Austin Ginder

The CourseCure Courses plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.1. This is due to a missing capability check in the ajax save settings() function, which accepts arbitrary POST parameters and calls update option() with attacker-controlled keys and values without any authorization verification. This makes it possible for authenticated attackers, with subscriber-level access and above, to elevate their privileges to administrator by setting the default role WordPress option to 'administrator' and users can register to '1', then registering a new account that is automatically granted full administrator access.

Insufficient input sanitization and output escaping in the DiviGear Carousel plugin for WordPress allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via the `update license` AJAX Action, enabling the injection of arbitrary web scripts. The payload executes when an administrator accesses the DiviGear > Activation settings page, where the stored value is echoed unescaped into a single-quoted HTML value attribute.

An unauthenticated attacker can perform a generic SQL Injection by appending additional SQL queries to existing ones. This is caused by insufficient escaping of user-supplied data and a lack of proper preparation of the SQL query. The issue occurs via the `email` parameter, allowing the extraction of sensitive information from the database.

Unauthenticated attackers can perform SQL Injection, a technique used to manipulate database queries, by appending malicious SQL commands to existing queries to extract sensitive information. This occurs due to insufficient escaping of user-supplied parameters and lack of proper preparation of SQL queries. The issue is triggered when the `orderby` parameter is set to `lat lon` and affects the `latitude` and `longitude` variables. The affected REST endpoints include 'geodir/v2/locations/cities', '/regions', '/countries', and '/neighbourhoods', specifically within the `get locations()` and `get neighbourhoods()` functions.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs via the `node preview` parameter in the 'no results message' component, enabling the injection of arbitrary web scripts that execute when a user is tricked into clicking a malicious link.

An authentication bypass exists on sites not yet connected to the WPMU DEV Hub. Because the site API key used for the WDP-AUTH request signature is empty by default, the signature verified by the `validate hash()` function can be easily forged. Additionally, the `validate nonce()` function lacks a replay check, and the remote handler is bound to the public `init` hook without a capability check. This allows unauthenticated attackers to perform privileged Hub actions, such as logging in as an administrator via SSO, upgrading WordPress core, deleting themes and plugins, or installing and activating a plugin from a remote URL, which can lead to remote code execution.

The MB Frontend Submission extension contains a missing authorization flaw within the `template redirect` dispatcher. The `handle request()` function routes the `mbfs delete` action without verifying user capabilities or ownership. Additionally, nonce verification in `check ajax()` is only performed if `is ajax()` is true, which is not the case for `template redirect` requests, allowing the check to be bypassed. Consequently, unauthenticated attackers can delete arbitrary posts and pages by providing a specific post ID through the `rwmb frontend field object id` GET parameter on any page hosting a frontend submission form, even if the `allow delete` setting is disabled.

The Link Whisper Premium plugin for WordPress contains a broken access control issue. A missing capability check in a function allows authenticated users with subscriber-level permissions or higher to perform unauthorized actions.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts into pages, which execute when a user accesses the affected page.

An Insecure Direct Object Reference (IDOR) exists due to missing validation on a user-controlled key. This allows unauthenticated attackers to perform unauthorized actions. IDOR is a type of access control flaw where an application provides direct access to objects based on user-supplied input.

The GravityView plugin for WordPress contains an Insecure Direct Object Reference (IDOR) flaw. This occurs due to missing validation on a user-controlled key, allowing unauthenticated attackers to perform unauthorized actions.

The Abandoned Cart Pro for WooCommerce plugin for WordPress allows authenticated attackers with Subscriber-level access or higher to elevate their privileges to those of an administrator.

The JetBlog plugin for WordPress allows unauthenticated attackers to extract sensitive user or configuration data due to a sensitive information exposure issue.

The WooCommerce Anti-Fraud plugin for WordPress contains a broken access control issue. This is caused by a missing capability check within a function, allowing unauthenticated attackers to perform unauthorized actions.

An unauthenticated SQL Injection allows an attacker to interfere with the queries that an application makes to its database. This occurs in the JetSmartFilters WordPress plugin.