Angus Girvan

The Loco Translate plugin for WordPress contains a path traversal flaw. Authenticated attackers with Translator-level access or higher (requiring the `loco admin` capability) can read arbitrary `.php`, `.js`, `.json`, and `.twig` files from the server filesystem, excluding `wp-config.php`. This occurs because the `findSourceFile()` function fails to validate that the resolved path remains within the intended directory when processing the `ref` variable via the 'fsReference' AJAX route, allowing the use of `../` sequences to access files outside the translation directory.

Insufficient file path validation in the `ajax attach file()` function allows authenticated attackers with roles granted by an administrator, such as Subscriber, to read or delete arbitrary files on the server. Reading files may expose sensitive information, while deleting files, such as 'wp-config.php', can lead to remote code execution.

The Elementor Website Builder plugin for WordPress is susceptible to a flaw that allows unauthorized access to sensitive information. This is caused by a permission check error in the `is allowed to read template()` function, which incorrectly allows reading of non-published templates without proper edit capability verification. Authenticated attackers with contributor-level access or higher can read private or draft Elementor template content by manipulating the `template id` parameter within the `get template data` action of the `elementor ajax` endpoint.

The WP DSGVO Tools (GDPR) plugin for WordPress is susceptible to unauthorized account destruction. The `super-unsubscribe` AJAX action allows unauthenticated users to bypass the email-confirmation process and immediately trigger irreversible account anonymization by submitting a victim's email address with the `process now` parameter set to 1. This results in password randomization, username/email overwriting, role stripping, comment anonymization, and the wiping of sensitive user metadata. The required nonce for the request is publicly available on any page containing the `[unsubscribe form]` shortcode. The vulnerable parameter is `process now`. The affected API endpoint is the `super-unsubscribe` AJAX action.

The Restrict Content plugin for WordPress has a flaw that allows unauthorized privilege escalation. The `rcp setup registration init()` function improperly handles the `rcp level` POST parameter, failing to verify membership level activity or payment requirements. This, combined with the `add user role()` method, enables attackers to register with any membership level, potentially gaining privileged WordPress roles like Administrator, or triggering charges for paid levels. A partial fix was implemented in version 3.2.18, but the issue persisted up to and including version 3.2.20.

The weMail plugin for WordPress is affected by a flaw allowing unauthorized deletion of forms. The `Forms::permission()` function inadequately validates the `X-WP-Nonce` header, failing to verify user capabilities. The REST nonce is accessible to unauthenticated visitors through the `weMail` JavaScript object on pages containing weMail forms. This allows any unauthenticated user to permanently delete all weMail forms by obtaining the nonce from the page source and sending a DELETE request to the forms endpoint: `/wp-json/wemail/v1/forms`. The vulnerable parameter is the `X-WP-Nonce` header.

The Shield Security plugin for WordPress is susceptible to unauthorized data modification. A missing capability check on the `MfaEmailDisable` action allows authenticated attackers with Subscriber-level access or higher to disable the global Email 2FA setting for the entire site.

The Zarinpal Gateway for WooCommerce plugin for WordPress has an issue with Improper Access Control to Payment Status Update. The payment callback handler `Return from ZarinPal Gateway` does not properly validate the authority token provided in the callback URL, ensuring it belongs to the specific order being marked as paid. This allows unauthenticated attackers to mark orders as paid without completing a legitimate payment by reusing a valid authority token from a different transaction of the same amount.

The Super Page Cache plugin for WordPress is susceptible to Stored Cross-Site Scripting through the Activity Log. Insufficient input sanitization and output escaping allows unauthenticated attackers to inject arbitrary web scripts into pages. When a user accesses an injected page, the script will execute.

The Ajax Load More plugin for WordPress has a flaw where data access isn’t properly controlled. Specifically, the `parse custom args()` function lacks correct authorization checks. This allows attackers who haven’t logged in to view titles and excerpts of posts that are private, drafts, pending publication, scheduled, or in the trash.

The weMail plugin for WordPress has a flaw where the REST API relies on the `x-wemail-user` HTTP header for user identification without confirming a valid WordPress session. This allows unauthenticated attackers, who can determine an administrator's email address (through the `/wp-json/wp/v2/users` endpoint), to act as that user. Successful exploitation grants access to CSV subscriber endpoints, potentially leading to the theft of Personally Identifiable Information (PII) like emails, names, and phone numbers from imported CSV files.

The Dokan plugin for WordPress is susceptible to an Insecure Direct Object Reference issue. This flaw stems from a lack of validation on a user-controlled key within the `/wp-json/dokan/v1/settings` API endpoint. Authenticated attackers possessing customer-level permissions or higher can potentially read or modify store settings belonging to other vendors. This includes sensitive data such as PayPal email addresses, bank account details, routing numbers, IBANs, SWIFT codes, phone numbers, and addresses. Exploitation could allow attackers to redirect marketplace payouts to accounts they control, resulting in financial theft. The vulnerable parameter is a user-controlled key.

The Awesome Support plugin for WordPress is affected by an authorization bypass. This is due to insufficient capability checks within the `wpas do mr activate user` function, which does not properly verify user permissions when modifying roles. A nonce reuse issue exists where nonces intended for public registration are also valid for privileged actions because all actions share the same nonce namespace. An unauthenticated attacker can exploit this by submitting a request to the 'wpas-do=mr activate user' action with a user-controlled `user id` parameter, provided they have access to a valid nonce from the public registration or submit ticket page. This allows them to demote administrators to lower-privilege roles.

The Booking Calendar plugin for WordPress is susceptible to an authorization issue that can lead to the disclosure of sensitive information. Attackers with Subscriber-level access or higher can view all booking records in the database. This includes personally identifiable information (PII) such as names, email addresses, phone numbers, physical addresses, payment status, booking costs, and booking hashes belonging to other users.

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is susceptible to unauthorized modification of data. This is due to a missing ownership check within the `dnd codedropz upload delete()` function. This allows unauthenticated attackers to delete arbitrary uploaded files when the "Send attachments as links" setting is enabled.

The WP-Members Membership Plugin for WordPress is susceptible to Stored Cross-Site Scripting through the Multiple Checkbox and Multiple Select user profile fields. Insufficient input sanitization and output escaping allow authenticated attackers with Subscriber-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress is susceptible to a blind SQL injection issue. This is due to inadequate escaping of user-supplied parameters and insufficient preparation of existing SQL queries. Specifically, the `order` and `append where sql` parameters are vulnerable. This allows unauthenticated attackers to append additional SQL queries to existing queries, potentially extracting sensitive information from the database.

The Brevo for WooCommerce plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `user connection id` parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.

The Customer Reviews for WooCommerce plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `displayName` parameter. Insufficient input sanitization and output escaping allows authenticated attackers with customer-level access or higher to inject arbitrary web scripts into pages. These scripts execute when a user accesses the injected page. While invoking the AJAX action typically requires authentication, an attacker could potentially bypass this requirement if guest checkout is enabled and a valid form ID is obtained through placing an order.

The User Activity Log plugin has an issue where the failed-login handler `ual shook wp login failed` does not perform a capability check. This allows unauthenticated attackers to modify site options using `update option()` calls. Specifically, attackers can change options from 0 to a non-zero value, potentially reopening registration or corrupting options like `wp user roles`, which can disrupt access to the wp-admin interface.