Charles Vosburgh

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.

The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button, allowing members to pay for a lower-priced membership while being granted a higher, more privileged membership level.

The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job, backup-destination, and backup-execution management, allowing users holding a BackWPup WordPress plugin before 5.7.5-defined, administrator-assigned limited role to create and run backup jobs and exfiltrate a full database backup to an attacker-controlled destination.

The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid registration without paying and obtain an activated account.

**Name of the Vulnerable Software and Affected Versions** Really Simple Security versions prior to 9.8.0 **Description** In WordPress Multisite environments, a privilege escalation flaw exists where the software fails to verify if a user has the necessary permissions before installing a plugin from a user-supplied URL. This allows a subsite administrator to bypass the security boundary and install and execute arbitrary PHP code within the network-shared plugin directory, a location normally reserved for the network administrator. Exploitation is possible only if the network administrator has enabled the Really Simple Security administration menu for subsites, which is not the default configuration. **Recommendations** Update Really Simple Security to version 9.8.0 or later. Restrict network-level administrative capabilities to trusted accounts only.

**Name of the Vulnerable Software and Affected Versions** Stripe Payment Forms by WP Full Pay versions prior to 8.5.1 **Description** An Insecure Direct Object Reference (IDOR) exists where the plugin fails to verify if a subscription belongs to the customer associated with the active customer-portal session. This allows an authenticated user with a valid portal session to cancel, reactivate, or modify subscriptions belonging to other customers. **Recommendations** Update Stripe Payment Forms by WP Full Pay to version 8.5.1 or later.

**Name of the Vulnerable Software and Affected Versions** AI Engine versions prior to 3.6.1 **Description** Insufficient authorization verification during privileged user management operations allows a user with the Administrator role on a Multisite sub-site to take over any account within the network, including the Network Administrator account. **Recommendations** Update AI Engine to version 3.6.1 or later.

**Name of the Vulnerable Software and Affected Versions** Import and export users and customers versions prior to 2.4.2 **Description** The plugin fails to enforce role-assignment and per-user edit permissions during the CSV import process. This allows a user with only the capability to create users to escalate their privileges by creating an administrator account or overwriting the password or email of an existing administrator. **Recommendations** Update to version 2.4.2 or later.

The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows (such as email notifications) of forms the site owner has deactivated or unpublished.

**Name of the Vulnerable Software and Affected Versions** Apache Fory versions prior to 1.4.0 **Description** An issue exists involving the deserialization of untrusted data, which may allow class-registration checks to be bypassed during Java lambda deserialization. This specifically affects the lambda capture class. **Recommendations** Upgrade to version 1.4.0.