر إضافي. **التوصيات** قم بتحديث «Extra Product Options Builder for WooCommerce» إلى الإصدار 1.2.176 أو أحدث.