Usama Arshad

The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any listing.

The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the private activity logs of all users. This is an incomplete fix of CVE-2026-13450.

**اسم البرنامج المصاب والإصدارات المتأثرة** WP-Invoice الإصدارات السابقة لـ 4.3.2 **الوصف** تفشل العديد من معالجات AJAX في الإضافة في إجراء فحوصات الصلاحيات. يسمح هذا لأي مستخدم مصادق عليه، بما في ذلك أولئك الذين لديهم صلاحيات مشترك، باسترداد معلومات تحديد الهوية الشخصية (PII) لجميع المستخدمين المسجلين، وتحديداً عناوين البريد الإلكتروني وأسماء العرض وتفاصيل الملف الشخصي. **التوصيات** تحديث WP-Invoice إلى الإصدار 4.3.2 أو إصدار أحدث.

**Name of the Vulnerable Software and Affected Versions** SendPress Newsletters WordPress plugin versions prior to 1.26.1.21 **Description** The plugin uses a hardcoded token that is identical across all installations to protect a logging endpoint. Because this token is not a per-site secret, unauthenticated users can access the endpoint to read newsletter sending logs, which may expose recipient email addresses. **Recommendations** Update the SendPress Newsletters WordPress plugin to version 1.26.1.21 or later.

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind authentication.

The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on before returning that user's email address, allowing any authenticated user, such as a Subscriber, to obtain the email address of any registered account, including administrators.

**Name of the Vulnerable Software and Affected Versions** The Pie Register WordPress plugin versions prior to 3.8.4.14 **Description** The plugin fails to restrict access to an invitation-code report. This allows unauthenticated visitors who possess a valid invitation code to retrieve the usernames and email addresses of all users who registered using that specific code. **Recommendations** Update The Pie Register WordPress plugin to version 3.8.4.14 or later.

**Name of the Vulnerable Software and Affected Versions** Connections Business Directory WordPress plugin versions prior to 10.4.68 **Description** Certain REST API read endpoints fail to apply visibility and moderation-status restrictions. This allows unauthenticated attackers to retrieve directory entries marked as private, unlisted, or pending moderation. Exposed data may include entry names, organizations, biographies, internal notes, and street addresses. **Recommendations** Remove the plugin. Restrict unauthenticated access to the REST API routes.

**Name of the Vulnerable Software and Affected Versions** Optima Express IDX WordPress plugin versions prior to 8.7.6 **Description** Stored Cross-Site Scripting occurs because the plugin fails to properly neutralize script values submitted through a REST endpoint. These values are stored and subsequently echoed into the document head when a post is rendered, allowing users with author-level permissions to execute malicious scripts. **Recommendations** Update the plugin to version 8.7.6 or later.

**Name of the Vulnerable Software and Affected Versions** wpForo Forum WordPress plugin versions 3.0.0 through 3.1.5 **Description** The plugin fails to verify the source of client-supplied IP address headers used to key the per-visitor rate limit for paid AI requests. This allows unauthenticated attackers to bypass the rate limit by spoofing the header, which can lead to the exhaustion of the site owner's metered AI credits. **Recommendations** Update wpForo Forum WordPress plugin to version 3.1.6 or later.

**Name of the Vulnerable Software and Affected Versions** Masteriyo LMS versions prior to 3.4.2 **Description** An issue exists where access to quiz answer keys is not properly restricted. This allows any authenticated user, including students, to retrieve correct answers for any quiz on the site, regardless of whether they are enrolled in the associated course. The system only redacts answers for a specific list of question types, meaning answers for all other types are returned in full to any user capable of viewing the questions. **Recommendations** Update Masteriyo LMS to version 3.4.2 or later.

**Name of the Vulnerable Software and Affected Versions** The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions prior to 8.9.5 **Description** An unrestricted REST endpoint allows unauthenticated attackers to access and read private contact details of registered users. **Recommendations** Update the plugin to version 8.9.5 or later.

**Name of the Vulnerable Software and Affected Versions** Email Subscribers & Newsletters WordPress plugin versions prior to 5.9.35 **Description** The plugin fails to verify the per-subscriber management token when modifying a subscriber's subscription status. This allows unauthenticated users to force-unsubscribe or force-confirm any subscriber if the attacker knows the target's email address. **Recommendations** Update the plugin to version 5.9.35 or later.

**Name of the Vulnerable Software and Affected Versions** RestroPress WordPress plugin versions prior to 3.4.6 **Description** Insufficient server-side validation of client-supplied item add-on prices occurs when items are added to or updated in the cart. This allows unauthenticated users to manipulate the price of add-ons, enabling them to place orders with an arbitrary total, including zero. **Recommendations** Update RestroPress WordPress plugin to version 3.4.6 or later.

**Name of the Vulnerable Software and Affected Versions** RestroPress versions prior to 3.4.7 **Description** The payment-recovery flow fails to verify ownership before processing a request-supplied order identifier. This allows unauthenticated attackers to identify which orders are in a recoverable state and add notes to orders belonging to other customers. **Recommendations** Update to a version newer than 3.4.6.

**Name of the Vulnerable Software and Affected Versions** Event Booking Manager for WooCommerce versions prior to 5.3.8 **Description** The plugin fails to perform ownership or authorization checks before rendering booking confirmation details. This allows unauthenticated attackers to retrieve personal information of registered attendees, including full names, email addresses, phone numbers, and custom registration fields, by providing an enumerable booking reference. This issue only affects sites configured to use the native (non-WooCommerce) checkout, which is not the default setting. **Recommendations** Update to version 5.3.8 or later.

**Name of the Vulnerable Software and Affected Versions** FluentBoards WordPress plugin versions prior to 2.0.15 **Description** An authorization bypass exists when the plugin returns the list of boards associated with a user. This allows any authenticated user, such as a Subscriber without board access, to disclose private board memberships of other users by referencing their `user ID`. **Recommendations** Update FluentBoards WordPress plugin to version 2.0.15 or later.

**Name of the Vulnerable Software and Affected Versions** Sprout Invoices WordPress plugin versions prior to 20.8.16 **Description** An issue exists where the software fails to perform capability or ownership checks before allowing a private note to be overwritten via an AJAX action. This allows any authenticated user, including those with subscriber-level privileges, to overwrite private notes on records belonging to other users through the `si edit private note` action. **Recommendations** Update the Sprout Invoices WordPress plugin to version 20.8.16 or later.

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9, the live redemption code, which anyone holding it can spend. Versions from 3.0.3 to 3.2.8 disclose the same data without the redemption code.

**Name of the Vulnerable Software and Affected Versions** Accept Stripe Payments WordPress plugin versions prior to 2.1.4 **Description** An open redirect issue exists due to insufficient validation of a user-supplied URL used during a redirect. This allows unauthenticated attackers to redirect visitors to arbitrary external websites, which can be utilized for phishing attacks. **Recommendations** Update the plugin to version 2.1.4 or later.