Audrey François

**Name of the Vulnerable Software and Affected Versions** The Sunshine Photo Cart: Free Client Photo Galleries for Photographers plugin for WordPress versions up to, and including, 3.4.11 **Description** The issue is related to privilege escalation via account takeover due to the plugin not properly validating a user-supplied key. This allows authenticated attackers with Subscriber-level access and above to change arbitrary users' passwords, including administrators, through the password reset functionality. This can be leveraged to reset the user's password and gain access to their account. **Recommendations** For versions up to, and including, 3.4.11, update to a version that properly validates user-supplied keys to prevent privilege escalation. As a temporary workaround, consider restricting access to the password reset functionality to minimize the risk of exploitation. Restrict access to the plugin's settings and functionality to trusted users only, to reduce the potential for account takeover.

**Name of the Vulnerable Software and Affected Versions** Download Manager plugin for WordPress versions up to, and including, 3.3.12 **Description** The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the `savePackage` function. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted, such as `wp-config.php`. **Recommendations** For versions up to, and including, 3.3.12, update to a version that fixes the `savePackage` function issue to prevent arbitrary file deletion. As a temporary workaround, consider disabling the `savePackage` function until a patch is available. Restrict access to the Download Manager plugin to minimize the risk of exploitation. Avoid using the plugin until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Password Protected plugin versions up to, and including, 2.7.7 **Description** The issue allows unauthenticated attackers to extract sensitive data, including all protected site content, if the 'Use Transient' setting is enabled. This is possible due to sensitive information exposure via the `password protected cookie` function. **Recommendations** For Password Protected plugin versions up to, and including, 2.7.7, consider disabling the `password protected cookie` function until a patch is available. Additionally, disabling the 'Use Transient' setting may help minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Event Tickets and Registration plugin for WordPress versions up to, and including, 5.19.1.1 **Description** The issue is related to a missing capability check on the `ajax ticket delete` function, allowing authenticated attackers with Contributor-level access and above to delete arbitrary Attendee tickets, resulting in unauthorized loss of data. **Recommendations** For versions up to, and including, 5.19.1.1, consider disabling the `ajax ticket delete` function until a patch is available to prevent unauthorized deletion of Attendee tickets. Restrict access to the `ajax ticket delete` function to minimize the risk of exploitation.