D.V4N_S3C

**Name of the Vulnerable Software and Affected Versions** Super Forms – Drag & Drop Form Builder versions prior to 6.3.317 **Description** The plugin allows unrestricted file type upload through the `upload files()` function. This occurs because the function fails to validate file types, instead using an attacker-controlled extensions string from the ` super elements` post meta as the allowed MIME type map. An authenticated attacker with Subscriber-level access or higher can poison the ` super elements` post meta using the `super save form` AJAX handler, which lacks capability and nonce checks. Once the meta is poisoned, any user can upload executable files via `super upload files` without authentication, potentially leading to remote code execution. **Recommendations** Update Super Forms – Drag & Drop Form Builder to a version newer than 6.3.316. As a temporary mitigation, restrict access to the `super save form` AJAX handler and the `super upload files` function.

**Name of the Vulnerable Software and Affected Versions** Bricksforge versions prior to 3.1.8.10 **Description** The Bricksforge plugin for WordPress contains a flaw allowing unauthenticated attackers to upload and execute arbitrary PHP code on the server. The issue stems from insufficient validation of the attacker-controlled URL field within the `temporaryFileUploads` parameter during form submission. An attacker can obtain a valid nonce via the `bricksforge regenerate nonce` AJAX endpoint and upload a GIF/PHP polyglot file (a file that is valid as both a GIF image and a PHP script) to the temporary upload directory. By submitting a form where the server-side path points to this validated GIF but the URL field ends with a `.php` extension, the attacker can force the server to save the file as a PHP script. Active exploitation has been observed, with reports of attack attempts from 63 unique IP addresses starting October 7, 2026. The vulnerability affects the Pro Forms functionality. Technical indicators include suspicious POST requests to the `/wp-json/bricksforge/v1/form submit` endpoint and the presence of unexpected PHP files in the `/wp-content/uploads/bricksforge/tmp/` directory. **Recommendations** Update Bricksforge to version 3.1.8.10 or later. As a temporary mitigation, block the `/wp-json/bricksforge/v1/form submit` endpoint at the Web Application Firewall (WAF). As a temporary mitigation, deactivate and remove the plugin. Restrict PHP execution in intended upload storage directories as a defense-in-depth measure.

**Name of the Vulnerable Software and Affected Versions** Super Forms – Drag & Drop Form Builder versions prior to 6.3.317 **Description** An issue exists in the `submit form()` function that allows unauthenticated attackers to recursively delete arbitrary directories on the server, including the WordPress root directory. This occurs because of insufficient validation of attacker-controlled JSON field declarations against the actual form schema and a non-effective ABSPATH guard that is bypassed when `dirname()` strips the trailing slash. This flaw is exploitable when the 'Delete files from server after form submissions' setting is enabled by an administrator. **Recommendations** Update to version 6.3.317 or later. Disable the 'Delete files from server after form submissions' setting as a temporary mitigation measure.

**Name of the Vulnerable Software and Affected Versions** ACPT (Premium) plugin for WordPress versions prior to 2.0.67 **Description** Authenticated attackers with subscriber-level access and above can achieve Remote Code Execution on the server. The issue stems from a missing capability check on the REST API form creation endpoint and an unsandboxed Twig environment used for rendering email templates. An attacker can exploit this by creating a form with malicious `email settings` via the REST API endpoint and subsequently triggering a form submission to execute injected Twig expressions through the `render()` function. **Recommendations** Update the ACPT (Premium) plugin for WordPress to version 2.0.67 or later.

**Name of the Vulnerable Software and Affected Versions** Super Forms – Drag & Drop Form Builder versions prior to 6.3.317 **Description** An issue exists in the Register & Login add-on where the `before email success msg()` function, during the `register login action='update'` flow, trusts a user-supplied `user id` value and passes it to `wp update user()` without verifying ownership or capabilities. Additionally, the `super save form` AJAX action lacks capability checks. This allows any authenticated user with Subscriber-level access or higher to create a malicious form and submit it with a target administrator's `user id` and new `user pass` or `user email` values, leading to account takeover and full site compromise. **Recommendations** Update Super Forms – Drag & Drop Form Builder to a version newer than 6.3.316.

