D01Exploit Official

The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead, allowing unauthenticated attackers to create WordPress user accounts even when registration is disabled. This is an incomplete fix for CVE-2025-12353: the check added in 3.6.3 covers only one of the three registration paths.

**Name of the Vulnerable Software and Affected Versions** Printcart Web to Print Product Designer for WooCommerce WordPress plugin versions prior to 2.5.3 **Description** An issue exists where the software fails to restrict user-supplied URLs before fetching them server-side and does not enforce valid authorization checks. This allows unauthenticated attackers to read arbitrary local files, such as configuration files containing secret keys and database credentials, and to perform server-side requests to internal resources. **Recommendations** Update Printcart Web to Print Product Designer for WooCommerce WordPress plugin to version 2.5.3 or later.

**Name of the Vulnerable Software and Affected Versions** Printcart Web to Print Product Designer for WooCommerce versions prior to 2.4.9 **Description** This issue involves a path traversal flaw that allows an unauthenticated attacker to retrieve directory listings for arbitrary directories on the server. Path traversal is a technique used to access files or directories outside the intended folder by using special characters like dot-dot-slash (../). **Recommendations** Update the plugin to a version newer than 2.4.8.

**Name of the Vulnerable Software and Affected Versions** Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress versions prior to 2.5.3 **Description** Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the `foxtool login google()` function. A nonce is a unique token used to prevent the replay of requests. This flaw allows unauthenticated attackers to establish an OAuth Connection through a forged request if a site administrator is tricked into clicking a malicious link. **Recommendations** Update the plugin to a version newer than 2.5.2. As a temporary workaround, restrict access to the `foxtool login google()` function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Simple User Capabilities versions prior to 1.1 **Description** Privilege Escalation occurs due to a missing capability check in the `suc submit capabilities()` function. This flaw allows unauthenticated attackers to elevate the role of any user account to administrator. **Recommendations** Update to a version later than 1.0. As a temporary workaround, consider disabling the `suc submit capabilities()` function until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Simple User Capabilities versions prior to 1.1 **Description** The plugin allows unauthenticated attackers to reset the capabilities of any user. This occurs because the 'wp ajax nopriv reset capability' AJAX endpoint lacks a proper capability check, leading to unauthorized modification of data. **Recommendations** Update the plugin to a version later than 1.0. As a temporary mitigation, restrict access to the 'wp ajax nopriv reset capability' AJAX endpoint.

**Name of the Vulnerable Software and Affected Versions** AppPresser – Mobile App Framework plugin for WordPress versions through 4.5.0 **Description** The AppPresser – Mobile App Framework plugin for WordPress is susceptible to unauthorized data access. A missing capability check within the `myappp verify` function allows unauthenticated attackers to extract sensitive information. This data includes plugin and theme names and version numbers, potentially enabling targeted attacks against vulnerable components. **Recommendations** Update to a version beyond 4.5.0.

**Name of the Vulnerable Software and Affected Versions** WordPress Content Writer plugin versions 3.6.8 and earlier **Description** The Content Writer plugin for WordPress is susceptible to exposing sensitive information. This occurs due to publicly accessible log files, potentially allowing unauthenticated attackers to view sensitive data contained within them. **Recommendations** Update the Content Writer plugin to a version newer than 3.6.8.

**Name of the Vulnerable Software and Affected Versions** SiteAlert (Formerly WP Health) plugin for WordPress versions through 1.9.8 **Description** The software is susceptible to unauthorized data access because of a missing capability check in several functions. This allows unauthenticated attackers to view site health information, which includes a list of installed and outdated plugins, as well as PHP and Database versions. **Recommendations** Update the SiteAlert (Formerly WP Health) plugin to a version later than 1.9.8.

**Name of the Vulnerable Software and Affected Versions** The Block For Mailchimp – Easy Mailchimp Form Integration plugin for WordPress versions up to and including 1.1.12 **Description** The software is susceptible to a Blind Server-Side Request Forgery issue. This allows unauthenticated attackers to make web requests to arbitrary locations originating from the web application. Attackers could potentially query and modify information from internal services using the `mcbSubmit Form Data()` function. **Recommendations** Update The Block For Mailchimp – Easy Mailchimp Form Integration plugin for WordPress to a version later than 1.1.12.