Junhee Cho

The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including orders that were already paid or completed.

The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposes it to unauthenticated users, so any visitor can force the store to re-register and overwrite the Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2's stored shop secret.

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting on the order named in it, allowing unauthenticated attackers to force any WooCommerce order into a failed state. Order identifiers are sequential, so every order in the shop can be taken out of the fulfilment queue one request at a time.

The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, allowing users with the Contributor role and above to delete arbitrary post meta from any post, including content owned by higher-privileged users.

The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting it, allowing unauthenticated attackers who know a customer's email to destroy or tamper with that customer's stored abandoned-cart data.

**Name of the Vulnerable Software and Affected Versions** elegro Crypto Payment versions prior to 1.0.2 **Description** The plugin fails to require a shared secret before trusting incoming payment notification requests. This allows unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on installations where the secret remains at its default empty value. **Recommendations** Update the plugin to a version newer than 1.0.1. Configure a strong shared secret for payment notification requests to prevent the forging of payment confirmations.

**Name of the Vulnerable Software and Affected Versions** Easy PayPal & Stripe Buy Now Button WordPress plugin versions prior to 2.0.6 **Description** The plugin fails to verify the payment amount on the server side, instead relying on a value provided by the client. This allows an unauthenticated attacker to manipulate the price of a purchase by setting an arbitrary lower value. **Recommendations** Update the plugin to version 2.0.6 or later.

**Name of the Vulnerable Software and Affected Versions** LA-Studio Element Kit for Elementor versions prior to 1.6.3 **Description** A Server-Side Request Forgery (SSRF) issue exists in the LA-Studio Element Kit for Elementor plugin. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location, potentially accessing internal resources or bypassing network security controls. **Recommendations** Update LA-Studio Element Kit for Elementor to version 1.6.3 or later.

Contributor Path Traversal in Creator LMS <= 1.2.19 versions.

**Name of the Vulnerable Software and Affected Versions** Mailchimp for WooCommerce WordPress plugin versions prior to 6.3 **Description** An issue exists where the plugin fails to require authentication or verify ownership when loading a saved cart. An unauthenticated attacker who possesses a customer's email address can use a request-supplied identifier derived from that email to confirm the customer's shopping history at the store and access the contents of their saved cart. **Recommendations** Update Mailchimp for WooCommerce WordPress plugin to version 6.3 or later.

**Name of the Vulnerable Software and Affected Versions** WPeMatico RSS Feed Fetcher versions prior to 2.8.27 **Description** The plugin fails to perform a capability check or validate the destination of a user-supplied feed URL before fetching it server-side. This allows users with contributor-level access and above to induce the server to make requests to internal-only resources and read the responses back, a behavior known as Server-Side Request Forgery (SSRF). **Recommendations** Update WPeMatico RSS Feed Fetcher to version 2.8.27 or later.

**Name of the Vulnerable Software and Affected Versions** Meow Gallery versions prior to 5.5.5 **Description** Insufficient sanitization of user-supplied values allows unauthenticated users to execute arbitrary registered shortcodes. This occurs when input is concatenated into a shortcode string and passed to the WordPress shortcode parser via the `/load gallery collection` REST endpoint. This flaw can lead to the disclosure of non-public gallery content. **Recommendations** Update Meow Gallery to version 5.5.5 or later. Restrict access to the `/load gallery collection` endpoint as a temporary mitigation measure.

**Name of the Vulnerable Software and Affected Versions** Sign-up Sheets versions prior to 2.4.0 **Description** The Sign-up Sheets WordPress plugin fails to properly validate the CSRF nonce protecting the sign-up deletion action. This allows an attacker to delete sign-up records by sending a forged request that is executed within the session of a logged-in user who possesses the necessary permissions. CSRF (Cross-Site Request Forgery) is a technique where a malicious actor tricks a user's browser into performing an unwanted action on a different website where the user is authenticated. **Recommendations** Update Sign-up Sheets to version 2.4.0 or later.

Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.

**Name of the Vulnerable Software and Affected Versions** Active Woot Products Tables for WooCommerce versions prior to 2.1.3 **Description** Certain AJAX actions in the plugin lack authorization and Cross-Site Request Forgery (CSRF) checks. This allows any authenticated user, including those with subscriber privileges, to modify the titles of arbitrary posts, pages, and products via the `woot update attachment` action. **Recommendations** Update to version 2.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin versions prior to 5.1.1 **Description** An issue exists in the message deletion AJAX action where the software fails to verify user capabilities and only checks for the presence of a nonce parameter without validating it. This allows any authenticated user, including those with subscriber-level privileges, to permanently delete all stored form submissions. **Recommendations** Update to version 5.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Master Addons for Elementor versions prior to 3.1.9 **Description** The plugin fails to perform an authorization check on the AJAX action used to deactivate Popup Builder popups. It relies solely on a nonce (a number used once to prevent replay attacks) that is publicly exposed to all visitors. This allows unauthenticated attackers to permanently disable any popup on the site via the `jltma popup disable expired` action. **Recommendations** Update to version 3.1.9 or later.

**Name of the Vulnerable Software and Affected Versions** Quads Ads Manager for Google AdSense versions prior to 3.0.5 **Description** The plugin fails to verify payment completion with the configured payment gateway before marking an ad-selling order as paid. This allows users with the ability to place orders to obtain paid ad placements without completing the actual payment process. **Recommendations** Update Quads Ads Manager for Google AdSense to version 3.0.5 or later.

**Name of the Vulnerable Software and Affected Versions** rtMedia for WordPress, BuddyPress and bbPress versions prior to 4.7.12 **Description** The plugin fails to verify ownership when modifying the privacy level of an activity and its associated media. It relies solely on a nonce shared among all authenticated users, which enables users with subscriber-level permissions or higher to change the visibility of another user's private activity, either making it public or hiding it. This is an Insecure Direct Object Reference (IDOR), a condition where an application provides direct access to objects based on user-supplied input without sufficient authorization checks. **Recommendations** Update rtMedia for WordPress, BuddyPress and bbPress to version 4.7.12 or later.

**Name of the Vulnerable Software and Affected Versions** Solace Extra WordPress plugin versions prior to 1.7.0 **Description** An issue exists where the plugin fails to perform authorization or post-status checks within an AJAX action. This allows unauthenticated visitors to access and read the content of Site Builder parts that are not published, including those with statuses such as draft, pending, private, or trashed, which are normally restricted by WordPress. **Recommendations** Update Solace Extra WordPress plugin to version 1.7.0 or later.