Benedictus Jovan

Sensitive information exposure occurs via the JSON-LD REST API endpoints. The plugin registers the '/wordlift/v1/jsonld/' routes, specifically 'jsonld/{id}', 'jsonld/http/{item id}', 'jsonld/post-meta/{meta key}', 'jsonld/meta/{meta key}', and 'jsonld/{post type}/{post name}', using a `permission callback` of ` return true`. Because the downstream converter uses the `get post()` function without verifying the post status or the capabilities of the requesting user, unauthenticated attackers can bypass WordPress core access controls. By enumerating post IDs, attackers can access the title, content, author, publication and modification dates, word count, comment count, and other metadata of private, draft, and pending posts.

An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can leverage the store's stored authentication token to create and cancel shipping orders via an external logistics API. Additionally, attackers can modify arbitrary WooCommerce order post meta, overwrite the stored API token, and trigger shipping notification emails to customers.

An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can modify arbitrary WooCommerce product metadata. Affected data includes the Empik logistic class ` empik logistic klass`, product state ` empik product state` and ` empik product state all variants`, as well as Empik export and offer flags for any product in the store.

The plugin contains a missing authorization flaw. The `license activate fleximp()` and `license deactivate fleximp()` functions, which are linked to the `wp ajax license activate fleximp` and `wp ajax license deactivate fleximp` AJAX actions, do not perform capability checks using `current user can()` or validate nonces. This allows authenticated users with subscriber-level access or higher to activate fraudulent license keys by modifying `fleximp is premium` via `update option()` or deactivate legitimate licenses by setting `fleximp validation status` to false, which disrupts premium features.

An authorization bypass exists because the software fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can exploit this to overwrite the API key stored in `wp options`, modify plugin settings, and alter WooCommerce tax rate data within the `wp woocommerce tax rates` table. This is achieved through the AJAX actions `s123 submit api key()` and `s123 submit invoice settings()`.

An unauthenticated SQL Injection exists in the system, allowing an attacker to execute arbitrary SQL commands without providing credentials.

The plugin is susceptible to sensitive information exposure through the `yapacdev generate order pdf` function. Unauthenticated attackers can extract personally identifiable information (PII) and order details—such as full names, email addresses, phone numbers, billing addresses, ordered items, quantities, prices, coupons, shipping methods, and order totals—by enumerating sequential order IDs. This occurs because invoice HTML files are stored in the publicly accessible `wp-content/uploads/whatsorder invoices/` directory without an `.htaccess` deny rule or `index.php` guard, allowing direct downloads over HTTP without authentication.

The plugin fails to properly verify user authorization for specific actions. This allows authenticated attackers with subscriber-level access or higher to delete the site's security.txt file from the server filesystem or create the .well-known directory. This is achieved by directly invoking the AJAX actions `delete securitytxt` and `create wellknown folder`.

An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can trigger outbound scraping of external websites and write the resulting data into the `wp dp reviews` database table. Additionally, this flaw allows attackers to send feature-request emails using the site administrator's email address.

Improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. This occurs when the application fails to properly sanitize user-supplied data before including it in a database query, enabling an attacker to infer information from the database by observing the application's response to specific queries.

Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the `peachpay stripe handle admin actions()` function. A nonce is a unique token used to prevent the replay of requests. This flaw allows unauthenticated attackers to permanently delete stored Stripe credentials from the WordPress database, including secret keys, publishable keys, webhook secrets, and Apple Pay configuration, by tricking a site administrator into clicking a malicious link. This action effectively disables Stripe payment processing for the store.

The issue is a Stored Cross-Site Scripting problem due to insufficient input sanitization and output escaping, allowing authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts in pages. This affects multi-site installations and installations where unfiltered html has been disabled.

The issue arises from a missing capability check on the `ajax()` function, allowing authenticated attackers with subscriber-level access and above to perform unauthorized actions, such as editing pricing tables.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `ajax()` function. This allows unauthenticated attackers to perform various actions related to managing pricing tables by tricking a site administrator into performing an action, such as clicking on a link.

Name of the Vulnerable Software and Affected Versions: Snippet Shortcodes plugin for WordPress versions up to, and including, 4.1.4 Description: The issue is due to missing or incorrect nonce validation when adding or editing shortcodes, making it possible for unauthenticated attackers to modify shortcodes via a forged request. This can be achieved if an attacker can trick a site administrator into performing an action, such as clicking on a link. Recommendations: For versions up to, and including, 4.1.4, update to a version higher than 4.1.4 to resolve the issue. As a temporary workaround, consider restricting access to shortcode editing and addition functionality to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Custom Product List Table plugin for WordPress versions up to, and including, 3.0.0 Description: The issue is due to missing or incorrect nonce validation when modifying products, making it possible for unauthenticated attackers to add, delete, bulk edit, approve, or cancel products via a forged request. This can happen if an attacker can trick a site administrator into performing an action, such as clicking on a link. Recommendations: For versions up to, and including, 3.0.0, update to a version that includes proper nonce validation to prevent Cross-Site Request Forgery attacks. As a temporary workaround, consider restricting access to product modification features to minimize the risk of exploitation.

The issue allows authenticated attackers with subscriber access or above to modify the plugin's settings due to a missing capability check on the `disable fe assets` function. Additionally, the lack of a nonce check results in a CSRF vulnerability, enabling attackers to change the plugin's settings without proper validation.

The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue only affects multi-site installations and installations where unfiltered html has been disabled.

The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue only affects multi-site installations and installations where unfiltered html has been disabled.

The issue is related to Cross-Site Request Forgery. This occurs because the plugin improperly releases the tagged and patched version, using the vulnerable version as core files, while the patched version is included in a 'trunk' folder. This allows unauthenticated attackers to perform various actions via a forged request if they can trick a site administrator into performing an action, such as clicking on a link.