Chloe Chamberland

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withdraw method field` parameter of the `tutor save withdraw account` AJAX handler. This is due to the handler lacking any capability or role check, relying solely on a nonce, while also passing attacker-supplied values through `esc sql()`, which replaces every `%` character with a 66-byte HMAC placeholder token before the data is serialized and stored via `update user meta()`; when the meta is later retrieved, the placeholder is collapsed back to a single `%`, leaving serialized string length declarations 65 bytes greater than the actual content, and because array keys originate from entirely unescaped POST field names, `unserialize()` over-reads into attacker-controlled bytes, allowing injection of an arbitrary serialized object stream. This makes it possible for authenticated attackers, with subscriber-level access and above, to achieve remote code execution on the server by triggering the `GuzzleHttpCookieFileCookieJar` POP chain, reachable via the `spl autoload register` loader in `TUTORRestAPI` which loads the plugin's own bundled PayPal Composer autoloader, writing attacker-controlled content to an attacker-specified filename. This has an unauthenticated pathway when user registration is enabled, which is common for students and teachers to register, and it requires the monetization feature to be enabled.

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is safe widget instance() object check and reach the callable-invocation sink in Element Classes::parse array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do blocks() processes the single-event HTML including the comment area.

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is safe widget instance function. This is due to insufficient protection in is safe widget instance, which can be bypassed because PHP fires magic methods during its pre-parse, combined with enable rendering widget copied() forging a valid wp hash integrity attribute before unserialize() is reached. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable without authentication or approval because the plugin's V2 single-event template runs do blocks() over buffered comment HTML, and WordPress returns a moderation-hash URL that allows an unauthenticated commenter to immediately view their own pending comment, delivering the injected block markup to the vulnerable code path before any moderation occurs. This does require comments to be enabled and visible on events.

**Name of the Vulnerable Software and Affected Versions** ComboBlocks versions 2.2.32 through 2.3.1 **Description** The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress contains an Unauthenticated Hook Injection flaw. This issue occurs through several functions within the `~/includes/blocks/form-wrap/function.php` file, allowing unauthenticated attackers to execute actions using WordPress hooks, provided no other security controls are present in the function. **Recommendations** Update ComboBlocks to a version later than 2.3.1. As a temporary mitigation, restrict access to the `~/includes/blocks/form-wrap/function.php` file.

**Name of the Vulnerable Software and Affected Versions** Wholesale for WooCommerce versions prior to 2.0.6 **Description** Authenticated users with author-level access and above can escalate their privileges to administrator. The issue exists in the `save requests meta()` function, which fails to perform capability checks, such as `current user can('promote users')` or `current user can('manage options')`, and lacks allowlist validation for the `user role set` POST parameter. Because the `wwp requests` post type is registered with `capability type => 'post'`, authors who have created a request can access the `request user role nonce` nonce and submit a crafted request with the `user role set` variable set to `administrator` to gain full administrative control. **Recommendations** Update Wholesale for WooCommerce to version 2.0.6 or later.

**Name of the Vulnerable Software and Affected Versions** Premium Addons for Elementor – Powerful Elementor Templates & Widgets versions prior to 4.11.85 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts through the `premium tooltip text` parameter. The payload executes when an administrator or a higher-privileged user opens the affected post in the Elementor editor, as the raw unescaped output is processed via the `print template()` function registered on the `elementor/section/print template` hook. **Recommendations** Update to version 4.11.85 or later. As a temporary mitigation, restrict access to the `premium tooltip text` parameter for users with contributor-level permissions.

**Name of the Vulnerable Software and Affected Versions** Post Export Import with Media versions prior to 1.13.2 **Description** An arbitrary file upload issue exists due to insufficient file extension validation. The `ajax import media start()` function uses `pathinfo()` on raw ZIP entry names, which can be bypassed using a trailing-dot filename (e.g., 'shell.php.'). This bypass results in an empty string for the extension, skipping the allow-list check. Subsequently, the `import media file secure()` function copies the file into the WordPress uploads directory without further validation. Authenticated attackers with administrator-level access or higher can exploit this to upload executable files, potentially leading to remote code execution. **Recommendations** Update to a version newer than 1.13.1. As a temporary workaround, restrict access to the `import media file secure()` function and the ZIP media import feature.

