Supakiad S

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb add meta to user on activation()` function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to `WP User::set role()` with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name `role` to persist and bridge attacker-controlled request input into the serialized signup record stored in `wp signups`. This makes it possible for unauthenticated attackers to gain a fully activated WordPress administrator account by submitting `role=administrator` through the public `[wppb-register]` shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy form field with meta-name `role` carried over from before the 4.0.3 upgrade, email confirmation enabled, and open user registration — all stable site-state conditions once established.

The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update cc details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via `api call('update cc details', ...)` before performing the local `username exists()` collision check, and aborts without rolling back the remote rename when a collision is detected — leaving the remote ONTRAPORT contact renamed to an existing WordPress Administrator's login. On a subsequent login attempt, `user login()` (hooked to `wp authenticate`) authenticates against ONTRAPORT using the renamed login and the attacker's own password, resolves the local WordPress user row via `get user by('login', $username)` — which now selects the real Administrator's row — and calls `wp set password()` against that Administrator's user ID; because the `user level != 10` guard only suppresses PilotPress's own cookie issuance rather than returning a `WP Error` to core, WordPress proceeds to validate the newly-synchronized password and issues a full Administrator authentication cookie to the attacker. This makes it possible for authenticated attackers with Subscriber-level access and above — specifically any PilotPress member holding a valid ONTRAPORT contact and the Customer Center nonce — to fully take over an Administrator account.

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy file function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales Representative-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by any user holding the plugin-defined import contacts capability, which is granted by default to the plugin's custom Sales Representative role.

The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that an administrator has enabled the "Allow edition in frontend?" option on at least one calendar view, which exposes the unauthenticated add endpoint and a publicly accessible nonce.

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.2.1 via the 'password' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to change the WordPress account password of any customer who has placed at least one order with the attacking vendor, enabling login as that customer and resulting in a limited account takeover. Vendor-level access, required to exploit this vulnerability, can be self-registered through the public 'I am a vendor' registration flow when that option is enabled on the site.

The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary business directory listings, including those owned by other users and posts in publish, draft, or private status. The nonces guarding the endpoint do not constitute an authorization barrier because both directorist nonce and atbdp nonce js are exposed to all logged-in users via wp localize script.

The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. This is due to the startSession() function accepting an empty jtlauth parameter as a valid credential, combined with insufficient file type validation in handleImagePush(). This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection fires during identity linking, before ProductController::push() executes, meaning exploitation succeeds even if downstream product handling would otherwise reject the request.

**Name of the Vulnerable Software and Affected Versions** LatePoint | Calendar & Scheduling for WordPress versions prior to 5.7.3 **Description** An Insecure Direct Object Reference (IDOR) and missing authorization issue exists in the LatePoint plugin. The publicly accessible endpoints 'steps start' and 'steps load step' accept a `params[presets][order item id]` value that is integrated into the booking object without verifying if the order item belongs to the current customer, is a bundle item, is paid, or has remaining capacity. The `is bundle scheduling()` function fails to properly validate the bundle, performing only a basic truthiness check on the `order item id`. This allows unauthenticated attackers to create approved appointments using other customers' order items and access sensitive information, including customer names, email addresses, and order codes, via the booking confirmation. **Recommendations** Update to a version newer than 5.7.2. Restrict access to the 'steps start' and 'steps load step' endpoints to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** FV Player 8 versions prior to 8.1.8 **Description** Insufficient file type validation in the `check mimetype()` function allows authenticated users with subscriber-level access and above to perform an arbitrary file upload. The issue occurs because the function writes remote file content to the public uploads directory before performing MIME or extension checks, and lacks a capability check during new player creation. By exploiting a race condition, an attacker can upload executable files to achieve remote code execution. **Recommendations** Update FV Player 8 to version 8.1.8 or later. As a temporary mitigation, restrict access to the `check mimetype()` function or limit user permissions to prevent subscriber-level accounts from creating new players.

