T4G0

**Name of the Vulnerable Software and Affected Versions** WP File Download versions prior to 6.4.0 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can permanently delete any file managed by the plugin, empty the trash, move files between categories, and publish or unpublish arbitrary files. **Recommendations** Update WP File Download to version 6.4.0 or later.

**Name of the Vulnerable Software and Affected Versions** Request a Quote for WooCommerce versions prior to 2.9.3 **Description** An arbitrary file upload issue exists in the `afrfq submit quote via popup()` function. The popup upload handler fails to validate file extensions and MIME types, using the raw filename provided by the user as the destination for the `move uploaded file()` function. This allows unauthenticated attackers to upload executable files, such as PHP files, to a web-accessible temporary RFQ upload directory when a public quote rule with the multi-page popup flow is enabled. The issue is triggered via the `admin-ajax` endpoint. **Recommendations** Update Request a Quote for WooCommerce to version 2.9.3 or later. As a temporary mitigation, disable public quote rules that utilize the multi-page popup flow.

**Name of the Vulnerable Software and Affected Versions** Mstore Api plugin for WordPress versions prior to 4.20.1 **Description** An authentication bypass exists due to JWT (JSON Web Token) forgery. The issue occurs in the `FirebasePhoneAuthHelper::verify id token()` function, which validates token claims such as `alg`, `kid`, `aud`, and `iss` but fails to perform cryptographic signature verification using `openssl verify()` or an equivalent method against Google's public key certificates. This allows unauthenticated attackers to use a self-generated RSA key pair to forge a Firebase Phone Auth JWT and impersonate any phone number, leading to unauthorized access to existing accounts or the creation of arbitrary new accounts. **Recommendations** Update the Mstore Api plugin for WordPress to a version newer than 4.20.0.