D.V4N_S3C

The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle form submission function. This is due to the plugin dynamically granting the unfiltered upload capability to all users during form submissions and bypassing MIME type validation when allowed file types is not configured. This makes it possible for unauthenticated attackers to execute code on the server. Several default pre-built templates including Job Application, Support Ticket, and Wholesale Application have file upload fields with no file type restrictions configured by design, making this vulnerability immediately exploitable upon installation.

**Name of the Vulnerable Software and Affected Versions** AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress versions prior to 10.11.2 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can overwrite the BCC field of the `acy notification cms` notification template. This allows subsequent WordPress password-reset emails, including those for administrator accounts, to be silently copied to an address controlled by the attacker, potentially leading to account takeover via the captured reset link. This issue is exploitable only if the site administrator has enabled the "Send website emails with AcyMailing" option, which routes core WordPress notification emails through the AcyMailing templating system. **Recommendations** Update to a version newer than 10.11.1. Disable the "Send website emails with AcyMailing" option to prevent the routing of core notification emails through the vulnerable templating system.

**Name of the Vulnerable Software and Affected Versions** AI Copilot – Content Generator versions prior to 1.5.7 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can achieve full site takeover by creating a new administrator-level user account. This is accomplished by saving and executing a malicious workflow that includes a `wp create user` action node with the `role` variable set to `administrator`. The issue is exploitable on sites where the `[aiwu-form]` shortcode or a public chatbot is rendered on a frontend page, as the `waic-nonce` value is exposed in the publicly accessible JavaScript `WAIC DATA.waicNonce`, making the nonce check ineffective. **Recommendations** Update AI Copilot – Content Generator to a version later than 1.5.6.

**Name of the Vulnerable Software and Affected Versions** Taskbuilder – Project Management & Task Management Tool With Kanban Board versions prior to 5.0.9 **Description** An issue exists where authenticated attackers with subscriber-level access and above can perform SQL Injection. This occurs because the `task search` parameter is not sufficiently escaped and the SQL query is not properly prepared. Additionally, the `wppm get task list()` AJAX handler lacks capability checks and nonce verification, allowing any authenticated user to invoke it directly and append malicious SQL queries to extract sensitive information from the database. **Recommendations** Update Taskbuilder – Project Management & Task Management Tool With Kanban Board to version 5.0.9 or later.

**Name of the Vulnerable Software and Affected Versions** LatePoint – Calendar Booking Plugin for Appointments and Events versions prior to 5.6.4 **Description** An Insecure Direct Object Reference (IDOR) exists in the `create or update()` function of OsOrdersController. This allows an authenticated Agent to provide an arbitrary `order[customer id]` and overwrite the email field of any customer, including those linked to WordPress Administrator accounts, via the public-scope `set data()` call. Due to a missing role verification in `OsAuthHelper::authorize customer()`, the linked WordPress user is logged in without a role check, enabling attackers with Agent-level access or higher to elevate their privileges to Administrator. **Recommendations** Update the plugin to version 5.6.4 or later.

**Name of the Vulnerable Software and Affected Versions** User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration versions prior to 4.3.2 **Description** Insufficient input validation and type checking on the `wpuf files` parameter during form submission, combined with unconditional deserialization via the `maybe unserialize()` function when displaying post content, allows authenticated attackers with Subscriber-level access or higher to inject arbitrary PHP objects. This can lead to arbitrary code execution, deletion of arbitrary files, or other malicious actions if a POP (Property-Oriented Programming) chain—a sequence of gadgets used to execute code during deserialization—is present on the target system. **Recommendations** Update to a version newer than 4.3.1. As a temporary workaround, restrict access to the `wpuf files` parameter during form submissions to minimize the risk of exploitation.