Andrea Bocchetti

The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'add sub account user' function that passes the raw 'userdata' array to 'wp insert user' without filtering dangerous keys like role or ID. This makes it possible for authenticated attackers, with subscriber-level access and above who hold a corporate account, to create new administrator accounts or hijack existing administrator accounts by overwriting their email addresses. The vulnerability was partially patched in version 1.5.39.

The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability only affects multi-input sub-field types within a repeater (such as Name, Address, and Checkbox fields), as scalar single-input field values are escaped with esc html() at the output stage in version 3.0.4.

The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP Address Header in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An unauthenticated attacker can first call the 'updateNonce' action — which is accessible without authentication due to its absence from the plugin's permission list — to obtain a valid nonce, then submit a contact form with a malicious payload in a spoofed IP header such as X-Forwarded-For.

**Name of the Vulnerable Software and Affected Versions** Single Sign On For TNG versions prior to 2.0.1 **Description** An authentication bypass exists allowing unauthenticated password resets. The `ssoprocess ajax()` function, registered on `wp ajax nopriv ssoprocess ajax`, accepts an attacker-supplied `email` parameter during the `setnewpassword` operation and calls `reset password()` without requiring an ownership token, email confirmation, or capability check. The security check performed by `check ajax referer()` is ineffective because the `ssoajaxnonce` nonce is publicly exposed on front-end pages via `wp localize script()` within the `SSOPWDREQUIREMENT` JavaScript object. Because WordPress uses a shared anonymous session context for logged-out visitors, any unauthenticated user can obtain a valid nonce to authenticate the request, potentially allowing them to change the password of any account, including administrators, and take over the site. **Recommendations** Update Single Sign On For TNG to a version newer than 2.0.0. As a temporary mitigation, restrict access to the `wp ajax nopriv ssoprocess ajax` endpoint.

**Name of the Vulnerable Software and Affected Versions** Super Forms – Drag & Drop Form Builder versions prior to 6.3.314 **Description** The Super Forms – Drag & Drop Form Builder plugin for WordPress contains an arbitrary file upload flaw that allows unauthenticated attackers to achieve remote code execution. The issue exists in the `submit form()` function within the `submit form` nopriv AJAX handler, which lacks file type validation and capability checks. Attackers can bypass the session nonce requirement by using the `super create nonce` nopriv AJAX action to obtain a valid `sf nonce` and session cookie. The exploit involves sending a base64-encoded datauristring via the `data` parameter to the '/wp-admin/admin-ajax.php' endpoint, which is then decoded and written to disk with an attacker-controlled filename. Over 440,000 exploit attempts have been detected, with some reports indicating more than 250,000 blocked attempts where PHP webshells, such as Mushr00w upl.php, were deployed to stage further payloads. **Recommendations** Update to version 6.3.314 immediately. As a temporary mitigation, deploy a WAF rule to block file uploads to '/wp-content/uploads/' from unauthenticated requests.

**Name of the Vulnerable Software and Affected Versions** Cost Calculator Builder versions prior to 4.0.2 **Description** The plugin is susceptible to Unauthenticated Price Manipulation and Insecure Direct Object Reference (IDOR), which occurs when used in combination with Cost Calculator Builder PRO. The issue arises because the 'ccb woocommerce payment' AJAX action is registered via `wp ajax nopriv`, allowing unauthenticated access. Additionally, the `renderWooCommercePayment()` function passes user-controlled data to `CCBWooCheckout::init()` without performing authorization checks. This allows unauthenticated attackers to add WooCommerce products to their cart with prices they control. **Recommendations** Update to a version later than 4.0.1. As a temporary workaround, restrict access to the 'ccb woocommerce payment' AJAX action to authenticated users only.

**Name of the Vulnerable Software and Affected Versions** AAWP version 3.16 **Description** A reflected cross-site scripting issue exists where authenticated attackers can inject malicious scripts by manipulating the `tab` parameter. This occurs on the 'aawp-settings' admin page, allowing the execution of arbitrary JavaScript within the context of authenticated users. **Recommendations** As a temporary workaround, restrict access to the `tab` parameter on the 'aawp-settings' admin page to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Royal Elementor Addons versions prior to 1.7.1057 **Description** The Royal Elementor Addons plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping in the `wpr update form action meta` AJAX action via the `status` parameter. Additionally, a publicly leaked nonce allows unauthenticated access to the AJAX handler, enabling unauthenticated attackers to inject arbitrary web scripts into pages that execute when accessed by users. **Recommendations** Update the plugin to a version later than 1.7.1056.

**Name of the Vulnerable Software and Affected Versions** MetForm Pro versions prior to 3.9.8 **Description** Improper Input Validation in payment integrations for Stripe and PayPal allows unauthenticated attackers to manipulate the payment amount. This occurs because the system trusts a user-submitted calculation field value without recomputing or validating it against the configured form price. The issue can be exploited via the `mf-calculation` field in the form submission REST request when a form is configured with these specific settings. **Recommendations** Update MetForm Pro to version 3.9.8 or later. As a temporary mitigation, avoid using the `mf-calculation` field in forms integrated with Stripe or PayPal until the update is applied.

Name of the Vulnerable Software and Affected Versions Elementor Website Builder – More Than Just a Page Builder plugin for WordPress versions through 3.35.5 Description The Elementor Website Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. Recommendations Update to a version later than 3.35.5

**Name of the Vulnerable Software and Affected Versions** MetForm Pro plugin for WordPress versions through 3.9.6 **Description** The MetForm Pro plugin for WordPress is susceptible to Stored Cross-Site Scripting through the Quiz feature. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into pages. These scripts will execute when a user accesses an injected page. **Recommendations** Update the MetForm Pro plugin to a version later than 3.9.6.

