Maksim Hayder

Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

**Name of the Vulnerable Software and Affected Versions** Theme My Login versions prior to 7.1.16 **Description** On Multisite installations, a missing authorization issue exists within the `tml ms signup handler()` function. Specifically, the `gimmeanotherblog` branch fails to enforce the network's `active signup` registration policy, verifying only if the user is logged in via `is user logged in()`. This allows authenticated attackers with Subscriber-level access or higher to send a POST request with the parameter `stage=gimmeanotherblog` to the signup route. This action bypasses the registration policy and triggers `wpmu create blog()`, resulting in the attacker being assigned the Administrator role on the newly created subsite through `add user to blog()`. The privilege escalation is limited to the new subsite; the attacker does not gain Super Admin or network-level capabilities such as `manage network` or `manage sites` on the main site. **Recommendations** Update to a version newer than 7.1.15.