Mutantgun

The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing customers' postal addresses, phone numbers and company details.

**Name of the Vulnerable Software and Affected Versions** The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin versions prior to 2.13.2 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can view privacy-restricted member profile field values, including those configured as owner-only, members-only, or role-restricted. This is achieved by querying the publicly accessible 'wp ajax nopriv um get members' endpoint. The required nonce `um-frontend-nonce` is emitted to all unauthenticated visitors via wp localize script, which removes meaningful access control and allows anonymous visitors to satisfy authentication requirements. **Recommendations** Update to version 2.13.2 or later.

**Name of the Vulnerable Software and Affected Versions** Mailchimp for WooCommerce WordPress plugin versions prior to 6.3 **Description** An issue exists where the plugin fails to require authentication, a nonce (a unique token used to prevent replay attacks), or an ownership check before processing actions on a customer's abandoned-cart record. This allows an unauthenticated attacker to modify or delete stored cart data belonging to other customers by providing specific request-supplied data. **Recommendations** Update the Mailchimp for WooCommerce WordPress plugin to version 6.3 or later.

**Name of the Vulnerable Software and Affected Versions** FluentCart A New Era of eCommerce WordPress plugin versions prior to 1.6.5 **Description** The plugin fails to verify if the individual performing a guest checkout actually controls the provided email address. This allows unauthenticated attackers who possess a known guest customer email to gain access to a logged-in account associated with that address, including the customer's stored records. **Recommendations** Update the plugin to version 1.6.5 or later.

**Name of the Vulnerable Software and Affected Versions** File Manager WordPress plugin versions prior to 8.0.5 FileOrganizer WordPress plugin versions prior to 1.2.1 File Manager Pro WordPress plugin versions prior to 2.1.3 **Description** These plugins fail to correctly validate the origin of window messages received by the file browser loaded on their admin screens. The system accepts any origin that is a leading string prefix of the site's own address. This flaw allows an unauthenticated attacker to execute arbitrary JavaScript within the session of a logged-in administrator who visits a page controlled by the attacker. The issue originates from the bundled `file-manager` library in versions prior to 2.1.70. **Recommendations** Update File Manager WordPress plugin to version 8.0.5 or later. Update FileOrganizer WordPress plugin to version 1.2.1 or later. Update File Manager Pro WordPress plugin to version 2.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** CMB2 WordPress plugin versions prior to 2.13.0 **Description** An issue exists where a lack of capability checks on an AJAX action allows users with Subscriber roles to create or corrupt arbitrary WordPress options. This can lead to the disruption of core site settings and potential site downtime. Exploitation is possible only if the site or another plugin using CMB2 has declared an oEmbed field, as the plugin does not register any by default. Since the stored value is not attacker-controlled, this issue does not allow for privilege escalation. **Recommendations** Update CMB2 WordPress plugin to version 2.13.0 or later.

**Name of the Vulnerable Software and Affected Versions** Relevanssi – A Better Search versions prior to 4.28.2 **Description** Reflected Cross-Site Scripting occurs when unauthenticated attackers trick users into clicking specially crafted links. The issue stems from insufficient input sanitization and output escaping in the `relevanssi debug array()` function within lib/debug.php, which uses `print r()` to dump user-supplied query variables inside a <pre> block without HTML escaping. This behavior is triggered when the `relevanssi debug=on` request parameter is supplied and the administrator has enabled the Debugging mode setting. The vulnerability affects the `s`, `post types`, and `orderby` request parameters. The debug path lacks capability, nonce, or logged-in checks. **Recommendations** Update to version 4.28.2 or later. Disable the Debugging mode setting in the plugin configuration. Avoid using the `s`, `post types`, and `orderby` parameters in conjunction with the `relevanssi debug=on` parameter.

**Name of the Vulnerable Software and Affected Versions** Masteriyo LMS versions prior to 3.4.0 **Description** Insufficient sanitization and escaping of course settings allow users with a course-author role or higher to perform Stored Cross-Site Scripting (XSS) attacks. This occurs when arbitrary web scripts are injected into pages available to all visitors, executing in the session of anyone viewing the course, including logged-in administrators. Stored Cross-Site Scripting is a flaw where malicious scripts are permanently stored on the target server. **Recommendations** Update to version 3.4.0 or later.

**Name of the Vulnerable Software and Affected Versions** HivePress Authentication versions prior to 1.1.5 **Description** An authentication bypass exists due to the way the `authenticate user()` function handles Facebook authentication. The system resolves third-party identity by forwarding the `access token` parameter to the Facebook Graph API and trusting the returned email and ID without performing application ID or audience validation. Specifically, the process lacks `/debug token` verification and fails to compare the token's `app id` against the configured `hp facebook app id`. This allows unauthenticated attackers to impersonate any WordPress user, including administrators, provided the attacker possesses a valid access token for a Facebook account associated with the victim's email address. **Recommendations** Update HivePress Authentication to version 1.1.5 or later. As a temporary mitigation, restrict the use of the `access token` parameter in the Facebook authentication process until the update is applied.

**Name of the Vulnerable Software and Affected Versions** RegistrationMagic WordPress plugin versions prior to 6.0.9.9 **Description** The plugin fails to verify the application to which a Facebook access token was issued before accepting it as proof of identity. This allows unauthenticated attackers to log in as an existing user if they obtain a valid token, or to create and access a new account even if user registration is disabled. **Recommendations** Update RegistrationMagic WordPress plugin to version 6.0.9.9 or later.