Baikuya

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escalate their privileges to Administrator.

**Name of the Vulnerable Software and Affected Versions** Restaurant Menu by MotoPress versions prior to 2.4.11 **Description** The Restaurant Menu and Food Ordering plugin for WordPress contains a flaw where insufficient escaping of user-supplied parameters and lack of proper preparation of SQL queries allow authenticated attackers with contributor-level access or higher to perform SQL Injection. This allows the attacker to append additional SQL queries to existing ones to extract sensitive information from the database. **Recommendations** Update the plugin to a version newer than 2.4.10.

**Name of the Vulnerable Software and Affected Versions** Groundhogg versions prior to 4.6 **Description** An authenticated attacker can exploit a SQL Injection flaw in the Sales Representative feature. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database. **Recommendations** Update Groundhogg to version 4.6 or later.

**Name of the Vulnerable Software and Affected Versions** Geo Mashup versions prior to 1.13.20 **Description** An SQL injection flaw exists in the Geo Mashup plugin, which allows users with subscriber privileges to execute unauthorized SQL commands. **Recommendations** Update to version 1.13.20 or later.

**Name of the Vulnerable Software and Affected Versions** JetFormBuilder versions prior to 3.6.2 **Description** The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress allows authenticated attackers with Subscriber-level access and above to elevate their privileges. **Recommendations** Update to a version newer than 3.6.1.

**Name of the Vulnerable Software and Affected Versions** Grav version 1.8.0-beta.29 Login Plugin versions prior to 3.8.2 **Description** A missing server-side validation issue exists in the `Login::register()` function of the Login plugin. When user registration is enabled and the `groups` or `access` fields are included in the allowed fields configuration, an unauthenticated user can inject these variables into the registration request. Because the `Login::validateField()` function does not validate the `groups` and `access` parameters, an attacker can self-register with `admin.super` privileges. This privilege escalation can lead to full administrative panel access and potentially remote code execution (RCE). **Recommendations** Update Login Plugin to version 3.8.2 or later. As a temporary workaround, remove `groups` and `access` from the `user registration.fields` list in the configuration to prevent unauthenticated users from injecting privilege levels.