Bashu

**Name of the Vulnerable Software and Affected Versions** Wishlist Member versions prior to 3.34.2 **Description** Insufficient verification of data authenticity allows unauthenticated attackers to take over any WordPress account, including those with administrator privileges. The issue occurs within the `wpm register()` function, which validates the registration cookie only against the `reg` GET parameter but fails to verify that the `mergewith` POST parameter references a temporary or incomplete registrant bound to the current transaction. By providing an arbitrary user ID in the `mergewith` parameter, an attacker can trigger `wp update user()` to overwrite the target account's username, password, email, and name with attacker-controlled values. Furthermore, password and email change notifications are suppressed. If the `wpm id` POST parameter references a non-existent membership level, the target user's existing role is preserved, leading to full privilege escalation. **Recommendations** Update Wishlist Member to a version newer than 3.34.1. As a temporary workaround, restrict access to the registration functionality that utilizes the `wpm register()` function.

**Name of the Vulnerable Software and Affected Versions** Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) versions prior to 2.3.3 **Description** An arbitrary file upload issue exists due to missing authorization and nonce validation in the `eco save settings()` function. This allows authenticated users with Subscriber-level access or higher to modify the `tc eco custom file types` upload allowlist setting. When combined with insufficient authorization on the `wc eco upload file` AJAX action, attackers can enable PHP uploads and upload a PHP file using the frontend upload nonce found on cart and checkout pages, leading to remote code execution. **Recommendations** Update to a version newer than 2.3.2.

**Name of the Vulnerable Software and Affected Versions** Lumise Product Designer for WooCommerce versions prior to 2.1.2 **Description** Unauthenticated attackers can perform SQL Injection by manipulating the `id` and `table` parameters within an uploaded cart JSON file. This issue occurs during the processing of the checkout AJAX action in the `find resource()` function, where user-supplied parameters are appended to a raw SQL query without sufficient escaping. Specifically, the `id` field is interpolated without quotes into a WHERE clause and the `table` field is interpolated into the FROM clause, bypassing protections like `wp magic quotes` or `$wpdb->prepare()`. This allows for the execution of additional SQL queries to extract sensitive information from the database. **Recommendations** Update to a version newer than 2.1.1. As a temporary mitigation, restrict the ability to upload cart JSON files until the update is applied.

**Name of the Vulnerable Software and Affected Versions** LatePoint – Calendar Booking Plugin for Appointments and Events versions through 5.2.7 **Description** The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is susceptible to privilege escalation through a flaw in the password reset functionality. The issue stems from the plugin permitting users with a LatePoint Agent role, while creating new customers, to define the `wordpress user id` field. This allows authenticated attackers possessing Agent-level access or higher to obtain elevated privileges by associating a customer with an arbitrary user ID, potentially including administrators, and subsequently resetting the password. The `wordpress user id` field is used to link a customer to a WordPress user account. **Recommendations** Versions prior to 5.2.7 should be updated to address this issue.

**Name of the Vulnerable Software and Affected Versions** Product Table and List Builder for WooCommerce Lite versions prior to 4.6.3 **Description** The Product Table and List Builder for WooCommerce Lite plugin for WordPress is susceptible to time-based SQL Injection. This is due to inadequate escaping of user-supplied input in the `search` parameter and insufficient preparation of the existing SQL query. This allows unauthenticated attackers to inject additional SQL queries into existing queries, potentially extracting sensitive information from the database. **Recommendations** Update to version 4.6.3 or later.

**Name of the Vulnerable Software and Affected Versions** SiteOrigin Widgets Bundle versions prior to 1.70.5 **Description** The SiteOrigin Widgets Bundle plugin for WordPress is susceptible to unauthorized arbitrary shortcode execution. This is caused by a missing capability check within the `siteorigin widget preview widget action()` function, which is registered through the `wp ajax so widgets preview` AJAX action. The function verifies a nonce (`widgets action`) but does not confirm user capabilities, allowing authenticated attackers with Subscriber-level access or higher to execute arbitrary shortcodes. The necessary nonce is exposed on the public frontend when the Post Carousel widget is present on a page, embedded within the `data-ajax-url` HTML attribute. Attackers can invoke the `SiteOrigin Widget Editor Widget` via the preview endpoint to exploit this issue. **Recommendations** Update SiteOrigin Widgets Bundle to version 1.70.5 or later.