Vuxvinh

The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead deriving them from a value hardcoded in the Salon Booking System WordPress plugin before 10.31.9 and the second at which a token was issued. An attacker able to constrain when a staff or administrator token was issued can compute a valid token and access the booking API as that user, including an administrator.

**Name of the Vulnerable Software and Affected Versions** Tutor LMS versions prior to 4.1.1 **Description** The plugin fails to verify if the posts specified in course content ordering requests belong to a course managed by the requester. This allows users with instructor-level access to perform an Insecure Direct Object Reference (IDOR)—a flaw where an application provides direct access to objects based on user-supplied input—to reassign the parent of any post on the site. Consequently, an attacker can move course content from other instructors into their own courses or make arbitrary published content unreachable. **Recommendations** Update to version 4.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Booking Calendar WordPress plugin versions prior to 11.8.3 **Description** An issue exists where a settings handler does not adequately restrict the options that lower-privileged users can load. This allows users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site configuration. **Recommendations** Update Booking Calendar WordPress plugin to version 11.8.3 or later.

The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site sends.

**Name of the Vulnerable Software and Affected Versions** MetForm WordPress plugin versions prior to 4.3.1 **Description** When the HubSpot Forms integration is enabled, the plugin fails to properly restrict access to a debug file created in the web root during every form submission. This allows unauthenticated attackers to read upstream API response data, which may include cookies and correlation identifiers. **Recommendations** Update the plugin to version 4.3.1 or later.

**Name of the Vulnerable Software and Affected Versions** Bookly WordPress plugin versions prior to 28.3 **Description** Insufficient server-side validation of client-supplied booking quantity values allows unauthenticated users to manipulate the appointment total. By reducing the total to zero, an attacker can book paid services for free and bypass the payment process. **Recommendations** Update Bookly WordPress plugin to version 28.3 or later.

**Name of the Vulnerable Software and Affected Versions** MasterStudy LMS WordPress Plugin versions prior to 3.7.50 **Description** The plugin fails to verify if user registration is enabled on the site before processing account creation through its front-end registration flows. This allows unauthenticated users to create accounts and log into them, even on sites where registration has been intentionally disabled. **Recommendations** Update the plugin to version 3.7.50 or later.

**Name of the Vulnerable Software and Affected Versions** MasterStudy LMS WordPress Plugin versions prior to 3.7.50 **Description** An issue exists where the plugin fails to perform capability or nonce checks on an administrative maintenance action. A nonce is a unique token used to protect against cross-site request forgery. This flaw allows any authenticated user, including those with subscriber-level privileges, to trigger the action and create published content on the site attributed to their own account. **Recommendations** Update MasterStudy LMS WordPress Plugin to version 3.7.50 or later.

**Name of the Vulnerable Software and Affected Versions** Forminator Forms WordPress plugin versions prior to 1.57.2.1 **Description** The plugin fails to bind saved-draft notifications to the visitor who created the draft. It accepts both the recipient address and the link included in the message directly from the request. This allows unauthenticated visitors to force the site to send messages from its own mail configuration to any arbitrary address, including a link of the attacker's choice within the site's template. Additionally, the authorization token for sending is provided to the anonymous caller by the plugin and can be replayed without limit. **Recommendations** Update Forminator Forms WordPress plugin to version 1.57.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** FluentBoards WordPress plugin versions prior to 2.1.0 **Description** The public, token-shared board feature fails to properly restrict the member data it returns. This allows unauthenticated users to disclose the email addresses of members belonging to a shared board, which often includes site administrators. **Recommendations** Update FluentBoards WordPress plugin to version 2.1.0 or later.

**Name of the Vulnerable Software and Affected Versions** Paid Membership Subscriptions versions prior to 3.1.0 **Description** An issue exists where an unauthenticated payment action is not bound to the requesting user. This allows an attacker who possesses another member's in-flight payment identifier to delete that member's checkout state. **Recommendations** Update Paid Membership Subscriptions to version 3.1.0 or later.

The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry. Unauthenticated visitors can therefore vote without limit on any poll and can choose the address stored against every submission they make.

**Name of the Vulnerable Software and Affected Versions** WP OAuth Server ( Login with WordPress ) versions prior to 6.4.0 **Description** The plugin fails to bind the OpenID Connect identity assertion to the authorization grant being exchanged. Instead, it returns the assertion of the most recently authenticated user. This allows users with the Subscriber role or higher to obtain a signed identity assertion for another user, such as an administrator, enabling them to authenticate as that user on any application utilizing the site for single sign-on. **Recommendations** Update WP OAuth Server ( Login with WordPress ) to version 6.4.0 or later.

**Name of the Vulnerable Software and Affected Versions** Online Scheduling and Appointment Booking System WordPress plugin versions prior to 28.2 **Description** The plugin fails to verify if the requester is the owner of the AI booking-assistant conversation during unauthenticated conversation actions. This allows an unauthenticated visitor to read messages from other visitors' assistant conversations and inject messages into active conversations. **Recommendations** Update the Online Scheduling and Appointment Booking System WordPress plugin to version 28.2 or later.

**Name of the Vulnerable Software and Affected Versions** LearnPress WordPress plugin versions prior to 4.4.7 **Description** An issue exists in an administrative course tool where the software fails to verify user capabilities. This allows unauthenticated attackers to list the display names and user identifiers of all students enrolled in a course. Additionally, attackers can retrieve student email addresses using the search filter of the same handler. **Recommendations** Update LearnPress WordPress plugin to version 4.4.7 or later.

The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing several board-management operations, checking only board membership. This allows any member of a board to carry out manager-only actions on it, including adding or removing members and enabling public access to a private board.

**Name of the Vulnerable Software and Affected Versions** FluentBoards WordPress plugin versions prior to 2.0.15 **Description** Insufficient verification occurs when a board member submits a comment, as the plugin fails to confirm if the submitter is the actual user to whom the comment is attributed. This allows any board member to impersonate other users, including administrators, by posting comments that appear to be authored by them. **Recommendations** Update FluentBoards WordPress plugin to version 2.0.15 or later.