Bashu

Insufficient verification of data authenticity allows unauthenticated attackers to take over any WordPress account, including those with administrator privileges. The issue occurs within the `wpm register()` function, which validates the registration cookie only against the `reg` GET parameter but fails to verify that the `mergewith` POST parameter references a temporary or incomplete registrant bound to the current transaction. By providing an arbitrary user ID in the `mergewith` parameter, an attacker can trigger `wp update user()` to overwrite the target account's username, password, email, and name with attacker-controlled values. Furthermore, password and email change notifications are suppressed. If the `wpm id` POST parameter references a non-existent membership level, the target user's existing role is preserved, leading to full privilege escalation.

An arbitrary file upload issue exists due to missing authorization and nonce validation in the `eco save settings()` function. This allows authenticated users with Subscriber-level access or higher to modify the `tc eco custom file types` upload allowlist setting. When combined with insufficient authorization on the `wc eco upload file` AJAX action, attackers can enable PHP uploads and upload a PHP file using the frontend upload nonce found on cart and checkout pages, leading to remote code execution.

Unauthenticated attackers can perform SQL Injection by manipulating the `id` and `table` parameters within an uploaded cart JSON file. This issue occurs during the processing of the checkout AJAX action in the `find resource()` function, where user-supplied parameters are appended to a raw SQL query without sufficient escaping. Specifically, the `id` field is interpolated without quotes into a WHERE clause and the `table` field is interpolated into the FROM clause, bypassing protections like `wp magic quotes` or `$wpdb->prepare()`. This allows for the execution of additional SQL queries to extract sensitive information from the database.

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is susceptible to privilege escalation through a flaw in the password reset functionality. The issue stems from the plugin permitting users with a LatePoint Agent role, while creating new customers, to define the `wordpress user id` field. This allows authenticated attackers possessing Agent-level access or higher to obtain elevated privileges by associating a customer with an arbitrary user ID, potentially including administrators, and subsequently resetting the password. The `wordpress user id` field is used to link a customer to a WordPress user account.

The Product Table and List Builder for WooCommerce Lite plugin for WordPress is susceptible to time-based SQL Injection. This is due to inadequate escaping of user-supplied input in the `search` parameter and insufficient preparation of the existing SQL query. This allows unauthenticated attackers to inject additional SQL queries into existing queries, potentially extracting sensitive information from the database.

The SiteOrigin Widgets Bundle plugin for WordPress is susceptible to unauthorized arbitrary shortcode execution. This is caused by a missing capability check within the `siteorigin widget preview widget action()` function, which is registered through the `wp ajax so widgets preview` AJAX action. The function verifies a nonce (`widgets action`) but does not confirm user capabilities, allowing authenticated attackers with Subscriber-level access or higher to execute arbitrary shortcodes. The necessary nonce is exposed on the public frontend when the Post Carousel widget is present on a page, embedded within the `data-ajax-url` HTML attribute. Attackers can invoke the `SiteOrigin Widget Editor Widget` via the preview endpoint to exploit this issue.