Osman Hussein

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the page id parameter, combined with a world-readable leaked nonce that bypasses authentication checks. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. This exploit chain requires obtaining the plugin's REST nonce (tenwebio rest), which is automatically serialized to a world-readable file under wp-content/uploads/ whenever a bulk optimisation batch pauses; because the nonce is generated in a cron/loopback context with a user ID of 0, it is valid for unauthenticated visitors.

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the check mimetype function. This is due to incomplete file type validation in the check mimetype function — while some extension checking is present, it can be bypassed, allowing attacker-supplied remote file content to be written with insufficient extension enforcement and no MIME check or WordPress upload helper. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the plugin's 'profile videos on bio' option to be enabled, as this causes the nonce to be emitted on the subscriber-accessible profile page; without this setting, authenticated users below Editor cannot obtain the required nonce.

The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner copy image from url AJAX action is registered for logged-out callers (wp ajax nopriv ), and its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter — bypassing the jpg/jpeg/png/gif allow-list applied on the other branch — and writes the fetched bytes to a web-accessible directory (wp-content/uploads/nbdesigner/temp/). This makes it possible for unauthenticated attackers to write a .php file to a web-served, PHP-executing location and, by supplying their own Google Drive file and OAuth token as the content source, execute arbitrary code on the server. The required save-design nonce is handed to anonymous callers by the nbd check use logged in endpoint, so it presents no barrier.

**Name of the Vulnerable Software and Affected Versions** Extensions For CF7 versions prior to 3.4.6 **Description** An arbitrary file upload flaw exists in the `extcf7 submit` function. The issue stems from missing file extension, MIME type, and size validation within the `validation filter()` of the signature field. Additionally, a bypass of the `sanitize file name()` function allows the conversion of filenames like `shell.php-` into `shell.php`. Combined with a lack of PHP-execution guards in the upload directory, unauthenticated attackers can upload executable files, potentially leading to remote code execution (RCE), which is the ability to execute arbitrary commands on the server. **Recommendations** Update Extensions For CF7 to version 3.4.6 or later. Restrict vulnerable form functionality until the update is applied. Block PHP execution in upload directories.

**Name of the Vulnerable Software and Affected Versions** 3D Product configurator for WooCommerce versions prior to 2.16.3 **Description** Remote Code Execution is possible due to missing authentication and nonce checks on the `wp loaded` handler. The issue occurs because the `xpv image` POST parameter is not sanitized before being echoed unescaped into a Dompdf-rendered HTML template with PHP execution enabled. This allows unauthenticated attackers to execute arbitrary code on the server via a single POST request to any URL on the site. **Recommendations** Update to a version newer than 2.16.2. Avoid using the `xpv image` parameter until the software is updated.

**Name of the Vulnerable Software and Affected Versions** YouTube Gallery versions 1.0.0 through 5.7.2 **Description** An unauthenticated SQL injection exists in the video search functionality and the router that maps friendly video URLs to database rows. This flaw allows attackers to inject SQL commands into read queries without requiring authentication. Anyone capable of loading a page containing a gallery can exploit this issue. **Recommendations** Update to version 5.7.3.

**Name of the Vulnerable Software and Affected Versions** miniOrange 2FA WordPress plugin versions prior to 6.3.1 miniOrange 2FA WordPress plugin versions prior to 19.3 **Description** An issue exists where the software does not require a validated transaction before deleting site options. This allows unauthenticated visitors to delete arbitrary options by providing the option names via request input, which can result in administrators being locked out of the dashboard or the plugin being deactivated on the site. **Recommendations** Update miniOrange 2FA WordPress plugin to version 6.3.1 or later. Update miniOrange 2FA WordPress plugin to version 19.3 or later.

The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any support ticket.