Duy Tran

The front-end event submission flow fails to verify the ownership or post type of a user-supplied post identifier. This Insecure Direct Object Reference (IDOR)—a flaw where an application provides direct access to objects based on user-supplied input—allows unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and subsequently convert them into events.

An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with author-level access or higher can modify the `post content` of any published post that references replaced media, including posts owned by administrators. This occurs because the `doReplaceQuery()` function executes a database-wide search-and-replace for the old media URL without performing per-post capability checks, allowing users to overwrite content that the standard admin UI and REST API would normally restrict.

Insufficient access control in the REST API allows unauthenticated users to access metadata and item contents of private wishlists. This occurs because the API does not enforce the same owner-only restrictions used on the front-end. The issue involves the `share key` variable.

The plugin fails to perform a capability or nonce check before clearing stored SEO analysis data. This allows unauthenticated users to delete this data. A nonce is a unique token used to protect against cross-site request forgery (CSRF) attacks.

The plugin fails to verify if requests sent to its cron-triggered backup execution handler originate from the internal scheduled-event dispatch of WordPress. This allows unauthenticated attackers to force any existing backup job to execute immediately, bypassing the configured schedule or trigger type.

The plugin fails to consistently exclude password-protected products from unauthenticated AJAX endpoints. This allows unauthenticated users to enumerate and disclose password-protected products and their associated metadata without providing the required password. The affected endpoints are 'dgwt wcas ajax search' (used for autocomplete search) and 'dgwt wcas result details' (used for the Details Panel when querying taxonomy details).

The plugin fails to verify if the appointment being updated via the customer-data update action belongs to the authenticated user. It relies on a shared nonce (a unique token used to prevent cross-site request forgery) that any authenticated user can obtain from their own appointment edit form. Consequently, a user with subscriber-level privileges can reuse this nonce to overwrite the customer metadata of another user's appointment, specifically the `email`, `name`, `phone`, and `description` variables. If an administrator subsequently changes the appointment status while customer notifications are enabled, the notification intended for the victim is sent to the attacker's email address.

This issue occurs because the plugin fails to verify if a user is authorized to access a referenced post before processing it and returning derived data. Consequently, users with contributor privileges can disclose information from private or draft posts that they do not own.

Insufficient verification of Stripe webhook requests occurs when no signing secret is configured. Additionally, the plugin fails to escape values retrieved from these requests before displaying them in administrator notices. This allows unauthenticated attackers to perform a Cross-Site Scripting (XSS) attack—injecting arbitrary web scripts that execute within the session of a logged-in administrator.

The plugin fails to reliably delete temporary CSV files created during email-notification processing. These files remain publicly accessible within the uploads directory. Unauthenticated attackers can retrieve form submission records of other users by utilizing predictable and enumerable filenames.