Crow

The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa locale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Notably, exploitation does not require authentication in practice, as the locale filter is installed unconditionally on every request during plugins loaded and the callback performs no nonce or capability check before returning the raw GET parameter value.

**Name of the Vulnerable Software and Affected Versions** Online Scheduling and Appointment Booking System – Bookly versions prior to 28.3 **Description** An authorization bypass exists due to PHP Type Juggling, a condition where PHP converts a variable from one data type to another during a comparison. The `postValidateCustomer()` function uses a loose inequality operator (`!=`) to compare a session-stored verification code with the `verification code` parameter. Because the `json data` input channel uses `json decode()`, an attacker can submit a boolean `true` value, which satisfies the loose comparison against the non-zero integer code, bypassing the verification guard. This issue is exacerbated by the booking AJAX controller registering methods as `wp ajax nopriv ` handlers and overriding `csrfTokenValid()` to always return true, leaving the endpoint unauthenticated and unprotected against Cross-Site Request Forgery (CSRF). Consequently, unauthenticated attackers can bypass phone or email ownership verification to overwrite the name, email, phone, and address fields of any existing customer record, redirecting booking notifications to their own contact details. **Recommendations** Update Online Scheduling and Appointment Booking System – Bookly to a version newer than 28.2.

**Name of the Vulnerable Software and Affected Versions** HUSKY – Products Filter for WooCommerce Professional versions prior to 1.4.5 **Description** The plugin is subject to Local File Inclusion, a condition where an application includes files from the local file system without proper validation. Unauthenticated attackers can exploit this via the `shortcode` parameter to include and execute arbitrary .php files on the server. This can lead to the execution of PHP code, bypassing of access controls, or the theft of sensitive data. The issue exists because the access control relies on a nonce check against `woof front nonce`, which is publicly exposed in inline JavaScript on all front-end pages, making it accessible to any visitor. **Recommendations** Update to a version newer than 1.4.4. Restrict the use of the `shortcode` parameter until the update is applied.

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'unique' parameter in all versions up to, and including, 4.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is a regression: the esc url() wrapper that remediated the equivalent CVE-2023-5749 in version 3.9.2 was removed in version 4.3.0 during a refactor that introduced the 'unique' parameter.