Andrea Bocchetti

An issue exists in the `user account manager()` function's edit profile branch. A mass-assignment flaw occurs when submitted `$ POST` fields are iterated and assigned to the current member object via the `MS Model` ` set()` magic method without a field allowlist or capability and ownership checks on the `id` parameter. Authenticated attackers with subscriber-level access or higher can inject an arbitrary user ID through the `id` parameter to overwrite the email address and password of any WordPress user, including the site administrator, leading to full administrative access.

The premium build of the plugin contains a flaw due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server, by manipulating the HTTP Referer Header. These scripts execute whenever a user visits the affected page. The attack is facilitated by the fact that the nonce required to access the vulnerable AJAX endpoint is available in the page source for anonymous visitors.

Unauthenticated attackers can perform a generic SQL Injection by manipulating the `validate` parameter. This is caused by insufficient escaping of user-supplied input and a lack of proper preparation of the SQL query. Attackers can exploit the malleability of the AES-CTR stream cipher—a type of encryption where the ciphertext can be modified to produce a predictable change in the plaintext—to recover the keystream and forge ciphertexts containing arbitrary SQL. Additionally, the HMAC check, which is a mechanism used to verify the integrity and authenticity of data, is only enforced when the `wcap nonce` parameter is present; omitting this parameter allows the check to be bypassed.

An authentication bypass exists due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens. The 8-byte CTR nonce is stored within the ciphertext blob, and the encryption key is retrieved using the attacker-supplied `user email` GET parameter. Additionally, the HMAC nonce check in the `wcap email track links()` function is only enforced if the `wcap nonce` parameter is not empty, allowing it to be bypassed by omitting the parameter. An insecure direct object reference on the decrypted `abandoned id` further allows access without ownership verification. An unauthenticated attacker with a legitimate cart-recovery link can recover the keystream, forge a ciphertext for any victim's cart ID, and trigger `wp set auth cookie()` to achieve full account takeover of any user who abandoned a cart, including administrators. The auto-login feature is enabled by default and forced during upgrades.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue occurs when field values are echoed unescaped within the `admin/ecf index.php` endpoint, specifically inside a title HTML attribute and the table cell body. Base64 encoding and serialization of the stored values fail to neutralize the malicious content, allowing scripts to execute when a user accesses the affected page.

An issue exists where authenticated attackers with subscriber-level access or higher who hold a corporate account can achieve privilege escalation. This occurs due to a mass assignment flaw in the `add sub account user()` function, which passes the raw `userdata` array to `wp insert user()` without filtering sensitive keys such as `role` or `ID`. Mass assignment is a vulnerability where an application takes user-provided data and binds it to an internal object without proper validation, allowing attackers to modify fields they should not have access to. This flaw allows attackers to create new administrator accounts or hijack existing ones by overwriting email addresses.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. This issue specifically affects multi-input sub-field types within a repeater, such as Name, Address, and Checkbox fields. Attackers can inject arbitrary web scripts into pages that execute when a user accesses the affected page.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. An attacker can call the `updateNonce()` action to obtain a valid nonce and then submit a contact form containing a malicious payload within a spoofed IP header, such as `X-Forwarded-For`. These scripts execute whenever a user accesses the affected page.

An issue exists where unauthenticated attackers can perform unauthorized modification of data. This occurs due to a missing capability check in the `do action()` function within the `Update Options` action class. The flaw allows the modification of JetEngine Options Page values if an administrator has configured a form with the Update Options post-submission action. This requires both JetFormBuilder and JetEngine to be installed and active.

An authentication bypass exists allowing unauthenticated password resets. The `ssoprocess ajax()` function, registered on `wp ajax nopriv ssoprocess ajax`, accepts an attacker-supplied `email` parameter during the `setnewpassword` operation and calls `reset password()` without requiring an ownership token, email confirmation, or capability check. The security check performed by `check ajax referer()` is ineffective because the `ssoajaxnonce` nonce is publicly exposed on front-end pages via `wp localize script()` within the `SSOPWDREQUIREMENT` JavaScript object. Because WordPress uses a shared anonymous session context for logged-out visitors, any unauthenticated user can obtain a valid nonce to authenticate the request, potentially allowing them to change the password of any account, including administrators, and take over the site.

The Super Forms – Drag & Drop Form Builder plugin for WordPress contains an arbitrary file upload flaw that allows unauthenticated attackers to achieve remote code execution. The issue exists in the `submit form()` function within the `submit form` nopriv AJAX handler, which lacks file type validation and capability checks. Attackers can bypass the session nonce requirement by using the `super create nonce` nopriv AJAX action to obtain a valid `sf nonce` and session cookie. The exploit involves sending a base64-encoded datauristring via the `data` parameter to the '/wp-admin/admin-ajax.php' endpoint, which is then decoded and written to disk with an attacker-controlled filename. Over 440,000 exploit attempts have been detected, with some reports indicating more than 250,000 blocked attempts where PHP webshells, such as Mushr00w upl.php, were deployed to stage further payloads.

The plugin is susceptible to Unauthenticated Price Manipulation and Insecure Direct Object Reference (IDOR), which occurs when used in combination with Cost Calculator Builder PRO. The issue arises because the 'ccb woocommerce payment' AJAX action is registered via `wp ajax nopriv`, allowing unauthenticated access. Additionally, the `renderWooCommercePayment()` function passes user-controlled data to `CCBWooCheckout::init()` without performing authorization checks. This allows unauthenticated attackers to add WooCommerce products to their cart with prices they control.

The Royal Elementor Addons plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping in the `wpr update form action meta` AJAX action via the `status` parameter. Additionally, a publicly leaked nonce allows unauthenticated access to the AJAX handler, enabling unauthenticated attackers to inject arbitrary web scripts into pages that execute when accessed by users.

Improper Input Validation in payment integrations for Stripe and PayPal allows unauthenticated attackers to manipulate the payment amount. This occurs because the system trusts a user-submitted calculation field value without recomputing or validating it against the configured form price. The issue can be exploited via the `mf-calculation` field in the form submission REST request when a form is configured with these specific settings.

Name of the Vulnerable Software and Affected Versions Elementor Website Builder – More Than Just a Page Builder plugin for WordPress versions through 3.35.5 Description The Elementor Website Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. Recommendations Update to a version later than 3.35.5

The MetForm Pro plugin for WordPress is susceptible to Stored Cross-Site Scripting through the Quiz feature. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into pages. These scripts will execute when a user accesses an injected page.

Improper Input Validation occurs because the plugin accepts payment amounts directly from user-controlled POST data within the `create payment intent()` and `create subscription intent()` functions without validating them against the configured price of the form. This allows unauthenticated attackers to modify the payment amount to an arbitrary value during Stripe payment form submission, potentially enabling the purchase of products or services at reduced prices.

The Fluent Forms Pro Add On Pack plugin for WordPress is susceptible to a Server-Side Request Forgery issue. This allows authenticated attackers with Subscriber-level access or higher to make web requests to arbitrary locations from the web application. Exploitation can enable querying and modification of information from internal services via the `saveDataSource` function.

The JAY Login & Register plugin for WordPress is susceptible to a privilege escalation issue. The plugin allows updating arbitrary user meta through the `jay login register ajax create final user` function, potentially enabling unauthenticated attackers to gain administrator privileges.

The Infility Global plugin for WordPress is susceptible to unauthenticated SQL Injection through the '`infility get data`' API action. This is a result of inadequate escaping of user-supplied input and insufficient preparation of the SQL query. This allows unauthenticated attackers to potentially append additional SQL queries, and extract sensitive information from the database.