Emiliano Versini

Unauthenticated attackers can delete arbitrary non-PHP files within the wp-content/uploads/ directory. This occurs because the plugin accepts arbitrary upload field metadata from POST requests in draft submissions without proper validation. The issue is triggered when a subsequent draft references a poisoned draft using the `previous draft id` parameter.

An IPC record-separator injection flaw exists in `Core::Sandbox` due to the failure to escape semicolons used as command separators when passing `tg://` links to a running instance over a local socket. A remote attacker can use crafted links containing unescaped semicolons to inject additional commands, specifically targeting the `interpret:` scheme handler. This handler, a legacy internal helper, allows the unauthorized reading and uploading of arbitrary local files—including `tdata` session keys, browser sessions, SSH keys, and cryptocurrency wallets—to an attacker-controlled channel without user confirmation. If no local passcode is configured, the theft of session files can lead to full account takeover. The attack is confirmed on Windows and typically requires the victim to click a malicious external link while Telegram is already running.

Webmin is a web-based system administration tool for Unix-like servers. Users are susceptible to Cross-Site Scripting (XSS), a technique where malicious scripts are injected into trusted websites, which can be triggered when a user clicks a malicious link to their server. This flaw allows for the execution of attacker-controlled commands.

The AI Engine plugin for WordPress has a Sensitive Information Exposure issue via the /mcp/v1/ REST API endpoint. When the 'No-Auth URL' option is enabled, this endpoint exposes the 'Bearer Token' value. Successful exploitation allows unauthenticated attackers to obtain the bearer token, granting them access to a valid session and the ability to perform actions such as creating a new administrator account, leading to privilege escalation. The vulnerability affects versions up to and including 3.1.3. Prior builds also contained privilege-escalation issues, allowing low-level users to create new admin accounts or upload arbitrary PHP files via REST endpoints. The `/mcp/v1/` API endpoint is involved in this exposure. The `Bearer Token` is the vulnerable parameter.

The issue allows unauthorized download of password-protected content due to improper password validation on the `checkFilePassword` function. This makes it possible for unauthenticated attackers to download password-protected files.

The issue concerns a failure to properly sanitize and escape a parameter from one of the plugin's RESP API endpoints before using it in a SQL statement. This allows administrators to perform SQL injection attacks.

Name of the Vulnerable Software and Affected Versions: Secure Downloads WordPress plugin versions prior to 1.2.3 Description: The issue allows authenticated attackers with admin-level access and above to download arbitrary files, potentially containing sensitive information, such as the wp-config.php file. This is due to the plugin not properly restricting which files can be downloaded. Recommendations: For Secure Downloads WordPress plugin versions prior to 1.2.3, update to version 1.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.