Abdullah Kareem

The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product, allowing users with contributor-level access to delete arbitrary WooCommerce products by previewing a post that contains the shortcode.

The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site.

The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthenticated users to download customer order details and opt-in form submissions when logging is enabled.

**Name of the Vulnerable Software and Affected Versions** MasterStudy LMS WordPress Plugin versions prior to 3.7.46 **Description** An authorization bypass occurs when retrieving order line-item data. This allows any authenticated user, including those with Subscriber roles, to access course sales records of other instructors by providing a different user's identifier. **Recommendations** Update MasterStudy LMS WordPress Plugin to version 3.7.46 or later.

**Name of the Vulnerable Software and Affected Versions** MasterStudy LMS WordPress Plugin versions prior to 3.7.46 **Description** An authorization check is missing before the plugin returns per-student course enrollment and progress data. This allows unauthenticated attackers to disclose the enrolled courses and learning progress of any registered user. **Recommendations** Update MasterStudy LMS WordPress Plugin to version 3.7.46 or later.

**Name of the Vulnerable Software and Affected Versions** MasterStudy LMS WordPress Plugin versions prior to 3.7.40 **Description** An issue exists where the plugin fails to verify the amount, receiver, currency, or status of a payment notification before marking an order as completed. This allows unauthenticated users to bypass payment requirements and gain access to paid content by paying only a token amount. **Recommendations** Update MasterStudy LMS WordPress Plugin to version 3.7.40 or later.

**Name of the Vulnerable Software and Affected Versions** AI Engine versions 3.4.0 through 3.7.1 **Description** An authorization bypass exists in an administration-only feature of the AI Engine WordPress plugin. The system relies on a token provided to anonymous visitors instead of performing proper authorization checks. This allows unauthenticated attackers to execute arbitrary AI queries using the site owner's configured provider account. **Recommendations** Update AI Engine to version 3.7.2 or later.

**Name of the Vulnerable Software and Affected Versions** Firebase Authentication WordPress plugin versions prior to 1.7.1 **Description** An issue exists where the plugin fails to verify the email address within an authentication token before matching it to a WordPress account and issuing a session. This allows unauthenticated attackers to log in as any user, including those with administrator privileges. **Recommendations** Update the Firebase Authentication WordPress plugin to version 1.7.1 or later.

**Name of the Vulnerable Software and Affected Versions** TrueBooker versions prior to 1.2.7 **Description** Insufficient authorization checks in certain AJAX actions allow unauthenticated users to modify the email addresses of any user, including those with administrator privileges. This flaw enables an attacker to seize control of accounts by utilizing the password reset process. **Recommendations** Update to version 1.2.7 or later.

**Name of the Vulnerable Software and Affected Versions** GDPR Cookie Compliance versions prior to 5.1.0 **Description** An issue exists where the plugin expires visitor cookies via an action accessible without authentication. Because the process lacks a request-origin check, an attacker can force any user to log out and delete the site cookies by tricking them into clicking a specially crafted link. **Recommendations** Update to version 5.1.0 or later.

**Name of the Vulnerable Software and Affected Versions** Bit Form WordPress plugin versions prior to 3.2.0 **Description** Stored Cross-Site Scripting occurs because the plugin fails to sanitize uploaded signature images before storage. This allows unauthenticated attackers to upload a specially crafted SVG file containing JavaScript, which executes when the file is viewed. **Recommendations** Update the plugin to version 3.2.0 or later.

**Name of the Vulnerable Software and Affected Versions** Link Library versions prior to 7.9.3 **Description** The Link Library WordPress plugin fails to properly sanitize and escape user-supplied values before incorporating them into a SQL query. This flaw allows unauthenticated users to execute SQL injection attacks via the front-end link submission form. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to or manipulation of the database. **Recommendations** Update the plugin to version 7.9.3 or later.