0Xd4Rk5Id3

This issue involves PHP Object Injection caused by the deserialization of untrusted input. Authenticated users with Subscriber-level access or higher can inject a PHP Object when a third-party integration plugin is installed and a recipe is configured to store attacker-controlled data as trigger meta. The presence of a POP chain (Property-Oriented Programming, a technique used to execute code by leveraging existing classes in the application) allows attackers to delete arbitrary files on the server.

An issue exists in the `dmem form submit handler()` function that allows unauthenticated attackers to escalate privileges. The function determines a new user's role by iterating through all WordPress roles and calling `password verify()` against a bcrypt hash provided in the `form id` POST parameter without validation or a whitelist of allowed roles. By submitting a locally computed bcrypt hash of `administrator` via the `form id` parameter and setting `auto login=on`, an attacker can register an account with administrator privileges and be immediately authenticated, leading to a full site takeover. This process requires a WordPress nonce, which is publicly available on any page that renders the registration form.

An authentication bypass exists in the Divi Membership plugin for WordPress. The `process paypal callback()` function, which is linked to the `init` action, processes a base64-encoded `paypal param` GET parameter without performing IPN validation, cryptographic signature checks, ownership verification, or nonce validation. This allows an unauthenticated attacker to provide an arbitrary user ID, which is then passed to `wp set current user()` and `wp set auth cookie()`, enabling them to log in as any existing user, including administrators, and achieve full site takeover. The issue persists regardless of whether the PayPal gateway is enabled or configured, as the class is instantiated on every front-end request.

The Divi Essential plugin for WordPress allows authenticated attackers with Subscriber-level access and above to expose sensitive information. The issue exists within the `dnxte get database tables` and `dnxte get database data` AJAX actions. The handlers only verify a nonce if the `nonce` POST parameter is present, allowing the check to be bypassed by omitting the parameter. Additionally, the plugin fails to call `current user can()` or enforce any specific capabilities. This enables attackers to enumerate all tables in the WordPress database and read a caller-controlled number of rows from any table, including `wp users` (usernames, emails, hashed passwords), `wp usermeta` (session tokens, secret keys), and `wp options` (privileged settings, API keys, and credentials from other plugins).

An arbitrary file upload issue exists in the Gravity Forms plugin for WordPress via the `upload file()` function. The flaw stems from a mismatch between the field validation pipeline and the file persistence pipeline, allowing hidden file upload fields to bypass extension validation. Consequently, a rejected file's intact upload state can be passed to `upload file()` without re-validation. This allows unauthenticated attackers to upload executable files on any publicly accessible form where a File Upload field has its Visibility set to 'Hidden', potentially leading to remote code execution (RCE), which is the ability to execute arbitrary commands on the server.

An issue exists where authenticated attackers with subscriber-level access and above can read arbitrary files on the server. This is achieved by poisoning the ` wpfd file metadata['file']` post-meta value through the unprotected `file.save()` handler using the `remoteurl` parameter. Subsequently, a streaming endpoint hooked on init, which does not require authentication, resolves and streams the traversed file path to any requester, including unauthenticated visitors. Directory Traversal is a method used to access files and directories that are stored outside the web root folder.

Insufficient file path validation in the delete function allows authenticated attackers with subscriber-level access and above to delete arbitrary files on the server. This can lead to remote code execution if critical files like wp-config.php are removed. The exploit occurs in two stages: first, a request to the 'file.save' task persists a path-traversal string into file metadata using the `remoteurl` parameter; second, a request to the 'file.delete' task triggers the unlink call. Both endpoints lack capability checks and nonce enforcement (a security token used to prevent cross-site request forgery).

An issue allows unauthenticated attackers to elevate their privileges to Administrator. This occurs because the plugin accepts an attacker-controlled `afreg select user role` value from the WooCommerce Store API endpoint '/wc/store/v1/checkout' within the `af reg checkout data to order meta data block()` function. The value is persisted in order meta and subsequently passed to the `WP User::add role()` function in the `af reg custom order processing function()` without being validated against the admin-configured allowed role list. An attacker can exploit this by creating an account during checkout with a modified JSON body specifying the desired role slug. This exploit requires the User Role Selection setting to be enabled.

Improper capability handling in the `allow attachment actions()` function allows authenticated attackers with Subscriber-level access or higher to escalate their privileges to Administrator. The issue occurs when the function treats a target user ID as a media attachment ID during capability checks, enabling the modification of an administrator account if the targeted user ID matches the ID of an existing media attachment.

The plugin is subject to Directory Traversal, a flaw that allows an attacker to access files and directories that are stored outside the web root folder. Authenticated users with subscriber-level access or higher can exploit this by manipulating the `thwcfe legacy file` parameter to read arbitrary files on the server, potentially exposing sensitive information.

The Bricksforge plugin for WordPress contains a privilege escalation flaw. The issue stems from improper validation of the `fieldIds` parameter within the Pro Forms registration action. This allows unauthenticated attackers to add attacker-supplied field IDs to the trusted form-field whitelist. By submitting a crafted request to a publicly accessible Bricksforge Pro Forms registration form, an attacker can register a new administrator account. This exploitation is possible if the site has a public Bricksforge Pro Forms element configured with the User Registration action.

Missing authorization allows authenticated attackers with subscriber-level access or higher to perform a complete account takeover. The issue occurs because the `update user()` function accepts a user ID parameter from form submissions without verifying if the authenticated user has permission to edit that specific account. Additionally, the `handle register submission()` function only checks if a user is logged in rather than validating permissions for the target user. This enables the modification of email addresses and passwords for any account, including administrators.

Insufficient file extension validation in the `do image upload()` function allows unauthenticated attackers to perform arbitrary file uploads, leading to Remote Code Execution. The issue occurs because user-supplied input from the `acceptFileTypes` POST parameter is directly interpolated into a regular expression used for validation. Attackers can bypass `.htaccess` protections by using PHP-executable extensions such as `.phtml`, `.phar`, `.php5`, or `.php7`. On Nginx-based servers, the `.htaccess` protection is entirely ineffective. An attacker can obtain a nonce from any public page containing a form to upload executable PHP files to the `/wp-content/uploads/de fb uploads/` directory and execute them via HTTP.

An incorrect privilege assignment in LCweb PrivateContent enables privilege escalation, allowing a user to gain higher levels of access than intended.

The plugin contains a privilege escalation flaw within the 'update capabilities' REST endpoint. The `update capabilities()` REST handler fails to implement allowlist validation when processing capability strings from the request body, passing them directly to the `WP User::add cap()` function. This allows authenticated attackers with Vendor-level access or higher, on sites where the Vendor Staff module is active, to assign arbitrary WordPress capabilities, such as administrator privileges, to any `vendor staff` account, potentially resulting in a complete site takeover.

Deserialization of untrusted data in the plugin allows for Object Injection. This occurs when the application deserializes data from an untrusted source without sufficient validation, potentially allowing an attacker to inject malicious PHP objects into the application state.

Unauthenticated broken access control allows unauthorized users to bypass security restrictions within the plugin.

An unauthenticated arbitrary file download issue exists, allowing an attacker to download files from the server without providing credentials.

Broken access control allows unauthenticated attackers to perform unauthorized actions due to a missing capability check in a function within the plugin.

The software contains a flaw related to the deserialization of untrusted data, which allows for object injection. This issue impacts the application's ability to securely handle incoming data, potentially leading to unauthorized access or control.