Afan

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including administrator passwords, to a known plugin-configured custom value, enabling full account takeover of the site. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.

**Name of the Vulnerable Software and Affected Versions** 6Storage Rentals versions prior to 2.27.1 **Description** An authentication bypass exists that allows unauthenticated attackers to log in as any existing WordPress user, including administrators. The issue occurs because the `six storage create wp user()` function is registered on the `wp ajax nopriv six storage create wp user` AJAX endpoint without requiring a nonce, capability, credential, or ownership verification. By providing a target user's email address via the `email` parameter, an attacker can trigger `wp set current user()` and `wp set auth cookie()` to gain unauthorized access. **Recommendations** Update to a version newer than 2.27.0. As a temporary workaround, restrict access to the `wp ajax nopriv six storage create wp user` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** User Session Synchronizer versions prior to 1.4.1 **Description** An authentication bypass exists that can lead to account takeover. The `synchronize session()` function, which executes on every request, fails to validate nonces, capabilities, or shared secrets for the `ussync-key`, `ussync-token`, and `ussync-ref` parameters. If the `ussync-key` refers to an unregistered slot, the AES-256-CBC encryption key reverts to a predictable `md5('')` value and the referer allowlist becomes an empty-string match, while the AES IV (Initialization Vector) is hard-coded as `md5('another-secret')`. This allows unauthenticated attackers to send a crafted request with an encrypted user email address in the `ussync-ref` parameter, triggering `wp set auth cookie()` and granting full access to the targeted account, including administrator privileges. **Recommendations** Update the plugin to a version later than 1.4.0. As a temporary workaround, restrict access to the `synchronize session()` function or disable the plugin until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Pronamic Pay versions prior to 10.1.1 **Description** The plugin is subject to privilege escalation. The `maybe update user role()` function passes an attacker-controlled Gravity Forms field value (`$lead[$feed->user role field id]`) directly into `WP User::set role()` without allowlist validation, capability comparison, or permission checks. This allows authenticated users with Subscriber-level access or higher to escalate their account privileges to Administrator by tampering with the role field value during a form submission. This issue occurs when an administrator has configured a Pronamic Pay payment feed in Gravity Forms with the Update User Role option enabled and mapped to a form field. **Recommendations** Update to a version newer than 10.1.0. As a temporary mitigation, disable the Update User Role option in the Pronamic Pay payment feed configuration within Gravity Forms.