Chinhnguyen

The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress plugin before 3.15.2 settings and stored form submissions, overwrite the Ninja Forms WordPress plugin before 3.15.2's configuration, and create or modify arbitrary posts and pages. The capability belongs to no default WordPress role and the Ninja Forms WordPress plugin before 3.15.2 never grants it, so an administrator must have assigned it, typically when delegating access to the form builder.

**Name of the Vulnerable Software and Affected Versions** Thunderbird versions prior to 153.2 Thunderbird versions prior to 155 **Description** The `mail.allowed attachment hostnames` advanced configuration setting is used in a regular expression without proper escaping. This flaw allows certain unintended hostnames to match the expression, potentially enabling the serving of remote attachments from unauthorized hosts. **Recommendations** Update Thunderbird to version 153.2 or later. Update Thunderbird to version 155 or later.

**Name of the Vulnerable Software and Affected Versions** Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder versions prior to 6.2.9 **Description** An Insecure Direct Object Reference exists due to missing validation on a user-controlled key. Unauthenticated attackers can brute-force valid transaction hashes using the `transaction` parameter to view sensitive payment receipt data of other users, including customer names, email addresses, billing addresses, order items, payment methods, and payment status. This is possible because the submission ID, form ID, and transaction creation time are observable or guessable, limiting the brute-force space to approximately 900 candidates per second per submission and form pair. **Recommendations** Update the plugin to version 6.2.9 or later. As a temporary mitigation, restrict access to the `transaction` parameter to minimize the risk of unauthorized data exposure.