0Xd4Rk5Id3

The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. An authenticated attacker with Subscriber-level access first poisons the wpfd file metadata['file'] post-meta value via the unprotected file.save handler, after which the streaming endpoint — hooked on init with no authentication requirement — resolves and streams the traversed file path to any caller, including unauthenticated visitors.

**Name of the Vulnerable Software and Affected Versions** WP File Download versions prior to 6.3.5 **Description** Insufficient file path validation in the delete function allows authenticated attackers with subscriber-level access and above to delete arbitrary files on the server. This can lead to remote code execution if critical files like wp-config.php are removed. The exploit occurs in two stages: first, a request to the 'file.save' task persists a path-traversal string into file metadata using the `remoteurl` parameter; second, a request to the 'file.delete' task triggers the unlink call. Both endpoints lack capability checks and nonce enforcement (a security token used to prevent cross-site request forgery). **Recommendations** Update WP File Download to version 6.3.5 or later. As a temporary workaround, restrict access to the 'file.save' and 'file.delete' tasks to prevent unauthorized file manipulation.

**Name of the Vulnerable Software and Affected Versions** Custom User Registration Fields for WooCommerce versions prior to 2.2.4 **Description** An issue allows unauthenticated attackers to elevate their privileges to Administrator. This occurs because the plugin accepts an attacker-controlled `afreg select user role` value from the WooCommerce Store API endpoint '/wc/store/v1/checkout' within the `af reg checkout data to order meta data block()` function. The value is persisted in order meta and subsequently passed to the `WP User::add role()` function in the `af reg custom order processing function()` without being validated against the admin-configured allowed role list. An attacker can exploit this by creating an account during checkout with a modified JSON body specifying the desired role slug. This exploit requires the User Role Selection setting to be enabled. **Recommendations** Update the plugin to a version newer than 2.2.3. Disable the User Role Selection setting as a temporary mitigation measure.

**Name of the Vulnerable Software and Affected Versions** Real Estate Manager Pro versions prior to 12.8.7 **Description** Improper capability handling in the `allow attachment actions()` function allows authenticated attackers with Subscriber-level access or higher to escalate their privileges to Administrator. The issue occurs when the function treats a target user ID as a media attachment ID during capability checks, enabling the modification of an administrator account if the targeted user ID matches the ID of an existing media attachment. **Recommendations** Update Real Estate Manager Pro to a version newer than 12.8.6. As a temporary mitigation, restrict access to user management functions for accounts with Subscriber-level privileges.

**Name of the Vulnerable Software and Affected Versions** Checkout Field Editor for WooCommerce (Pro) versions prior to 3.7.8 **Description** The plugin is subject to Directory Traversal, a flaw that allows an attacker to access files and directories that are stored outside the web root folder. Authenticated users with subscriber-level access or higher can exploit this by manipulating the `thwcfe legacy file` parameter to read arbitrary files on the server, potentially exposing sensitive information. **Recommendations** Update Checkout Field Editor for WooCommerce (Pro) to version 3.7.8 or later. As a temporary mitigation, restrict access to the `thwcfe legacy file` parameter.

**Name of the Vulnerable Software and Affected Versions** Bricksforge versions prior to 3.1.8.7 **Description** The Bricksforge plugin for WordPress contains a privilege escalation flaw. The issue stems from improper validation of the `fieldIds` parameter within the Pro Forms registration action. This allows unauthenticated attackers to add attacker-supplied field IDs to the trusted form-field whitelist. By submitting a crafted request to a publicly accessible Bricksforge Pro Forms registration form, an attacker can register a new administrator account. This exploitation is possible if the site has a public Bricksforge Pro Forms element configured with the User Registration action. **Recommendations** Update to version 3.1.8.7 or later. Restrict public registration forms to minimize the risk of exploitation. Audit administrator accounts for unauthorized entries.

**Name of the Vulnerable Software and Affected Versions** Divi Form Builder versions prior to 5.1.9 **Description** Missing authorization allows authenticated attackers with subscriber-level access or higher to perform a complete account takeover. The issue occurs because the `update user()` function accepts a user ID parameter from form submissions without verifying if the authenticated user has permission to edit that specific account. Additionally, the `handle register submission()` function only checks if a user is logged in rather than validating permissions for the target user. This enables the modification of email addresses and passwords for any account, including administrators. **Recommendations** Update Divi Form Builder to version 5.1.9 or later.