**Name of the Vulnerable Software and Affected Versions** AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress versions prior to 10.10.3 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via the `alignment` attribute, enabling the injection of arbitrary web scripts into pages that execute when accessed by other users. **Recommendations** Update AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress to version 10.10.3 or later.

**Name of the Vulnerable Software and Affected Versions** JoomSport – for Sports: Team & League, Football, Hockey & more versions prior to 5.7.9 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can create arbitrary season groups or modify existing group names, participants, and round-type options. This exploitation requires the `joomsportajaxnonce`, which is exposed on frontend pages that render a JoomSport shortcode. **Recommendations** Update JoomSport – for Sports: Team & League, Football, Hockey & more to version 5.7.9 or later.

**Name of the Vulnerable Software and Affected Versions** RegistrationMagic – User Registration Forms Plugin versions prior to 6.0.9.2 **Description** This issue involves a Cross-Site Request Forgery (CSRF) flaw, which occurs when a web application fails to verify that a request was intentionally initiated by the user. The flaw exists in the `process request()` function due to missing or incorrect nonce validation. An unauthenticated attacker can exploit this by tricking a site administrator into clicking a malicious link, allowing the attacker to escalate the privileges of a form submitter to administrator by creating a malicious Chronos automation task executed via WordPress cron. **Recommendations** Update RegistrationMagic – User Registration Forms Plugin to version 6.0.9.2 or later. As a temporary mitigation, restrict access to the `process request()` function to prevent unauthorized requests.

**Name of the Vulnerable Software and Affected Versions** JoomSport – for Sports: Team & League, Football, Hockey & more versions prior to 5.7.9 **Description** An authorization flaw exists in the `joomsport season groupdel()` AJAX handler. The system fails to perform a capability check, verifying only a nonce before executing a DELETE query on group IDs provided by the user. This allows authenticated users with Subscriber-level access or higher to delete arbitrary JoomSport group records. **Recommendations** Update to a version newer than 5.7.8. As a temporary mitigation, restrict access to the `joomsport season groupdel()` AJAX handler for users with Subscriber-level permissions.

**Name of the Vulnerable Software and Affected Versions** SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery versions prior to 3.9.6 **Description** An issue exists that allows unauthenticated attackers to perform privilege escalation via account takeover. The plugin fails to properly validate a user's identity before updating account details, such as resetting passwords. This allows an attacker to change the email addresses of arbitrary users, including administrators, to reset their passwords and gain full account access. This issue specifically affects sites where OTP (One-Time Password) verification for password resets is enabled and the target user has a phone number configured for OTP verification. **Recommendations** Update the plugin to version 3.9.6 or later.

**Name of the Vulnerable Software and Affected Versions** Groundhogg versions prior to 4.5.6 **Description** The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress contains a generic SQL Injection flaw. This occurs because the software fails to properly escape user-supplied input and lacks sufficient preparation of the SQL query. Authenticated attackers with marketer-level access or higher can exploit this by appending malicious SQL queries via the `search` parameter to extract sensitive information from the database. **Recommendations** Update the plugin to a version newer than 4.5.5. Avoid using the `search` parameter if the plugin cannot be updated immediately.

**Name of the Vulnerable Software and Affected Versions** CodePeople Post Map for Google Maps versions prior to 1.2.7 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts via the `cpm point` Post Meta, which execute when a user accesses the affected page. **Recommendations** Update CodePeople Post Map for Google Maps to version 1.2.7 or later.

