Alyudin Nafiie

An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This flaw allows unauthenticated attackers to install and activate arbitrary plugins from the WordPress.org repository on the affected site.

The Invoice Generator plugin for WordPress allows privilege escalation because it fails to perform a capability check on the `pravel invoice edit account()` AJAX action. The handler is exposed via the `wp ajax nopriv pravel invoice edit account` endpoint and accepts the `user id` and `user email` variables from POST data. Because the plugin calls `wp update user()` without verifying authentication, ownership, or a nonce, unauthenticated attackers can change the email address of any user, including administrators. This allows them to trigger the password reset flow and gain unauthorized access to the targeted account.

The SignUp & SignIn plugin for WordPress contains an authentication bypass that allows unauthenticated attackers to take over any account, including administrator accounts. The issue exists in the `pravel change password()` AJAX handler, which is registered via `wp ajax nopriv pravel change password` and accessible without authentication. The handler fails to perform nonce verification or capability checks and uses a loose equality check between the `reset activation code` POST parameter and the `forgot email` user meta value. If a user has not initiated a password reset, the system returns an empty string, which can be trivially matched by an attacker providing an empty or omitted code. Attackers can exploit this by sending a crafted POST request to the 'admin-ajax.php' endpoint with the `action` parameter set to `pravel change password`, the `reset user id` set to the target user ID, and `new password custom` set to a password of their choice.

The Invoice Generator plugin for WordPress allows unauthenticated account takeover through a flaw in the password reset process. The `pravel invoice change password()` function is registered as a nopriv AJAX handler but lacks nonce verification and authorization checks. Additionally, it uses a loose equality comparison between the `reset activation code` POST parameter and the `forgot email` user meta. For users who have never requested a password reset, this check evaluates to true when the `reset activation code` is omitted. An attacker can exploit this by providing a target user ID via the `reset user id` POST parameter to set a new password for any account, including administrator accounts.

The Lizza LMS Pro plugin for WordPress is susceptible to a privilege escalation issue. The `lizza lms pro register user front end` function does not adequately restrict the user roles that can be assigned during registration. This allows unauthenticated attackers to register with the 'administrator' role, gaining unauthorized administrative access to the WordPress site.

The Clasifico Listing plugin for WordPress allows users registering new accounts to set their own role using the `listing user role` parameter. This can allow unauthenticated attackers to gain elevated privileges, including administrator access, by registering an account with a higher role.

The s2Member plugin for WordPress is susceptible to privilege escalation via account takeover. The plugin does not properly validate a user’s identity before allowing password updates. This allows unauthenticated attackers to change passwords for any user account, including administrator accounts, potentially leading to full site takeover. A compiled exploit for this issue is being sold, with builds available for Windows and macOS.

The Truelysell Core plugin for WordPress is subject to a privilege escalation issue. Insufficient validation of the `user role` parameter during user registration allows unauthenticated attackers to create accounts with elevated privileges, potentially including administrator access.

The EduKart Pro plugin for WordPress is susceptible to a privilege escalation issue. The `edukart pro register user front end` function does not adequately restrict the user roles that can be assigned during registration. This allows unauthenticated attackers to register with the 'administrator' role, gaining unauthorized administrative access to the WordPress site.

The Doccure Core plugin for WordPress allows privilege escalation in versions prior to 1.5.4. This occurs because the plugin permits users creating new accounts to define their own role, specifically through the `user type` field. This enables unauthenticated attackers to obtain elevated privileges by registering an account with administrator rights.

The Lisfinity Core plugin for the pebas® Lisfinity WordPress theme is susceptible to privilege escalation. This is a result of the plugin assigning the editor role by default without restricting API usage. This issue can be combined with another to gain administrator privileges.

The Lisfinity Core plugin for WordPress is susceptible to privilege escalation. An authenticated attacker with Subscriber-level access or higher can modify passwords for any user, including administrators. This occurs because the plugin does not adequately verify a user’s identity before allowing password updates. The vulnerable component is the password update functionality.

Name of the Vulnerable Software and Affected Versions: Resideo Plugin for Resideo - Real Estate WordPress Theme versions prior to 2.5.5 Description: The Resideo Plugin for Resideo - Real Estate WordPress Theme plugin for WordPress is susceptible to privilege escalation via account takeover. The plugin does not properly validate a user’s identity before allowing updates to user details, such as email addresses. This allows authenticated attackers with Subscriber-level access or higher to modify arbitrary user email addresses, including those of administrators, and subsequently reset passwords to gain account access. Recommendations: Update the Resideo Plugin for Resideo - Real Estate WordPress Theme to version 2.5.5 or later.

Name of the Vulnerable Software and Affected Versions: Real Spaces - WordPress Properties Directory Theme versions prior to 3.6 Description: The Real Spaces - WordPress Properties Directory Theme for WordPress is susceptible to privilege escalation through the `change role member` parameter during profile updates. This occurs due to insufficient restrictions on the profile update role, allowing unauthenticated attackers to arbitrarily select their role, including Administrator. Recommendations: Update Real Spaces - WordPress Properties Directory Theme to version 3.6 or later.

Name of the Vulnerable Software and Affected Versions: Real Spaces - WordPress Properties Directory Theme versions prior to 3.7 Description: The Real Spaces - WordPress Properties Directory Theme for WordPress is susceptible to privilege escalation through the `imic agent register` function. This issue stems from a lack of restrictions on the registration role, allowing unauthenticated attackers to arbitrarily select their role, including Administrator, during user registration. Recommendations: Real Spaces - WordPress Properties Directory Theme versions prior to 3.7: Upgrade to version 3.7 or later to address the unrestricted registration role issue and prevent privilege escalation. As a temporary workaround, consider restricting access to the `imic agent register` function until a patch is available.

The Reveal Listing plugin for WordPress allows users registering new accounts to set their own role via the `listing user role` field. This enables unauthenticated attackers to gain elevated privileges, potentially achieving site takeover, by creating an account with administrator privileges.

Name of the Vulnerable Software and Affected Versions: Opal Estate Pro – Property Management and Submission plugin for WordPress versions up to, and including, 1.7.5 Description: The issue is due to a lack of role restriction during registration in the `on regiser user` function, making it possible for unauthenticated attackers to arbitrarily choose the role, including the Administrator role, assigned when registering. Recommendations: For Opal Estate Pro – Property Management and Submission plugin for WordPress versions up to, and including, 1.7.5, consider disabling the `on regiser user` function until a patch is available to prevent privilege escalation. Restrict access to the registration process to minimize the risk of exploitation. Avoid using the registration feature in the affected plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to privilege escalation via account takeover. This is due to the plugin not properly validating a verification code value prior to updating a user's password through the `imic reset password init()` function. This makes it possible for unauthenticated attackers to change any user's passwords, including administrators, if the user's email is known.

The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation due to a lack of restriction on user role in the `nsl registration store extra input` function. This allows unauthenticated attackers to register an account on the site with an arbitrary role, including Administrator, when registering via a social login. The Nextend Social Login plugin must be installed and configured to exploit this issue.

The issue is related to privilege escalation due to the plugin allowing users who are registering new accounts to set their own role or by supplying the `user register role` field. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role.