Abhirup Konwar

The Cellular Web Interface contains a flaw where missing authentication allows unauthenticated attackers to manipulate critical device settings and disrupt operations. This issue has been exploited to modify critical settings and establish persistent control over energy sector infrastructure across multiple networks.

The Assistio plugin for WordPress allows authenticated users with Subscriber-level access and above to perform unauthorized data modification. This occurs because the `assistio plugin delete assistio settings()` function lacks a capability check and nonce verification. A nonce is a unique token used to protect against cross-site request forgery. Attackers can exploit this to delete plugin options, specifically the `assistiobot oauth settings` variable, which breaks the integration with the Assistio bot service.

The SearchPlus plugin for WordPress allows unauthenticated users to modify or delete stored data. This occurs because the `searchplus save token action callback()` and `searchplus reset token action callback()` functions lack capability checks and nonce validation, and are exposed via `wp ajax nopriv ` hooks. An attacker can exploit this to overwrite or delete account token and account name options, specifically the `dym token`, `dym name`, `searchplus token`, `searchplus name`, `sp token`, and `sp name` variables.

An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to read, create, update, and delete event records stored in the `rentmy events` WordPress option and overwrite the `rentmy locationId` option.

Insufficient path sanitization in the `render logs ui()` function allows authenticated attackers with Administrator-level access to read arbitrary files on the server, such as wp-config. The issue occurs because the plugin accepts a base64-encoded file name via the 'log file' GET parameter and concatenates it with the log directory path without verifying that the resulting path stays within the intended directory. This leads to a Path Traversal, which is a technique used to access files and directories that are stored outside the web root folder.

The Helpfulcrowd Product Reviews plugin for WordPress allows unauthenticated authorization bypass due to PHP Type Juggling. This occurs because the `helpfulcrowd validate token()` function uses a loose comparison operator (`!=`) instead of a strict comparison (`!==`) when validating the `token` parameter. Since the REST route "/wp-json/helpfulcrowd/v1/update-settings" is registered with a `permission callback` of ` return true`, it is accessible to unauthenticated users. By submitting a JSON boolean `true` as the `token` value, the loose comparison evaluates as equal to the non-empty base64-encoded secret string, bypassing the security check. Consequently, attackers can invoke `helpfulcrowd settings endpoint()` to write arbitrary key-value pairs into the `helpfulcrowd options` WordPress database option via `update option()` without sanitization or allowlist filtering, leading to full modification of the plugin configuration.

An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can modify all plugin settings by writing arbitrary data to the `ar try on settings` option in the database through the '/wp-json/ar try on/v1/settings' REST endpoint.

The GSheet For Woo Importer plugin for WordPress contains a flaw allowing unauthorized loss of data. This is caused by a missing capability check in the `process ajax restore action()` function, enabling authenticated attackers with Subscriber-level access or higher to delete the Google Sheets API token and configuration options.

The Essential Chat Support plugin for WordPress contains an authorization bypass. The plugin fails to properly verify if a user is authorized to perform specific actions, allowing unauthenticated attackers to reset all plugin configuration settings to their defaults. This includes general settings, display rules, custom CSS, and WooCommerce tab settings. The issue is triggered by sending a POST request containing the parameter `ecs reset settings=1`.

The Notify Odoo plugin for WordPress contains a Cross-Site Request Forgery (CSRF) flaw. This occurs because the ` updateSettings()` function lacks proper nonce validation. A nonce (number used once) is a unique token used to verify that a request was intentionally sent by the user. Consequently, unauthenticated attackers can trick a site administrator into clicking a link to execute a forged request. This allows the attacker to change the Notify Odoo URL to one they control and modify settings related to notifications, tracking images, and allowed IP addresses.

Missing authorization in a REST API endpoint allows unauthenticated attackers to delete any classroom record. This occurs because the endpoint is registered with a `permission callback` of ` return true`, which bypasses all WordPress authentication and authorization checks. An attacker can trigger this by supplying the classroom ID in the request, leading to permanent data loss.

The plugin contains a missing authorization flaw caused by a lack of capability checks and nonce verification (a unique token used to prevent cross-site request forgery) within the `save settings()` function, which is registered on the `admin post cccf7 save settings` hook. This allows authenticated users with Subscriber-level access or higher to overwrite the `cccf7 api key` variable via a crafted POST request to the '/wp-admin/admin-post' endpoint.

The plugin is subject to missing authorization due to the absence of capability checks and nonce verification within the `admin init` hook. Specifically, the code at lines 205-209 of `wp-books-gallery.php` only verifies the presence of the `permalink structure` POST parameter before updating the `wbg cpt slug` option, failing to ensure the request originates from an authenticated administrator. This allows unauthenticated attackers to modify the custom post type slug for the books gallery, altering the URL structure for all book entries and potentially disrupting existing links and SEO rankings.

The plugin is susceptible to unauthorized data modification because the `page options ajax disconnect()` function lacks a proper capability check. Authenticated users with Subscriber-level permissions or higher can exploit this by using the 'emailchef disconnect' AJAX action to delete plugin settings.

Missing authorization occurs due to the absence of capability checks or nonce verification in the `updateOptions()` function. This function is exposed via two AJAX hooks: 'wp ajax updateOptions' and 'wp ajax fbc updateOptions'. Because these hooks are registered under the `wp ajax ` prefix without calls to `current user can()` or `check ajax referer()`, authenticated attackers with subscriber-level access or higher can arbitrarily modify or delete plugin options that control cron scheduling behavior, specifically `fbc duplicates`, `fbc cron`, `fbc schedule`, `fbc cron time day`, `fbc cron time hour`, and `fbc cron start`. Additionally, attackers can manipulate or clear the scheduled WordPress cron event `fbc scheduled update`.

Name of the Vulnerable Software and Affected Versions Aruba HiSpeed Cache plugin for WordPress versions up to and including 3.0.4 Description The Aruba HiSpeed Cache plugin for WordPress is susceptible to Cross-Site Request Forgery. This is caused by the absence of nonce verification within the `ahsc ajax reset options()` function. An unauthenticated attacker could potentially reset all plugin settings to their default values by manipulating a site administrator into performing an action, such as clicking a malicious link. Recommendations Update the Aruba HiSpeed Cache plugin to a version later than 3.0.4.

Name of the Vulnerable Software and Affected Versions Gerador de Certificados – DevApps plugin for WordPress versions up to and including 1.3.6 Description The Gerador de Certificados – DevApps plugin for WordPress is susceptible to arbitrary file uploads because of a lack of file type validation within the `moveUploadedFile()` function. This allows authenticated attackers with Administrator-level access or higher to upload arbitrary files to the server, potentially leading to remote code execution. Recommendations Update the Gerador de Certificados – DevApps plugin to a version later than 1.3.6.

The software is susceptible to a missing authorization issue. This is caused by a missing capability check within the `linkedin company post reset handler()` function, which is connected to the `admin post reset linkedin company post` action. Attackers with Subscriber-level access or higher can delete LinkedIn post data stored in the site’s options table.

The software contains a path traversal flaw in all versions up to and including 1.5.0, accessible through the `cert` parameter of the 'wccd-delete-certificate' AJAX action. Insufficient validation of the file path before deletion allows authenticated attackers with Administrator-level access or higher to delete arbitrary files on the server, such as `wp-config.php`. Successful exploitation could lead to site takeover and remote code execution.

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin is susceptible to unauthorized data modification. This is due to a missing capability check within the `deactivate license()` function. Authenticated attackers with Subscriber-level access or higher can exploit this to deactivate the plugin license.