Pedro Pinho

The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and brute-force the short numeric login code to take over an account without its password.

The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge payment-confirmation notifications and record arbitrary donations as completed, with attacker-chosen amounts, donor names and messages.

The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with editor-level access and above can perform SQL injection and read arbitrary information from the database. On multisite a sub-site editor can read the network-global users table, including the super administrator's password hash.

The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator.

The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not properly restrict access to guest-submitted quotes, allowing unauthenticated users to retrieve another guest's quote, including the buyer's name, email address and requested line items, by supplying an enumerable identifier.

The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment provider when no webhook secret has been configured, allowing unauthenticated attackers to forge one and mark orders as paid without paying.

**Name of the Vulnerable Software and Affected Versions** Track Orders for WooCommerce versions prior to 1.2.7 **Description** An issue exists where the plugin fails to verify order ownership before returning billing details. This allows unauthenticated attackers to obtain a customer's name, email address, phone number, postal address, and order history by providing the customer's email address. **Recommendations** Update to version 1.2.7 or later.

**Name of the Vulnerable Software and Affected Versions** UPI QR Code Payment Gateway WordPress plugin versions prior to 1.4.4 **Description** The plugin fails to verify if a payment-confirmation request is legitimately associated with the order and customer it intends to confirm. This allows unauthenticated attackers to mark any arbitrary order as paid without completing an actual transaction. **Recommendations** Update the plugin to version 1.4.4 or later.

**Name of the Vulnerable Software and Affected Versions** TillKit WordPress plugin versions prior to 1.0.5 **Description** The plugin creates a privileged POS account upon activation that uses a hard-coded, publicly known PIN. The system does not require this PIN to be changed before use and authenticates the public POS login endpoint based solely on this PIN without performing identity or capability checks. This allows unauthenticated attackers to obtain a privileged POS session to read personal data of customers and site users, as well as modify store data. **Recommendations** Update TillKit WordPress plugin to version 1.0.5 or later.

**Name of the Vulnerable Software and Affected Versions** Post Grid Gutenberg Blocks versions prior to 5.0.41 **Description** An issue exists where the plugin fails to perform authorization or post-visibility checks on a REST API route. This allows unauthenticated users to disclose the custom field key names of arbitrary posts, including those that are private, draft, pending, scheduled, or password-protected. **Recommendations** Update Post Grid Gutenberg Blocks to version 5.0.41 or later.

**Name of the Vulnerable Software and Affected Versions** SUMIT Payment Gateway for WooCommerce WordPress plugin versions prior to 4.0.0 **Description** The plugin fails to verify the authenticity of payment notifications with the payment provider before marking an order as paid. This allows unauthenticated users to mark pending orders as paid without actually completing the payment process. **Recommendations** Update the SUMIT Payment Gateway for WooCommerce WordPress plugin to version 4.0.0 or later.

**Name of the Vulnerable Software and Affected Versions** UsersWP versions prior to 1.5.10 **Description** An issue exists where the plugin fails to verify if a social login provider has confirmed ownership of an email address before using it to resolve an existing account. This allows unauthenticated attackers to perform an account takeover and log in as any user, including administrators, by asserting the target email address through a social provider account they control. **Recommendations** Update to version 1.5.10 or later.

**Name of the Vulnerable Software and Affected Versions** UpsellWP versions prior to 2.2.10 **Description** The UpsellWP WordPress plugin fails to verify if products added to the cart via a Frequently Bought Together campaign are actually part of that specific campaign. This allows unauthenticated users to manipulate the pricing and purchase arbitrary products at the discounted rate associated with the campaign. **Recommendations** Update to version 2.2.10 or later.

**Name of the Vulnerable Software and Affected Versions** Motors WordPress plugin versions prior to 1.4.121 **Description** An authorization bypass exists that allows unauthenticated attackers to access non-published car listings, including those in draft, pending, and private status. By providing a target's numeric `user id`, an attacker can retrieve sensitive information such as titles, prices, media URLs, and seller notes. **Recommendations** Update Motors WordPress plugin to version 1.4.121 or later.

**Name of the Vulnerable Software and Affected Versions** Robokassa payment gateway for Woocommerce WordPress plugin versions prior to 1.8.9 **Description** The plugin fails to verify the authenticity of incoming payment notifications when the non-default deferred-payment feature is enabled. This allows unauthenticated attackers to forge notifications and mark arbitrary WooCommerce orders as paid or on-hold without providing a valid signature or completing the payment. **Recommendations** Update the Robokassa payment gateway for Woocommerce WordPress plugin to version 1.8.9 or later. As a temporary mitigation, disable the deferred-payment feature.

**Name of the Vulnerable Software and Affected Versions** Rox Appointment Booking WordPress plugin versions prior to 1.2.8 **Description** The plugin fails to perform authorization checks on the endpoint used to retrieve booking agent records. This allows unauthenticated attackers to access sensitive staff information, including email addresses, phone numbers, private internal notes, and the linked WordPress account names for all agents. **Recommendations** Update the plugin to version 1.2.8 or later.

**Name of the Vulnerable Software and Affected Versions** CryptoPayment Gateway versions 1.2.1 through 1.2.2 **Description** The plugin fails to apply an authorization check on an AJAX endpoint. This allows unauthenticated users to perform administrative operations, such as deleting arbitrary files on the server, overwriting the payment gateway configuration, and recovering stored wallet credentials in cleartext. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Booking for Appointments and Events Calendar versions prior to 9.8.1 **Description** The plugin fails to verify if a payment was successfully processed before marking a booking as paid. It trusts the payment gateway specified in a public, unauthenticated booking request, even if that gateway has not been configured on the site. This allows an unauthenticated attacker to secure confirmed and fully paid appointments or events without making any payment. **Recommendations** Update to version 9.8.1 or later.

**Name of the Vulnerable Software and Affected Versions** Rox Appointment Booking versions prior to 1.2.0 **Description** The plugin fails to perform capability or authorization checks when saving the holiday schedule. This allows unauthenticated attackers to overwrite dates treated as unavailable by the booking system, potentially blocking legitimate bookings or opening dates intended to remain closed. **Recommendations** Update to version 1.2.0 or later.

**Name of the Vulnerable Software and Affected Versions** WPBot versions prior to 8.5.7 **Description** The plugin fails to perform authorization or nonce checks on several AJAX actions used to relay prompts to configured AI providers. This allows unauthenticated attackers to trigger third-party API calls using the site's configured API keys, leading to unauthorized consumption of the associated costs. **Recommendations** Update WPBot to version 8.5.7 or later.