**Name of the Vulnerable Software and Affected Versions** Super Forms – Drag & Drop Form Builder versions prior to 6.3.317 **Description** An issue exists in the Register & Login add-on where the `before email success msg()` function whitelists the client-submitted `role` key and copies it into the user-data array passed to `wp insert user()`. The process fails to validate the submitted role against the administrator-configured `register user role`, lacks an allow-list, and does not perform a `current user can()` capability check. This allows unauthenticated attackers to register a new account with the Administrator role by injecting `role=administrator` into the data submitted to any published registration form using the `register login action='register'` action. **Recommendations** Update Super Forms – Drag & Drop Form Builder to version 6.3.317 or later.

**Name of the Vulnerable Software and Affected Versions** Super Forms – Drag & Drop Form Builder versions prior to 6.3.317 **Description** Authenticated users with Subscriber-level access and above can recursively delete arbitrary files and directories on the server, potentially leading to a full site takedown or remote code execution. The issue occurs because the `super save form` AJAX handler lacks capability checks, allowing users to enable the `file upload submission delete` setting. Subsequently, the `submit form()` function within the `super submit form` handler passes the `files[].subdir` variable from the `$ POST['data']` array directly into the `SUPER Common::delete dir()` function without proper sanitization. A flawed `ABSPATH` guard is bypassed when the `subdir` variable is set to `wp-config.php`, as the string comparison fails to account for trailing-slash mismatches. **Recommendations** Update Super Forms – Drag & Drop Form Builder to version 6.3.317 or later.

**Name of the Vulnerable Software and Affected Versions** Abandoned Cart Pro for WooCommerce versions prior to 10.7.2 **Description** Privilege escalation is possible for authenticated users with subscriber-level access and above. The issue stems from missing capability checks and nonce verification—a security token used to prevent cross-site request forgery—on several AJAX actions: 'wcap save connector settings', 'wcap send manual email', 'wcap abandoned cart info', and 'wcap change manual email data'. Attackers can modify SMTP connector settings to route administrator recovery emails through a server they control, allowing them to intercept auto-login links and obtain full administrative access. This requires the auto-login feature to be enabled, which is the default setting. **Recommendations** Update Abandoned Cart Pro for WooCommerce to version 10.7.2 or later. As a temporary mitigation, disable the auto-login feature.

**Name of the Vulnerable Software and Affected Versions** ACPT (Premium) plugin for WordPress versions prior to 2.0.67 **Description** An issue exists where missing authorization in the `submit()` function allows unauthenticated form submissions to control the target user ID before the `wp update user()` function is called. This enables unauthenticated attackers to overwrite the email address and password of any WordPress user, including administrators, leading to full account takeover. Successful exploitation requires a public ACPT user form that permits anonymous submissions. The vulnerability involves the `acpt form post id` variable. **Recommendations** Update the ACPT (Premium) plugin for WordPress to version 2.0.67 or later.

**Name of the Vulnerable Software and Affected Versions** WPBakery Page Builder versions prior to 8.7.5 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. By using the `data` parameter, an attacker can inject arbitrary web scripts into pages. The issue occurs because the `wp kses post` sanitization function fails to neutralize base64-encoded payloads, which are then decoded and rendered unescaped by the `vc raw html` shortcode template. **Recommendations** Update the plugin to version 8.7.5 or later.

**Name of the Vulnerable Software and Affected Versions** Nokri - Job Board WordPress Theme versions prior to 1.6.7 **Description** Insufficient reset token validation in the `nokri reset password()` function allows unauthenticated attackers to perform privilege escalation via account takeover. By providing an empty reset token in the `token` parameter, an attacker can match empty or unset `sb password forget token` user meta values, enabling the password reset of any user, including administrators. **Recommendations** Update to a version newer than 1.6.6. As a temporary workaround, restrict access to the password reset functionality until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Booking for Appointments and Events Calendar – Amelia (Premium) versions 8.0 through 9.6.2 **Description** Insufficient validation of the `type` parameter in the customer update endpoint allows unauthenticated attackers to escalate privileges. By setting the `type` parameter and setting the `externalId` parameter to 0, an attacker can trigger the creation of a WordPress user with the `wpamelia-manager` role. Subsequently, the attacker can elevate their privileges to administrator by creating a provider entity linked to an administrator user ID and overwriting the administrator password. **Recommendations** Update Booking for Appointments and Events Calendar – Amelia (Premium) to a version later than 9.6.2.

