Choriyev Qahramon

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or overwrite the Booking Manager WordPress plugin before 2.1.21's per-user settings on arbitrary users, including administrators.

**Name of the Vulnerable Software and Affected Versions** Blog2Social plugin for WordPress versions prior to 9.1.0 **Description** Low-privileged users can enumerate WordPress user accounts. The `b2s get select mandant user` AJAX handler in includes/Ajax/Get.php resolves arbitrary user IDs provided in the `owner` parameter to display names without verifying if the caller is authorized to access user account data. This allows any user with the `edit posts` capability to map WordPress user IDs to display names and confirm the existence of accounts for arbitrary IDs. **Recommendations** Update the Blog2Social plugin for WordPress to version 9.1.0 or later.

**Name of the Vulnerable Software and Affected Versions** Blog2Social plugin for WordPress versions prior to 9.1.0 **Description** Low-privileged accounts can access the email addresses of all registered WordPress users. The issue occurs because the `b2s search user` AJAX handler in `includes/Ajax/Get.php` calls the `searchUser()` function in `includes/Tools.php` without verifying if the requester has the `list users` capability. Consequently, any user with the `edit posts` capability can retrieve email addresses, including those of administrators. **Recommendations** Update Blog2Social plugin for WordPress to version 9.1.0 or later.

Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2s calendar move post AJAX handler in includes/Ajax/Post.php issues an UPDATE against the b2s posts table using only the attacker-supplied b2s id primary key with no blog user id ownership constraint, allowing any user with the edit posts capability to reschedule, suppress, or alter the publication state of any other user's scheduled social media post.

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or nonce verification. Attackers can force the plugin to use Basic HTTP authentication regardless of configured JWT or API token settings, then exploit distinguishable error codes and the absence of rate limiting to perform unthrottled username enumeration and credential guessing attacks.