**Name of the Vulnerable Software and Affected Versions** wp.insider Simple Membership versions through 4.6.9 **Description** An authorization issue exists in wp.insider Simple Membership. The issue involves incorrectly configured access control security levels, potentially allowing unauthorized access. **Recommendations** Update to a version later than 4.6.9.

**Name of the Vulnerable Software and Affected Versions** SureForms – Drag and Drop Form Builder for WordPress versions prior to 2.2.2 **Description** Improper Input Validation occurs because the plugin accepts payment amounts directly from user-controlled POST data within the `create payment intent()` and `create subscription intent()` functions without validating them against the configured price of the form. This allows unauthenticated attackers to modify the payment amount to an arbitrary value during Stripe payment form submission, potentially enabling the purchase of products or services at reduced prices. **Recommendations** Update SureForms – Drag and Drop Form Builder for WordPress to version 2.2.2 or later. As a temporary workaround, restrict access to the `create payment intent()` and `create subscription intent()` functions.

**Name of the Vulnerable Software and Affected Versions** Fluent Forms Pro Add On Pack versions prior to 6.1.13 **Description** The Fluent Forms Pro Add On Pack plugin for WordPress is susceptible to a Server-Side Request Forgery issue. This allows authenticated attackers with Subscriber-level access or higher to make web requests to arbitrary locations from the web application. Exploitation can enable querying and modification of information from internal services via the `saveDataSource` function. **Recommendations** Update Fluent Forms Pro Add On Pack to version 6.1.13 or later.

**Name of the Vulnerable Software and Affected Versions** JAY Login & Register plugin for WordPress versions prior to 2.6.04 **Description** The JAY Login & Register plugin for WordPress is susceptible to a privilege escalation issue. The plugin allows updating arbitrary user meta through the `jay login register ajax create final user` function, potentially enabling unauthenticated attackers to gain administrator privileges. **Recommendations** Update the JAY Login & Register plugin to version 2.6.04 or later.

**Name of the Vulnerable Software and Affected Versions** Infility Global plugin for WordPress versions prior to 2.14.46 **Description** The Infility Global plugin for WordPress is susceptible to unauthenticated SQL Injection through the '`infility get data`' API action. This is a result of inadequate escaping of user-supplied input and insufficient preparation of the SQL query. This allows unauthenticated attackers to potentially append additional SQL queries, and extract sensitive information from the database. **Recommendations** Update the Infility Global plugin to a version later than 2.14.46.

**Name of the Vulnerable Software and Affected Versions** All-in-One Video Gallery plugin for WordPress versions through 4.6.4 **Description** The All-in-One Video Gallery plugin for WordPress is susceptible to unauthorized data modification because of a missing capability check on the `ajax callback create bunny stream video`, `ajax callback get bunny stream video`, and `ajax callback delete bunny stream video` functions. This allows unauthenticated attackers to create and delete videos on the Bunny Stream CDN linked to the victim’s account, if they can acquire a valid nonce, which is present in public player templates. **Recommendations** Update to a version beyond 4.6.4.

**Name of the Vulnerable Software and Affected Versions** LearnPress – WordPress LMS Plugin versions prior to 4.3.2.5 **Description** The LearnPress WordPress LMS Plugin is affected by a sensitive information disclosure issue. Unauthenticated attackers can extract sensitive data, including user first names, last names, social profile links, and enrollment information, through the `get item permissions check` function. **Recommendations** Update LearnPress – WordPress LMS Plugin to version 4.3.2.5 or later.

**Advanced Custom Fields: Extended Plugin** Advanced Custom Fields: Extended versions up to and including 0.9.2.1 **Description** The Advanced Custom Fields: Extended plugin for WordPress has a flaw that allows unauthenticated attackers to gain administrator access. This is due to insufficient restrictions within the `insert user` function, which allows attackers to assign themselves the 'administrator' role during user registration, provided the 'role' parameter is mapped to a custom field. Approximately 100,000 websites are potentially affected. The issue can be exploited by submitting a crafted registration request. The `wp insert user()` function is abused to escalate privileges. The vulnerability allows for full site takeover, including the ability to upload malicious plugins and backdoors. A scanning campaign targeting WordPress plugins has been detected, potentially seeking to identify vulnerable sites. **Recommendations** Update to version 0.9.2.2 or later. Disable user registration until a patch is applied. Strip the role parameter from registration requests as a temporary mitigation. Review recent user registrations for unauthorized administrator accounts.

**Name of the Vulnerable Software and Affected Versions** Cost Calculator Builder plugin for WordPress versions prior to 3.7.0 **Description** The Cost Calculator Builder plugin for WordPress is susceptible to an unauthenticated payment status bypass. This occurs because the `complete payment` AJAX action is registered via `wp ajax nopriv`, allowing access to unauthenticated users. The `complete()` function only verifies a nonce, without checking user capabilities or order ownership. Nonces are exposed to all visitors via `window.ccb nonces` in the page source, enabling an attacker to mark any order's payment status as "completed" without actual payment. The issue requires the use of both Cost Calculator Builder and Cost Calculator Builder PRO. **Recommendations** Update the Cost Calculator Builder plugin to version 3.7.0 or later.