**Name of the Vulnerable Software and Affected Versions** Groundhogg versions prior to 4.5.6 **Description** The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress contains a SQL Injection flaw. Authenticated attackers with Sales Representative-level access or higher can append malicious SQL queries to existing ones to extract sensitive database information. This occurs because of insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. The issue can be triggered via the `query[select]` parameter. Furthermore, the sanitized `Contact Query` code path can be bypassed by providing an invalid filter type in the `query[filters][0][0][type]` parameter, which triggers a `FilterException` and forces the application to use the unsanitized `Legacy Contact Query` path. **Recommendations** Update the plugin to a version newer than 4.5.5. Avoid using the `query[select]` parameter in the affected plugin until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Simple File List versions prior to 6.3.8 **Description** The Simple File List plugin for WordPress contains a flaw where a missing authorization check on the `frontmanage` shortcode attribute allows authenticated attackers with contributor-level access or higher to perform unauthorized file operations. These operations include deleting, moving, creating folders, and downloading files. An attacker can exploit this by creating a draft post with the `eeSFL` shortcode and using the post preview endpoint to obtain a nonce, which is a unique token used to prevent cross-site request forgery, to authorize requests that bypass checks in the `includes/ee-list-ops-bar-process.php` file. **Recommendations** Update to a version later than 6.3.7.

**Name of the Vulnerable Software and Affected Versions** Simple File List versions prior to 6.3.8 **Description** The Simple File List plugin for WordPress contains insufficient authorization checks that allow unauthenticated attackers to delete and modify files on the server. This issue occurs within the `simplefilelist edit job` AJAX action. The flaw persists even if the `AllowFrontManage` setting is disabled because the `is admin()` function unconditionally bypasses the security guard before the setting is evaluated. **Recommendations** Update the plugin to a version later than 6.3.7.

**Name of the Vulnerable Software and Affected Versions** Simple File List versions prior to 6.3.8 **Description** The Simple File List plugin for WordPress contains a flaw allowing unauthenticated attackers to delete arbitrary files on the server. This occurs due to insufficient file path validation within the `eeSFL DeleteFile()` function, specifically involving the `eeSubFolder` parameter. The issue is accessible via the 'simplefilelist edit job' AJAX action, which is registered for non-privileged users. The `is admin()` security guard is bypassed because it returns true for all requests sent to the 'admin-ajax.php' endpoint. Deleting critical files, such as 'wp-config.php', can lead to remote code execution (the ability to execute arbitrary commands on the target machine). **Recommendations** Update to a version later than 6.3.7. As a temporary workaround, restrict access to the 'admin-ajax.php' endpoint or the 'simplefilelist edit job' action to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Appointment Booking Calendar versions prior to 1.4.02 **Description** The plugin is subject to sensitive information exposure due to insufficient authorization and a lack of per-calendar ownership verification within the `cpabc appointments calendar load2()` function. This function is accessible via the `cpabc calendar load2=1` query parameter in 'wp-admin'. The system only verifies if the user is an administrator or has the `edit posts` capability, which is granted to users with Contributor-level access and above. Consequently, authenticated attackers with these privileges can provide an arbitrary calendar ID through the `id` parameter to extract customer booking data, such as names, email addresses, phone numbers, booking times, and comments, from any calendar managed by the plugin. **Recommendations** Update the plugin to a version later than 1.4.01. As a temporary workaround, restrict access to the `cpabc appointments calendar load2()` function or the `id` parameter in the 'wp-admin' area for users with Contributor-level privileges.

**Name of the Vulnerable Software and Affected Versions** Customize My Account For Woocommerce versions prior to 4.3.7 **Description** The Customize My Account For Woocommerce plugin for WordPress contains a Stored Cross-Site Scripting issue via the 'sysbasics user avatar' shortcode. The problem arises from insufficient input sanitization and output escaping within the `wcmamtx get avatar default()` function. Specifically, user-supplied attributes `min height`, `min width`, `max height`, and `max width` are concatenated unescaped into the `extra attr` style attribute of the `get avatar()` function. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update to a version later than 4.3.6. As a temporary workaround, restrict the use of the 'sysbasics user avatar' shortcode or limit the permissions of users who can edit pages to prevent the injection of malicious attributes.