**Name of the Vulnerable Software and Affected Versions** FooSales – Point of Sale (POS) for WooCommerce versions prior to 1.43.1 **Description** This issue allows privilege escalation via account takeover. The plugin fails to properly validate a user's identity before updating account details, such as the email address. Authenticated attackers with FooSales Cashier-level access or higher can change the email addresses of arbitrary users, including administrators, and subsequently reset those passwords to gain full account access. **Recommendations** Update FooSales – Point of Sale (POS) for WooCommerce to version 1.43.1 or later.

**Name of the Vulnerable Software and Affected Versions** GamiPress – Gamification plugin for WordPress versions prior to 7.9.5 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts via the `video id` parameter. These scripts execute whenever a user accesses the affected page. **Recommendations** Update GamiPress – Gamification plugin for WordPress to version 7.9.5 or later. Avoid using the `video id` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** rtMedia for WordPress, BuddyPress and bbPress versions prior to 4.7.14 **Description** Insufficient file path validation in the `process()` function allows unauthenticated attackers to delete arbitrary safe files on the server. This is possible because the public nonce `rtmedia upload nonce` is emitted into frontend JavaScript on any page rendering the rtMedia gallery or upload shortcode, allowing it to be retrieved by visitors without authentication. **Recommendations** Update rtMedia for WordPress, BuddyPress and bbPress to version 4.7.14 or later.

**Name of the Vulnerable Software and Affected Versions** Groundhogg — CRM, Newsletters, and Marketing Automation versions prior to 5.0 **Description** Privilege escalation is possible through contact identity rebinding. The `create contact` function in the `POST /gh/v3/contacts` endpoint is only protected by the `add contacts` capability and forwards the entire request payload, including the `user id` variable, to the `Contacts DB::add()` function. This process bypasses the ownership guard used in `Contacts DB::update()`, allowing authenticated users with Sales Representative-level access or higher to rebind a contact record to an Administrator's user ID. Subsequently, an attacker can use the `POST /gh/v4/emails/test` endpoint, which is accessible via the `send emails` capability, to generate an `{auto login url}`. This one-time permissions key allows the attacker to call `wp set auth cookie()` and obtain a fully authenticated session as a WordPress Administrator. **Recommendations** Update Groundhogg — CRM, Newsletters, and Marketing Automation to version 5.0 or later.

**Name of the Vulnerable Software and Affected Versions** WPMobile.App – Android and iOS App Builder versions prior to 11.83 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to exfiltrate password-reset URLs for any user, including administrators. The issue occurs when the mail-to-push feature is enabled via the `wpmobile auto mail=1` setting, which causes outbound WordPress password-reset emails to be mirrored into the push row queue, making the reset URLs and keys accessible to attackers for account takeover. **Recommendations** Update to a version later than 11.82. Disable the mail-to-push feature by setting `wpmobile auto mail` to 0 to prevent the mirroring of password-reset emails into the push queue.

**Name of the Vulnerable Software and Affected Versions** WPFunnels versions prior to 3.13.2 **Description** The software contains an Insecure Direct Object Reference (IDOR), a condition where an application provides direct access to objects based on user-supplied input, allowing unauthenticated users to access or manipulate data they are not authorized to view. **Recommendations** Update to a version newer than 3.13.1.

Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation <= 5.9.3 versions.

Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions.

Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.

**Name of the Vulnerable Software and Affected Versions** miniOrange OTP Login, Verification and SMS Notifications versions prior to 5.5.6 **Description** An authentication bypass exists when the `mo wp login intent` parameter is used. The issue occurs within the `mo by pass login()` function, specifically in the `skip pass fallback-enabled` configuration branch, where a missing password-intent guard allows administrator role membership to be treated as sufficient authentication. When an unauthenticated user submits the `mo wp login intent` parameter with the value `otp`, the `mo get user()` function skips the `wp authenticate username password()` process and resolves a user based solely on a username lookup. This allows an attacker to log in as any administrator by providing a known username and an empty password. This behavior is conditional on the site administrator having enabled the WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass options. **Recommendations** Update the plugin to a version newer than 5.5.5. As a temporary mitigation, disable the Admin OTP Bypass option or the Login with Only OTP setting to prevent the authentication bypass.