Spy0X7

The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter. This is due to missing authentication, capability checks, and nonce verification on the standalone admin.php endpoint, combined with unsanitized injection of POST parameters directly into generated PHP source written to an included file. This makes it possible for unauthenticated attackers to execute code on the server. This is possible because admin.php does not load WordPress and carries no ABSPATH guard, making it a fully unauthenticated entry point regardless of the decorative capability arguments registered via the plugin's simulated menu API.

The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data object Parameter in all versions up to, and including, 2.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by unauthenticated attackers because the cdbbc payment verify AJAX action is registered under wp ajax nopriv and its only authentication gate — a nonce check — is bypassable, as the cdbbc donation box nonce is publicly exposed to anonymous visitors via the wallets data JavaScript object emitted by the [crypto-donation-box] shortcode.

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'current month' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a regression vulnerability — a capability check introduced in versions 2.0.19.11–2.0.19.14 to address CVE-2024-50425 was removed in version 2.1, meaning any authenticated subscriber-level account can reach the vulnerable handler with no nonce validation required.

**Name of the Vulnerable Software and Affected Versions** Printcart Web to Print Product Designer for WooCommerce versions prior to 2.8.6 **Description** This issue involves a Directory Traversal flaw that allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitive information. The flaw is triggered via the `mockups` parameter. Attackers can obtain a valid nonce through the `nbd check use logged in` AJAX endpoint, which provides a `nbdesigner-get-data` nonce to any visitor. Furthermore, the security check is completely bypassed if the `NBDESIGNER ENABLE NONCE` constant is disabled. **Recommendations** Update Printcart Web to Print Product Designer for WooCommerce to version 2.8.6 or later. Restrict access to the `mockups` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Paid Downloads versions prior to 3.16 **Description** The Paid Downloads plugin for WordPress allows unauthenticated arbitrary file upload through the `admin request handler()` function. This occurs because the function lacks proper authorization and file type validation and is accessible via the `/wp-admin/admin-post.php` endpoint. An attacker can upload executable files to achieve remote code execution. The exploitability is limited on Apache servers where AllowOverride is enabled due to potential .htaccess restrictions in the upload directory, but it remains effective on nginx, LiteSpeed, and Apache configurations with AllowOverride None. **Recommendations** Update the plugin to a version newer than 3.15.

**Name of the Vulnerable Software and Affected Versions** Direct Download for WooCommerce versions prior to 1.20 **Description** A Directory Traversal issue exists in the (top-level include) function. This allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitive information. The flaw occurs because the product ownership check only verifies the existence of a free, virtual, downloadable product on the site, rather than confirming that the requested file path is associated with that specific product's downloads. **Recommendations** Update the plugin to version 1.20 or later.

**Name of the Vulnerable Software and Affected Versions** CM Map Locations – Visualize and share your locations in a few clicks versions prior to 2.1.9 **Description** Insufficient file type validation in the upload handler allows authenticated attackers with subscriber-level access and above to perform a limited arbitrary file upload. The issue occurs within the `uploadMedia()` function, which uses incomplete extension filtering and fails to perform MIME-type checks or verify upload capabilities before calling `move uploaded file()`. This can lead to remote code execution if executable files are uploaded. The required nonce is exposed to logged-in subscribers through the `CMLOC Editor Images` JavaScript object on the front-end location editor page. **Recommendations** Update to a version newer than 2.1.8. As a temporary mitigation, restrict access to the front-end location editor page for users with subscriber-level permissions.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** RapiSafe – Secure Multi File Upload for Contact Form 7، الإصدارات الأقدم من 1.0.5 **الوصف** يؤدي عدم كفاية التحقق من صحة مسار الملف في الدالة `handleAjaxRemoveUpload()` إلى تمكين المهاجمين غير المصادق عليهم من حذف ملفات عشوائية على الخادم. قد يؤدي ذلك إلى تنفيذ تعليمات برمجية عن بُعد في حالة حذف ملفات مهمة، مثل `wp-config.php`. يتم الكشف عن الرقم العشوائي (nonce) المطلوب في جافا سكريبت المتاح للجمهور باسم `RSMFCF7Vars.nonce` في أي صفحة من صفحات Contact Form 7 تعرض حقل تحميل RapiSafe، مما يسمح لأي زائر بالحصول عليه. يتضمن الهجوم المعلمتين `rsmfcf7 session` و`file name`. **التوصيات** قم بتحديث RapiSafe – Secure Multi File Upload for Contact Form 7 إلى الإصدار 1.0.5 أو أحدث. كحل مؤقت، قم بتقييد الوصول إلى الدالة `handleAjaxRemoveUpload()` لتقليل مخاطر الاستغلال إلى أدنى حد.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** Demi – One Click Demo Import، وWP Backup & Site Migration، الإصدارات الأقدم من 0.0.8 **الوصف** يمكن لمهاجم غير مصدق عليه حذف مجلدات عشوائية على الخادم بشكل متكرر. يحدث هذا لأن المكون الإضافي يخزن مفتاح التوقيع HMAC ورمز الاستعادة لكل خطوة كملفات dotfiles في مجلد فرعي يمكن الوصول إليه علنًا ضمن مجلد التحميلات في WordPress دون حماية مناسبة. يسمح معالج AJAX `demi restore step` للمتصلين غير المصادق عليهم باستخدام مفتاح التوقيع المكشوف كبديل لفحوصات الصلاحيات القياسية وفحوصات nonce. من خلال استرداد هذا المفتاح، يمكن للمهاجم تزوير مغلف حالة موقّع لتشغيل الدالة `CleanDir::execute()` باستخدام مسار مطلق يقدمه المتصل يفتقر إلى فحوصات قائمة السماح أو توحيد المسار. **التوصيات** قم بالتحديث إلى إصدار أحدث من 0.0.7. كإجراء تخفيفي مؤقت، قم بتقييد الوصول العام إلى الدليل الفرعي للمكوّن الإضافي داخل مجلد «uploads» في WordPress لمنع استرداد مفتاح التوقيع HMAC.