Abdullah Kareem

The WP Google Review Slider WordPress plugin before 18.11 does not perform nonce validation when updating its active Google Places configuration, allowing attackers to alter or destroy that configuration via a forged request, provided they can trick a site administrator into following a crafted link.

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities.

The plugin fails to restrict access to a site-wide third-party email-service API key. This sensitive credential is exposed on an admin screen accessible by default to users with the Editor role. An attacker with these privileges can obtain the key to impersonate other users and disconnect the site from its email service without requiring a WordPress session.

Authenticated users with read access to centers or targeted datatables can perform time-based blind SQL injection. This occurs because the application concatenates caller-supplied ordering parameters directly into the SQL ORDER BY clause, bypassing existing regex-based input validation. The affected API endpoints are '/api/v1/centers', '/api/v1/datatables/{datatable}/{apptableId}', and '/api/v1/datatables/{datatable}/{apptableId}/{datatableId}'. The vulnerable parameters are `orderBy`, `sortOrder`, and `order`.

A server-side template injection occurs in the Twig theme rendering sandbox. The sandbox, designed to restrict user-uploaded theme templates, fails to fully enforce restrictions, allowing a crafted template to escape. An authenticated user with the `core:themes:create` permission can upload a malicious theme that, when rendered, enables arbitrary code execution with the privileges of the web server process. This allows for the execution of operating system commands, reading of server-side files such as configuration files and database credentials, writing files, and accessing internal services.

Insufficient sanitization and escaping of gallery configuration values before they are echoed into an inline script on pages embedding the gallery allows users with contributor-level access and above to perform a stored cross-site scripting attack. This enables the execution of arbitrary JavaScript in the browsers of all users who view the gallery, including those with administrator privileges.

Missing authorization in the module data retrieval process allows unauthorized cross-group access to module history.

The plugin fails to verify user capabilities before dispatching request handlers within its bundled admin framework. This allows users with subscriber-level accounts to access administrative pages and disclose stored settings.

An authorization check is missing in an AJAX action, which allows any authenticated user, including those with subscriber privileges, to retrieve the IDs and titles of unpublished lists belonging to other users.

An issue exists where the plugin fails to perform a capability check in an AJAX action. This allows any authenticated user, including those with subscriber-level privileges, to read the full content of unpublished recipes.

The Product XML Feed Manager for WooCommerce WordPress plugin fails to restrict the object methods that its product shortcode can call and does not verify the user's permissions regarding the targeted product. This allows users with contributor-level access to delete arbitrary WooCommerce products by previewing a post containing the shortcode.

The plugin fails to verify if a user is authorized to rename a specific wishlist due to a missing capability check on a function. This allows unauthenticated users to rename any wishlist on the site.

The plugin fails to restrict access to log files stored in a predictable location within the public uploads directory. When logging is enabled, unauthenticated users can download sensitive information, including customer order details and opt-in form submissions.

An authorization bypass occurs when retrieving order line-item data. This allows any authenticated user, including those with Subscriber roles, to access course sales records of other instructors by providing a different user's identifier.

An authorization check is missing before the plugin returns per-student course enrollment and progress data. This allows unauthenticated attackers to disclose the enrolled courses and learning progress of any registered user.

An issue exists where the plugin fails to verify the amount, receiver, currency, or status of a payment notification before marking an order as completed. This allows unauthenticated users to bypass payment requirements and gain access to paid content by paying only a token amount.

An authorization bypass exists in an administration-only feature of the AI Engine WordPress plugin. The system relies on a token provided to anonymous visitors instead of performing proper authorization checks. This allows unauthenticated attackers to execute arbitrary AI queries using the site owner's configured provider account.

An issue exists where the plugin fails to verify the email address within an authentication token before matching it to a WordPress account and issuing a session. This allows unauthenticated attackers to log in as any user, including those with administrator privileges.

Insufficient authorization checks in certain AJAX actions allow unauthenticated users to modify the email addresses of any user, including those with administrator privileges. This flaw enables an attacker to seize control of accounts by utilizing the password reset process.

Stored Cross-Site Scripting occurs because the plugin fails to sanitize uploaded signature images before storage. This allows unauthenticated attackers to upload a specially crafted SVG file containing JavaScript, which executes when the file is viewed.