**Name of the Vulnerable Software and Affected Versions** Sigma Forms Pro versions prior to 1.4.6 **Description** Remote Code Execution is possible via the `handle form submission()` function. The issue occurs because the plugin dynamically grants the `unfiltered upload` capability to all users during form submissions and bypasses MIME type validation when the `allowed file types` variable is not configured. This allows unauthenticated attackers to execute code on the server. Certain pre-built templates, such as Job Application, Support Ticket, and Wholesale Application, include file upload fields without file type restrictions by design, making the issue exploitable immediately after installation. **Recommendations** Update Sigma Forms Pro to version 1.4.6 or later. As a temporary mitigation, restrict access to or disable the use of pre-built templates containing file upload fields, such as Job Application, Support Ticket, and Wholesale Application, until the update is applied.

**Name of the Vulnerable Software and Affected Versions** AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress versions prior to 10.11.2 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can overwrite the BCC field of the `acy notification cms` notification template. This allows subsequent WordPress password-reset emails, including those for administrator accounts, to be silently copied to an address controlled by the attacker, potentially leading to account takeover via the captured reset link. This issue is exploitable only if the site administrator has enabled the "Send website emails with AcyMailing" option, which routes core WordPress notification emails through the AcyMailing templating system. **Recommendations** Update to a version newer than 10.11.1. Disable the "Send website emails with AcyMailing" option to prevent the routing of core notification emails through the vulnerable templating system.

**Name of the Vulnerable Software and Affected Versions** AI Copilot – Content Generator versions prior to 1.5.7 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can achieve full site takeover by creating a new administrator-level user account. This is accomplished by saving and executing a malicious workflow that includes a `wp create user` action node with the `role` variable set to `administrator`. The issue is exploitable on sites where the `[aiwu-form]` shortcode or a public chatbot is rendered on a frontend page, as the `waic-nonce` value is exposed in the publicly accessible JavaScript `WAIC DATA.waicNonce`, making the nonce check ineffective. **Recommendations** Update AI Copilot – Content Generator to a version later than 1.5.6.

**Name of the Vulnerable Software and Affected Versions** Taskbuilder – Project Management & Task Management Tool With Kanban Board versions prior to 5.0.9 **Description** An issue exists where authenticated attackers with subscriber-level access and above can perform SQL Injection. This occurs because the `task search` parameter is not sufficiently escaped and the SQL query is not properly prepared. Additionally, the `wppm get task list()` AJAX handler lacks capability checks and nonce verification, allowing any authenticated user to invoke it directly and append malicious SQL queries to extract sensitive information from the database. **Recommendations** Update Taskbuilder – Project Management & Task Management Tool With Kanban Board to version 5.0.9 or later.

**Name of the Vulnerable Software and Affected Versions** LatePoint – Calendar Booking Plugin for Appointments and Events versions prior to 5.6.4 **Description** An Insecure Direct Object Reference (IDOR) exists in the `create or update()` function of OsOrdersController. This allows an authenticated Agent to provide an arbitrary `order[customer id]` and overwrite the email field of any customer, including those linked to WordPress Administrator accounts, via the public-scope `set data()` call. Due to a missing role verification in `OsAuthHelper::authorize customer()`, the linked WordPress user is logged in without a role check, enabling attackers with Agent-level access or higher to elevate their privileges to Administrator. **Recommendations** Update the plugin to version 5.6.4 or later.

**Name of the Vulnerable Software and Affected Versions** User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration versions prior to 4.3.2 **Description** Insufficient input validation and type checking on the `wpuf files` parameter during form submission, combined with unconditional deserialization via the `maybe unserialize()` function when displaying post content, allows authenticated attackers with Subscriber-level access or higher to inject arbitrary PHP objects. This can lead to arbitrary code execution, deletion of arbitrary files, or other malicious actions if a POP (Property-Oriented Programming) chain—a sequence of gadgets used to execute code during deserialization—is present on the target system. **Recommendations** Update to a version newer than 4.3.1. As a temporary workaround, restrict access to the `wpuf files` parameter during form submissions to minimize the risk of exploitation.