Waris Damkham

An information leakage vulnerability exists in the Endpoint DLP component (epdlpdrv.sys) of Netskope Client for Windows prior to version R141. An internal communication channel used by the user-space hook DLL to pass messages through the kernel driver to the daemon lacked proper token-based message validation, allowing local unprivileged processes to send unauthorized queries. Additionally, a reply buffer used by the port message handler was not properly initialized before returning data, leaking residual kernel pool memory from prior allocations. A local unprivileged attacker could exploit this vulnerability to enumerate DLP configuration and feature flags, extract live session tokens, and read kernel memory fragments from other users' operations.

**Nome do Software Vulnerável e Versões Afetadas** ShopLentor versões anteriores a 3.3.8 **Description** O plugin ShopLentor para WordPress permite a execução arbitrária de funções através do endpoint de API REST 'woolentoropt/v1/custom-action'. O problema ocorre porque o método `handle action()` passa a entrada fornecida pelo usuário para a função `call user func()` sem validá-la em uma lista de permissões de callbacks permitidos. Consequentemente, invasores autenticados com nível de acesso de Administrador ou superior podem executar funções PHP chamáveis arbitrárias manipulando o parâmetro `callback`. **Recommendations** Atualize o ShopLentor para a versão 3.3.8 ou posterior. Como mitigação temporária, restrinja o acesso ao endpoint de API REST 'woolentoropt/v1/custom-action'.

**Nome do Software Vulnerável e Versões Afetadas** TableOn – WordPress Posts Table Filterable versões anteriores a 1.0.5.2 **Descrição** Atacantes não autenticados podem realizar Injeção de SQL cega (blind SQL Injection) através do parâmetro `filter data[comment count]` da ação AJAX pública `tableon get table data`. O problema ocorre porque a entrada fornecida pelo usuário é dividida por dois pontos e interpolada diretamente em uma cláusula SQL `posts where` sem a utilização de conversão `intval()` ou `$wpdb->prepare()`. Isso permite a execução de consultas SQL adicionais para extrair dados sensíveis do banco de dados, como nomes de bancos de dados, nomes de usuário e senhas. **Recomendações** Atualize para uma versão posterior à 1.0.5.1. Como medida paliativa temporária, restrinja o acesso à ação AJAX `tableon get table data` para minimizar o risco de exploração.

Name of the Vulnerable Software and Affected Versions O plugin Quick Playground para WordPress versões até e incluindo 1.3.1 Description O plugin Quick Playground para WordPress é suscetível à Execução Remota de Código devido a verificações de autorização insuficientes em endpoints REST API. Esses endpoints expõem um código de sincronização e permitem o upload arbitrário de arquivos. Isso permite que invasores não autenticados recuperem o código de sincronização, carreguem arquivos PHP usando técnicas de travessia de caminho e, finalmente, alcancem a execução remota de código no servidor. Recommendations Atualize o plugin Quick Playground para uma versão posterior a 1.3.1.

**Name of the Vulnerable Software and Affected Versions** Easy Image Gallery versions prior to 1.5.4 **Description** The Easy Image Gallery plugin for WordPress is susceptible to Stored Cross-Site Scripting through the Gallery shortcode post meta field. Insufficient input sanitization and output escaping of user-supplied gallery shortcode values allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. **Recommendations** Update Easy Image Gallery to version 1.5.4 or later.

**Name of the Vulnerable Software and Affected Versions** Hr Press Lite versions up to and including 1.0.2 **Description** The Hr Press Lite plugin for WordPress has a flaw that allows unauthorized access to sensitive employee data. This is due to a missing capability check on the `hrp-fetch-employees` AJAX action. Attackers with Subscriber-level access or higher can retrieve sensitive employee information, including names, email addresses, phone numbers, salary/pay rates, employment dates, and employment status. The vulnerable component is the `hrp-fetch-employees` AJAX action. **Recommendations** Update Hr Press Lite to a version beyond 1.0.2.

