Ezekiel Victor

**Name of the Vulnerable Software and Affected Versions** Gutentor versions prior to 4.0.6 **Description** An issue exists where the plugin fails to apply proper context restrictions to a REST endpoint. This allows any authenticated user with the Subscriber role or higher to access the plaintext passwords of password-protected posts. **Recommendations** Update Gutentor to version 4.0.6 or later.

**Name of the Vulnerable Software and Affected Versions** Tamara Checkout versions prior to 1.9.9.21 **Description** The plugin fails to verify the order key, a nonce, or any specific capability on its public payment cancel and fail return URLs. This allows an unauthenticated attacker to change the status of any WooCommerce order by providing a numeric order id. By enumerating these ids, an attacker can cancel or fail arbitrary orders across the store, which triggers side-effects such as stock release and notifications. **Recommendations** Update the plugin to a version newer than 1.9.9.20.

**Name of the Vulnerable Software and Affected Versions** SmartCrawl SEO checker, analyzer & optimizer WordPress plugin versions prior to 3.16.3 **Description** Insufficient capability checks on two AJAX actions allow users with the Subscriber role or higher to read titles of private and draft posts by ID and enumerate stored post-meta key names. **Recommendations** Update the plugin to version 3.16.3 or later.

**Name of the Vulnerable Software and Affected Versions** Squeeze WordPress plugin versions prior to 1.7.12 **Description** Insufficient validation of file types or extensions during attachment-update actions allows users with the `upload files` capability, such as those with Author privileges and above, to upload executable PHP files into the uploads directory. This flaw can lead to remote code execution, which is the ability of an attacker to execute arbitrary commands on the server. **Recommendations** Update Squeeze WordPress plugin to version 1.7.12 or later.