Akshat Parikh

The Redirection for Contact Form 7 WordPress plugin before 3.2.16 does not verify ownership of the email address supplied through its data request form action and by default records the resulting request as already confirmed, allowing unauthenticated visitors to create verified WordPress personal data erasure or export requests for addresses they do not control.

The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders WordPress plugin before 2.5.7's user restriction setting.

The front-end registration email-verification step of the plugin does not limit the number of attempts for the short numeric PIN used for verification. This allows unauthenticated attackers to brute-force the PIN to create and activate a WordPress account linked to an email address they do not own, resulting in an unauthorized authenticated session.

On multisite installations, the plugin fails to protect stored private files because the rewrite rule used to route file requests through the access check is not reached. This allows unauthenticated users to retrieve private files belonging to other users directly.

Insufficient multisite authorization checks occur before serving backup archives and job logs. This allows an administrator of the network's main site, who lacks Super Admin privileges, to download a full backup of the entire network, including the shared webroot and data from every site.

The Ray Enterprise Translation WordPress plugin fails to perform capability or nonce checks on an AJAX action. This allows any authenticated user, such as those with Subscriber privileges, to add or delete the configured languages of the site. A nonce is a unique token used to protect against cross-site request forgery (CSRF) by ensuring that the request was intentionally sent by the user.

The Ray Enterprise Translation WordPress plugin fails to perform capability or nonce checks on an AJAX action. This allows any authenticated user, such as those with Subscriber privileges, to overwrite the translation API token configured by the administrator with an arbitrary value. A nonce is a unique token used to protect against cross-site request forgery.

Insufficient verification of incoming payment callbacks occurs because the secret used to validate the callback signature remains empty during the standard setup flow. Consequently, the expected signature becomes an unkeyed hash of the request body, which can be calculated by any party. This allows unauthenticated attackers to forge payment-success notifications to mark unpaid WooCommerce orders as paid without actual payment.

The software contains a flaw due to improper neutralization of input during web page generation, specifically a Stored Cross-site Scripting issue. This allows for the injection of malicious scripts. The vulnerability exists within the accessibility-toolbar component.

The issue is related to an Improper Input Validation vulnerability in Apache Traffic Server, specifically with malformed HTTP/2 frames. Users are recommended to upgrade to a fixed version.