**Name of the Vulnerable Software and Affected Versions** NextGEN Gallery versions prior to 4.0.4 **Description** The NextGEN Gallery plugin for WordPress is susceptible to a Local File Inclusion issue. This affects versions up to and including 4.0.3. The issue is triggered through the `template` parameter within gallery shortcodes. Successful exploitation allows authenticated attackers with Author-level access or higher to include and execute arbitrary .php files on the server. This can lead to bypassing access controls, obtaining sensitive data, or achieving code execution if .php files can be uploaded and included. The vulnerable parameter is `template`. **Recommendations** Update NextGEN Gallery to version 4.0.4 or later.

**Name of the Vulnerable Software and Affected Versions** WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress versions up to and including 4.4.3 **Description** The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is susceptible to SQL Injection via the `search` parameter. Insufficient escaping of user-supplied input and inadequate preparation of existing SQL queries allow unauthenticated attackers to inject additional SQL queries, potentially extracting sensitive information from the database. **Recommendations** Versions prior to 4.4.4 should be updated.

**Name of the Vulnerable Software and Affected Versions** WordPress JS Archive List plugin versions up to and including 6.1.7 **Description** The JS Archive List plugin for WordPress is susceptible to PHP Object Injection through the 'included' shortcode attribute. This occurs because of the deserialization of untrusted input provided through the 'included' parameter of the plugin’s shortcode. Authenticated attackers with Contributor-level access or higher can inject a PHP Object. Currently, no known practical exploitation chain (POP chain) exists within the vulnerable software itself. However, if a POP chain is present through an additional plugin or theme installed on the target system, an attacker could potentially delete arbitrary files, retrieve sensitive data, or execute code. **Recommendations** Update the JS Archive List plugin to a version newer than 6.1.7.

**Name of the Vulnerable Software and Affected Versions** WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation plugin for WordPress versions up to and including 1.4.24 **Description** The WowOptin plugin for WordPress is susceptible to unauthorized arbitrary plugin installation. This is due to a missing capability check within the `install and active plugin` function. Authenticated attackers possessing Subscriber-level access or higher can exploit this to install and activate plugins without authorization. **Recommendations** Versions prior to and including 1.4.24 should be updated.

**Name of the Vulnerable Software and Affected Versions** Envira Gallery for WordPress plugin versions up to and including 1.12.3 **Description** The Envira Gallery for WordPress plugin is susceptible to Stored Cross-Site Scripting through the `justified gallery theme` parameter. Insufficient input sanitization and output escaping allow authenticated attackers with Author-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. **Recommendations** Update Envira Gallery for WordPress plugin to a version later than 1.12.3

**Name of the Vulnerable Software and Affected Versions** Library Management System versions prior to 3.2.2 **Description** The Library Management System plugin for WordPress is susceptible to SQL Injection due to inadequate input validation and query preparation. Specifically, the `bid` parameter is not properly sanitized, allowing attackers to inject malicious SQL code. This can enable unauthenticated attackers to extract sensitive information from the database by appending additional SQL queries to existing ones. **Recommendations** Update the Library Management System plugin to version 3.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** WP Customer Reviews versions prior to 3.7.6 **Description** The WP Customer Reviews plugin for WordPress is susceptible to Reflected Cross-Site Scripting. This is due to inadequate input sanitization and output escaping of the `wpcr3 fname` parameter. An unauthenticated attacker can inject arbitrary web scripts into pages, which will execute if a user is tricked into performing an action, such as clicking a malicious link. **Recommendations** Update WP Customer Reviews to version 3.7.6 or later.

**Nome do Software Vulnerável e Versões Afetadas** Versões do Prodigy Commerce anteriores à 3.2.9 **Descrição** O plugin Prodigy Commerce para WordPress está suscetível a uma vulnerabilidade de Inclusão Local de Arquivos. Isso permite que atacantes não autenticados incluam e leiam arquivos arbitrários ou executem arquivos arbitrários no servidor. A exploração dessa vulnerabilidade pode levar ao contorno de controles de acesso, obtenção de dados sensíveis ou execução de código. A vulnerabilidade deve-se à validação de entrada insuficiente do parâmetro `parameters[template name]`. Isso permite que atacantes incluam e executem código PHP dentro de arquivos enviados. **Recomendações** Versões anteriores à 3.2.9 devem ser atualizadas. Como medida paliativa temporária, considere desativar o plugin Prodigy Commerce até que uma correção esteja disponível. Monitore os uploads de arquivos em busca de conteúdo potencialmente malicioso.

