Devploit

**Name of the Vulnerable Software and Affected Versions** PixMagix – WordPress Image Editor versions prior to 1.7.3 **Description** Authenticated attackers with author-level access and above can write files with controlled content to arbitrary server locations. The issue occurs because the `layers[].id` parameter is not sanitized before being concatenated into a filesystem path and passed to the `copy()` function within the `move image on server()` function. This allows the use of traversal sequences to escape the intended upload directory. The attack is possible via the `save template` API endpoint, which is accessible to users with the `create projects` permission. **Recommendations** Update PixMagix – WordPress Image Editor to version 1.7.3 or later. As a temporary mitigation, restrict access to the `save template` API endpoint or limit user permissions to prevent Author-level users from utilizing the `create projects` permission.

**Name of the Vulnerable Software and Affected Versions** Checkout Files Upload for WooCommerce versions prior to 2.2.6 **Description** An Insecure Direct Object Reference (IDOR) exists due to missing validation on a user-controlled key, which allows unauthenticated attackers to bypass authorization and exploit incorrectly configured access control security levels to perform unauthorized actions. **Recommendations** Update Checkout Files Upload for WooCommerce to version 2.2.6 or later.