Artus Kg

On multisite installations, the plugin fails to verify network-level capabilities before processing a network-scope parameter on its snippet import routes. This allows an administrator of a single subsite, who lacks network-management rights, to create, overwrite, and deactivate snippets that apply to the entire network.

An issue exists where the plugin fails to perform authorization or publication-status checks in an AJAX action. This allows unauthenticated users to access the full contents of unpublished property listings, including the private name, email address, phone number, and office address of the listing agent, leading to sensitive information exposure.

An issue exists where the plugin fails to restrict the recipient of a contact email action due to a missing capability check on a function. This allows unauthenticated users to send emails to arbitrary addresses through the site, while controlling the sender header and the message body.

An issue exists where the plugin fails to perform publication-status or authorization checks in two of its AJAX actions. This is caused by a missing capability check on a function, which allows unauthenticated users to retrieve images attached to property listings that have not been published.

An issue exists where the plugin fails to verify if a listing package selected for free activation is actually free or if the requesting user is entitled to it. This is caused by a missing capability check on a function, allowing authenticated users with customer-level access and above to activate paid packages without payment, resulting in the site recording a paid invoice at the full price.

The plugin fails to verify the signature on an unauthenticated webhook endpoint when no shared secret is configured, which is the default setting. This allows unauthenticated users to replace the thumbnail image published for any document.

The plugin fails to restrict its reports REST endpoints to users with management capabilities. This allows any authenticated user with subscriber-level access or higher to extract sensitive information, specifically the email addresses of the repository staff.

The plugin fails to prevent low-privileged users from providing a template body that the bundled templating engine compiles and executes as PHP. This occurs due to insufficient validation of user-supplied input, allowing authenticated attackers with the Contributor role or higher to perform Remote Code Execution (RCE), which is the ability to run arbitrary code on the server.

Insufficient authorization checks in several AJAX actions allow users with the Contributor role or higher to read, modify, and delete galleries belonging to other users and site-wide gallery filters.

Insufficient per-record authorization in several AI Abilities API actions allows an authenticated user with the LatePoint Agent role to bypass restrictions. When the Abilities API feature is enabled, an attacker can read and modify profile data of other agents, as well as access bookings and associated customer details belonging to other agents.

Insufficient restriction of callbacks used to resolve schema field default values allows authenticated users with Author-level access and above to store input that discloses sensitive data. This can lead to the exposure of other users' password hashes and arbitrary site option values in public output accessible to unauthenticated visitors.

The plugin fails to perform authorization checks on several actions and exposes its management page to any logged-in user. This allows users with low-privileged roles, such as Subscriber, to store display-targeting values. These values are subsequently invoked as zero-argument PHP callables—functions that can be called without passing any arguments—during public page loads, which can result in sensitive information disclosure and denial of service.

An unauthenticated AJAX handler fails to perform an authorization check, which allows unauthenticated users to read contact records of quote-request submissions. This includes access to records that the site has not published.

The plugin fails to perform a capability check on an account-connection action, relying solely on nonce verification. This allows authenticated users with minimal privileges, such as Subscribers, to overwrite site-wide configuration options, including the linked service account and API configuration, which should be restricted to administrators.

When the secret key is not configured, which occurs immediately after activation, the plugin fails to verify that payment callbacks originate from the legitimate payment provider. This allows unauthenticated attackers to modify the status of arbitrary orders, such as marking unpaid orders as paid and reducing stock levels.

The plugin fails to enforce site-wide access restrictions on the WordPress REST API. This allows unauthenticated users to read the content of published posts and pages that were intended to be hidden by the site's access mode configuration.

Two admin AJAX handlers fail to perform a capability check, which allows any authenticated subscriber to read the email addresses of other users and trigger a cross-user CRM re-sync.

Insufficient validation of the URI scheme in a user-supplied value allows users with the contributor role and above to store a malicious payload. This payload executes in the browser of any user who follows the link, including administrators previewing unpublished submissions.

Insufficient sanitization and escaping of data stored from payment callbacks allows unauthenticated users to store malicious scripts. These scripts execute within the session of a store administrator when viewed on an admin page. This issue occurs when the gateway is enabled without credentials, as the integrity check on the callbacks can be forged.

The plugin fails to enforce intended capability checks on several read REST routes. This allows any authenticated user to access attachment metadata and site-wide statistics, information that should be restricted to users with administrator privileges.