**Name of the Vulnerable Software and Affected Versions** WP Event Aggregator plugin for WordPress versions up to and including 1.8.7 **Description** The WP Event Aggregator plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'wp events' shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. **Recommendations** Update the WP Event Aggregator plugin to a version later than 1.8.7.

**Nome do Software Vulnerável e Versões Afetadas** Plugin midi-Synth para WordPress versões até e incluindo a 1.1.0 **Descrição** O plugin midi-Synth para WordPress está suscetível a uploads de arquivos arbitrários devido à falta de validação de tipo e extensão de arquivo dentro da ação AJAX 'export'. Isso permite que atacantes não autenticados façam upload de arquivos arbitrários para o servidor afetado. A exploração bem-sucedida pode levar à execução remota de código se o atacante puder obter um nonce válido, que está exposto no JavaScript do frontend. **Recomendações** Atualize o plugin midi-Synth para uma versão superior à 1.1.0. Alternativamente, desative o plugin midi-Synth até que uma versão mais recente esteja disponível.

**Name of the Vulnerable Software and Affected Versions** FastDup – Fastest WordPress Migration & Duplicator plugin versions up to 2.7.1 **Description** The FastDup plugin for WordPress is affected by a flaw that allows unauthorized backup creation and download. This is due to a missing capability check on REST API endpoints. Authenticated attackers with Contributor-level access or higher can create and download full-site backup archives, including database exports and configuration files. The affected API endpoints are not explicitly specified, but the issue relates to REST API functionality. The vulnerability allows access to the entire WordPress installation data. **Recommendations** Versions prior to 2.7.1 should be updated to address this issue.

**Name of the Vulnerable Software and Affected Versions** Beaver Builder Page Builder plugin for WordPress versions prior to 2.10.0.6 **Description** The Beaver Builder Page Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to missing capability checks within the `save global settings()` function and insufficient input sanitization and output escaping. Authenticated attackers with Custom-level access or higher, who have been granted Beaver Builder access, can inject arbitrary web scripts into pages. These scripts will execute whenever a user accesses an injected page via the `js` Global Settings parameter. **Recommendations** Update to Beaver Builder Page Builder plugin version 2.10.0.6 or later.

**Name of the Vulnerable Software and Affected Versions** TableMaster for Elementor versions up to and including 1.3.6 **Description** The TableMaster for Elementor plugin for WordPress is susceptible to Server-Side Request Forgery. This occurs because the plugin does not limit the URLs that can be accessed when importing CSV data from a URL using the Data Table widget. Authenticated attackers with Author-level access or higher can make web requests to arbitrary locations, including localhost and internal network services. Sensitive files, such as `wp-config.php`, can be read through the `csv url` parameter. **Recommendations** Update TableMaster for Elementor to a version later than 1.3.6.

**Name of the Vulnerable Software and Affected Versions** LA-Studio Element Kit for Elementor versions through 1.5.6.3 **Description** The LA-Studio Element Kit for Elementor plugin for WordPress is susceptible to unauthorized administrative user creation. This occurs because the `ajax register handle` function does not properly restrict user role assignments during registration. Unauthenticated attackers can exploit this by providing a malicious value for the `lakit bkrole` parameter during the registration process, allowing them to gain administrator access to the site. Reports indicate that approximately 20,000+ WordPress sites globally may be affected. The issue was reportedly introduced by a former employee and allows for full site takeover. The `lakit bkrole` parameter is used in the plugin’s registration handler to manipulate user roles. **Recommendations** Versions through 1.5.6.3 should be updated to version 1.6.0. Audit for rogue administrator users after applying the update.