Ryan Fabella

The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded visitor's IP address, user agent and referer.

The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount, allowing unauthenticated attackers to forge a payment confirmation and mark arbitrary orders as paid without paying.

The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain values from a request, allowing unauthenticated users to inject HTML and links that are rendered to visitors on the storefront.

The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns from the hosted payment page, nor bind that response to the targeted order or check the amount, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made, and to retrieve order and customer details.

The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding one valid transaction identifier from a payment of their own to mark arbitrary pending orders as paid.

**Name of the Vulnerable Software and Affected Versions** Frontend Dashboard versions prior to 3.0.5 **Description** This issue occurs because the plugin fails to perform authorization or nonce checks on actions available to unauthenticated users. This allows an attacker to call an arbitrary PHP function or class method using request data, which can lead to the takeover of any account, including those with administrator privileges. A nonce is a unique token used to protect against cross-site request forgery (CSRF) by ensuring that a request was intentionally sent by the user. **Recommendations** Update to version 3.0.5 or later.

**Name of the Vulnerable Software and Affected Versions** Yaad Sarig Payment Gateway For WC WordPress versions prior to 2.2.13 **Description** Insufficient authorization verification in several order payment-processing actions allows any authenticated user, including those with subscriber roles, to act on and modify orders belonging to other customers. **Recommendations** Update Yaad Sarig Payment Gateway For WC WordPress to version 2.2.13 or later.

**Name of the Vulnerable Software and Affected Versions** CP Media Player versions prior to 1.3.4 **Description** The plugin fails to perform a capability check on its settings-page handler. This allows users with Contributor-level access to create, modify, duplicate, and delete site-wide media player configurations, as well as change options that should be restricted to administrator access. **Recommendations** Update to version 1.3.4 or later.

The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a profile update, allowing any authenticated user, such as a subscriber, to grant themselves the Administrator role.

**Name of the Vulnerable Software and Affected Versions** InPost PL WordPress plugin versions prior to 1.9.8 **Description** The plugin fails to verify the authenticity of incoming shipment webhook requests. It relies on a non-secret identifier and an IP check that is not enforced. This allows unauthenticated attackers who possess a target order's parcel tracking number to forge the shipment status and prematurely mark the order as completed. **Recommendations** Update the InPost PL WordPress plugin to version 1.9.8 or later.

**Name of the Vulnerable Software and Affected Versions** Paymob for WooCommerce WordPress plugin versions prior to 4.1.14 **Description** Insufficient capability checks on several admin AJAX actions used to manage payment-gateway configuration allow users with contributor-level access to delete, wipe, or modify the configuration, including stored payment credentials. **Recommendations** Update the plugin to version 4.1.14 or later.

**Name of the Vulnerable Software and Affected Versions** Ni WooCommerce Sales Report versions prior to 4.2.0 **Description** One of the report-printing routines lacks authentication and authorization checks. This allows unauthenticated users to retrieve WooCommerce order details and customer contact information, target specific individual orders, and search store orders using customer names or email addresses. **Recommendations** Update Ni WooCommerce Sales Report to version 4.2.0 or later.

The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات «Login & Register Forms» الأقدم من 4.0.2 **الوصف** عند تمكين وضع إعادة تعيين رمز التحقق، يفشل المكون الإضافي في فرض حدود محاولات إعادة تعيين كلمة المرور باستخدام قيمة مستمدة من الخادم. وبدلاً من ذلك، يعتمد المكون الإضافي على البيانات التي يتحكم فيها العميل لكل من رمز التحقق وعداد المحاولات لكل مصدر. وهذا يسمح للمهاجمين غير المصادق عليهم بإعادة تعيين حد المحاولات واستخدام الهجوم بالقوة الغاشمة على رمز التحقق للاستيلاء على أي حساب، بما في ذلك الحسابات التي تتمتع بامتيازات المسؤول. **التوصيات** تحديث «نماذج تسجيل الدخول والتسجيل» إلى الإصدار 4.0.2 أو أحدث.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات برنامج Podlove Podcast Publisher الأقدم من 4.5.3 **الوصف** تحدث مشكلة تزوير الطلبات عبر المواقع (CSRF) بسبب فشل المكون الإضافي في إجراء التحقق من صحة الرقم العشوائي (nonce) — وهي آلية أمان تُستخدم للحماية من الطلبات المزورة — عند تنفيذ بعض الإجراءات الإدارية المتعلقة بالإنشاء والحذف. وهذا يسمح للمهاجم بخداع مسؤول مسجل الدخول لزيارة صفحة مصممة خصيصًا، مما قد يؤدي إلى إنشاء سجلات مزيفة أو حذف سجلات شرعية. **التوصيات** قم بتحديث Podlove Podcast Publisher إلى الإصدار 4.5.3 أو أحدث.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات المكون الإضافي MultiVendorX لـ WordPress الأقدم من الإصدار 5.0.11 **الوصف** توجد مشكلة تتمثل في فشل المكون الإضافي في التحقق مما إذا كان المتجر المطلوب ينتمي إلى المستخدم الحالي ضمن نقطة نهاية واجهة برمجة تطبيقات REST. وهذا يسمح لأي مستخدم يتمتع بامتيازات على مستوى البائع بالوصول إلى بيانات العمولات والبيانات المالية الخاصة بالبائعين الآخرين وقراءتها. **التوصيات** قم بتحديث المكون الإضافي MultiVendorX لـ WordPress إلى الإصدار 5.0.11 أو أحدث.