Aabideen Bangash

The WPGraphQL WordPress plugin before 2.27.1 does not restrict access to posts in custom non-public post statuses, allowing users with the Contributor role and above to read the content of other users' posts in those statuses.

The Essential Real Estate WordPress plugin before 5.3.6 does not verify that the recipients it allows for its contact email action are legitimate, allowing users with the self-registered Customer role to add any address to that allowlist so that unauthenticated users can then send emails with attacker-controlled content to it through the site.

When WeChat official-account keyword login is enabled, the plugin fails to limit or bind attempts to verify WeChat login codes. This allows unauthenticated attackers to brute-force a code issued to another user and gain unauthorized access to their account, including those with administrator privileges.

Users with the Author role and above can permanently delete synced media belonging to other users, including administrators. This occurs because the plugin fails to verify if a user has the necessary permissions to delete media within a collection before the deletion process is executed. The issue is caused by a missing capability check in a function.

The GetPaid WordPress plugin fails to verify that item quantities on payment forms are whole numbers. This allows unauthenticated users to bypass payment by using fractional quantities, resulting in invoices for priced items being marked as paid without the required charge.

Insufficient sanitization and escaping of keyword names before they are stored and displayed on the debugging page allow users with the Author role and above to perform Stored Cross-Site Scripting (XSS) attacks. This occurs when an authenticated attacker injects arbitrary web scripts that execute when an administrator accesses the affected page.

The plugin fails to restrict access to several REST API routes, which allows unauthenticated users to generate and retrieve login tokens for any account. This flaw enables an attacker to perform privilege escalation and log in as any user, including those with administrator privileges.