**Name of the Vulnerable Software and Affected Versions** Divi Form Builder versions prior to 5.1.9 **Description** Insufficient file extension validation in the `do image upload()` function allows unauthenticated attackers to perform arbitrary file uploads, leading to Remote Code Execution. The issue occurs because user-supplied input from the `acceptFileTypes` POST parameter is directly interpolated into a regular expression used for validation. Attackers can bypass `.htaccess` protections by using PHP-executable extensions such as `.phtml`, `.phar`, `.php5`, or `.php7`. On Nginx-based servers, the `.htaccess` protection is entirely ineffective. An attacker can obtain a nonce from any public page containing a form to upload executable PHP files to the `/wp-content/uploads/de fb uploads/` directory and execute them via HTTP. **Recommendations** Update Divi Form Builder to version 5.1.9 or later. As a temporary mitigation, restrict access to the `/wp-content/uploads/de fb uploads/` directory to prevent the execution of uploaded files.

**Name of the Vulnerable Software and Affected Versions** Themify Popup versions prior to 1.4.4 **Description** Deserialization of untrusted data in the plugin allows for Object Injection. This occurs when the application deserializes data from an untrusted source without sufficient validation, potentially allowing an attacker to inject malicious PHP objects into the application state. **Recommendations** Update to a version newer than 1.4.3.

**Name of the Vulnerable Software and Affected Versions** Dokan Pro versions prior to 5.0.5 **Description** The plugin contains a privilege escalation flaw within the 'update capabilities' REST endpoint. The `update capabilities()` REST handler fails to implement allowlist validation when processing capability strings from the request body, passing them directly to the `WP User::add cap()` function. This allows authenticated attackers with Vendor-level access or higher, on sites where the Vendor Staff module is active, to assign arbitrary WordPress capabilities, such as administrator privileges, to any `vendor staff` account, potentially resulting in a complete site takeover. **Recommendations** Update to version 5.0.5 or later. Restrict access to the 'update capabilities' REST endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** PrivateContent versions prior to 9.9.2 **Description** An incorrect privilege assignment in LCweb PrivateContent enables privilege escalation, allowing a user to gain higher levels of access than intended. **Recommendations** Update PrivateContent to version 9.9.2 or later.

**Name of the Vulnerable Software and Affected Versions** WP Media folder Addon versions 4.0.1 and earlier **Description** An unauthenticated arbitrary file download issue exists, allowing an attacker to download files from the server without providing credentials. **Recommendations** Update WP Media folder Addon to a version later than 4.0.1.

**Name of the Vulnerable Software and Affected Versions** User Registration Stripe versions prior to 1.3.13 **Description** Unauthenticated broken access control allows unauthorized users to bypass security restrictions within the plugin. **Recommendations** Update to a version later than 1.3.12.

**Name of the Vulnerable Software and Affected Versions** Directorist Booking versions prior to 3.0.2 **Description** Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) allows an attacker to interfere with the queries that an application makes to its database. This can lead to unauthorized access to sensitive data or modification of database records. **Recommendations** Update to version 3.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** Directorist Social Login versions prior to 2.1.4 **Description** Incorrect Privilege Assignment in Directorist Social Login allows for Privilege Escalation, a condition where a user can gain higher levels of access or permissions than intended. **Recommendations** Update to version 2.1.4.

**Name of the Vulnerable Software and Affected Versions** User Registration Stripe versions prior to 1.3.15 **Description** Broken access control allows unauthenticated attackers to perform unauthorized actions due to a missing capability check in a function within the plugin. **Recommendations** Update User Registration Stripe to version 1.3.15 or later.

**Name of the Vulnerable Software and Affected Versions** WishList Member X versions through 3.29.0 **Description** The software contains a flaw related to the deserialization of untrusted data, which allows for object injection. This issue impacts the application's ability to securely handle incoming data, potentially leading to unauthorized access or control. **Recommendations** Versions prior to 3.29.0 should be updated. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cozmoslabs Profile Builder Pro versions through 3.13.9 **Description** The software contains an Improper Neutralization of Special Elements used in an SQL Command issue, also known as a SQL Injection. This allows for Blind SQL Injection. The issue affects the application and could allow attackers to execute malicious SQL queries. No information is available regarding the number of potentially affected devices or real-world incidents. The vulnerability allows attackers to execute Blind SQL Injection. The vulnerable component is susceptible to exploitation via crafted SQL commands. **Recommendations** Update to version 3.14 to address the issue.

**Name of the Vulnerable Software and Affected Versions** Jordy Meow AI Engine versions through 3.3.2 **Description** The software contains an unrestricted file upload issue that allows the use of malicious files. The vulnerability involves the ability to upload files of dangerous types. **Recommendations** Update to a version later than 3.3.2.

**Name of the Vulnerable Software and Affected Versions** blazethemes News Kit Elementor Addons versions through 1.4.2 **Description** An issue exists in blazethemes News Kit Elementor Addons where incorrectly configured access control security levels can be exploited, leading to a missing authorization condition. **Recommendations** Update blazethemes News Kit Elementor Addons to a version later than 1.4.2.