Chloe Chamberland

An authorization bypass exists due to improper verification before dispatching a WordPress action hook. The issue occurs when the hook name is derived from an attacker-supplied form-field value via the notification `email message` [field] placeholder and the `{action hook,...}` dynamic-data token. This allows unauthenticated attackers to invoke arbitrary WordPress action hooks, which can lead to permanent destruction of site content, such as the deletion of trashed posts, pages, and comments through the `wp scheduled delete` action. Additionally, it can cause denial of service via `wp maybe auto update` or enable privileged writes if vulnerable third-party handlers are present. The same pipeline allows for a blind arbitrary user or post-meta read, although the result is only delivered to the site owner. Exploitation requires a published Avada form with AJAX submission and a notification template containing an `[all fields]` or explicit `[field]` placeholder.

Unauthenticated attackers can achieve Remote Code Execution on the server through the `parse array()` function in `Element Classes::parse array()`. The issue stems from insufficient validation of the widget `classes` map, which allows a plain-array payload to bypass the `is safe widget instance()` object check and reach a callable-invocation sink. This attack chain is triggered when `do blocks()` processes the single-event HTML including the comment area. Successful exploitation requires that the site has comments enabled on `tribe events` posts and that a comment containing a crafted `wp:legacy-widget` block has been submitted.

Unauthenticated attackers can achieve Remote Code Execution on the server due to insufficient protection in the `is safe widget instance()` function. The issue arises because PHP magic methods are triggered during pre-parse, and the `enable rendering widget copied()` function can forge a valid `wp hash` integrity attribute before the `unserialize()` function is reached. This allows for PHP Object Injection. The flaw is exploitable when comments are enabled and visible on events, as the V2 single-event template processes `do blocks()` over buffered comment HTML. An unauthenticated commenter can use a moderation-hash URL to view their pending comment immediately, delivering injected block markup to the vulnerable code path before moderation occurs.

The Tutor LMS plugin for WordPress is affected by a PHP Object Injection issue that can lead to remote code execution on over 100,000 sites worldwide. The flaw exists in the `tutor save withdraw account` AJAX handler via the `withdraw method field` parameter. The handler lacks proper capability or role checks, relying only on a nonce. The issue occurs because `esc sql()` is misapplied to values stored via `update user meta()`, causing a serialization length desynchronization where the serialized string length is 65 bytes larger than the actual content. This allows `unserialize()` to over-read into attacker-controlled POST keys and inject an arbitrary serialized object stream. Attackers with subscriber-level access or higher can trigger the `GuzzleHttpCookieFileCookieJar` POP chain (Property-Oriented Programming) via the `spl autoload register` loader in `TUTORRestAPI`, enabling them to write arbitrary content to a file on the server. This can be exploited by unauthenticated users if user registration and the monetization feature are enabled.

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress contains an Unauthenticated Hook Injection flaw. This issue occurs through several functions within the `~/includes/blocks/form-wrap/function.php` file, allowing unauthenticated attackers to execute actions using WordPress hooks, provided no other security controls are present in the function.

Authenticated users with author-level access and above can escalate their privileges to administrator. The issue exists in the `save requests meta()` function, which fails to perform capability checks, such as `current user can('promote users')` or `current user can('manage options')`, and lacks allowlist validation for the `user role set` POST parameter. Because the `wwp requests` post type is registered with `capability type => 'post'`, authors who have created a request can access the `request user role nonce` nonce and submit a crafted request with the `user role set` variable set to `administrator` to gain full administrative control.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts through the `premium tooltip text` parameter. The payload executes when an administrator or a higher-privileged user opens the affected post in the Elementor editor, as the raw unescaped output is processed via the `print template()` function registered on the `elementor/section/print template` hook.

An arbitrary file upload issue exists due to insufficient file extension validation. The `ajax import media start()` function uses `pathinfo()` on raw ZIP entry names, which can be bypassed using a trailing-dot filename (e.g., 'shell.php.'). This bypass results in an empty string for the extension, skipping the allow-list check. Subsequently, the `import media file secure()` function copies the file into the WordPress uploads directory without further validation. Authenticated attackers with administrator-level access or higher can exploit this to upload executable files, potentially leading to remote code execution.

Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via the `alignment` attribute, enabling the injection of arbitrary web scripts into pages that execute when accessed by other users.

An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can create arbitrary season groups or modify existing group names, participants, and round-type options. This exploitation requires the `joomsportajaxnonce`, which is exposed on frontend pages that render a JoomSport shortcode.

An issue exists that allows unauthenticated attackers to perform privilege escalation via account takeover. The plugin fails to properly validate a user's identity before updating account details, such as resetting passwords. This allows an attacker to change the email addresses of arbitrary users, including administrators, to reset their passwords and gain full account access. This issue specifically affects sites where OTP (One-Time Password) verification for password resets is enabled and the target user has a phone number configured for OTP verification.

This issue involves a Cross-Site Request Forgery (CSRF) flaw, which occurs when a web application fails to verify that a request was intentionally initiated by the user. The flaw exists in the `process request()` function due to missing or incorrect nonce validation. An unauthenticated attacker can exploit this by tricking a site administrator into clicking a malicious link, allowing the attacker to escalate the privileges of a form submitter to administrator by creating a malicious Chronos automation task executed via WordPress cron.

An authorization flaw exists in the `joomsport season groupdel()` AJAX handler. The system fails to perform a capability check, verifying only a nonce before executing a DELETE query on group IDs provided by the user. This allows authenticated users with Subscriber-level access or higher to delete arbitrary JoomSport group records.

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress contains a SQL Injection flaw. Authenticated attackers with Sales Representative-level access or higher can append malicious SQL queries to existing ones to extract sensitive database information. This occurs because of insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. The issue can be triggered via the `query[select]` parameter. Furthermore, the sanitized `Contact Query` code path can be bypassed by providing an invalid filter type in the `query[filters][0][0][type]` parameter, which triggers a `FilterException` and forces the application to use the unsanitized `Legacy Contact Query` path.

Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts via the `cpm point` Post Meta, which execute when a user accesses the affected page.

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress contains a generic SQL Injection flaw. This occurs because the software fails to properly escape user-supplied input and lacks sufficient preparation of the SQL query. Authenticated attackers with marketer-level access or higher can exploit this by appending malicious SQL queries via the `search` parameter to extract sensitive information from the database.

The Simple File List plugin for WordPress contains a flaw where a missing authorization check on the `frontmanage` shortcode attribute allows authenticated attackers with contributor-level access or higher to perform unauthorized file operations. These operations include deleting, moving, creating folders, and downloading files. An attacker can exploit this by creating a draft post with the `eeSFL` shortcode and using the post preview endpoint to obtain a nonce, which is a unique token used to prevent cross-site request forgery, to authorize requests that bypass checks in the `includes/ee-list-ops-bar-process.php` file.

The Simple File List plugin for WordPress contains insufficient authorization checks that allow unauthenticated attackers to delete and modify files on the server. This issue occurs within the `simplefilelist edit job` AJAX action. The flaw persists even if the `AllowFrontManage` setting is disabled because the `is admin()` function unconditionally bypasses the security guard before the setting is evaluated.

The Simple File List plugin for WordPress contains a flaw allowing unauthenticated attackers to delete arbitrary files on the server. This occurs due to insufficient file path validation within the `eeSFL DeleteFile()` function, specifically involving the `eeSubFolder` parameter. The issue is accessible via the 'simplefilelist edit job' AJAX action, which is registered for non-privileged users. The `is admin()` security guard is bypassed because it returns true for all requests sent to the 'admin-ajax.php' endpoint. Deleting critical files, such as 'wp-config.php', can lead to remote code execution (the ability to execute arbitrary commands on the target machine).

The plugin is subject to sensitive information exposure due to insufficient authorization and a lack of per-calendar ownership verification within the `cpabc appointments calendar load2()` function. This function is accessible via the `cpabc calendar load2=1` query parameter in 'wp-admin'. The system only verifies if the user is an administrator or has the `edit posts` capability, which is granted to users with Contributor-level access and above. Consequently, authenticated attackers with these privileges can provide an arbitrary calendar ID through the `id` parameter to extract customer booking data, such as names, email addresses, phone numbers, booking times, and comments, from any calendar managed by the plugin.