Farid Narimanov

Insufficient capability checks in the plugin allow users with any role granted access to the admin area, including the Subscriber role, to perform unauthorized actions. Specifically, the software fails to verify if a user has the authority to manage WooCommerce orders before returning or removing ticket data. This allows an authenticated attacker to view the names and ticket codes of other customers or remove tickets from orders.

An Insecure Direct Object Reference (IDOR) exists due to missing authorization, ownership, and request-validation checks when updating stored form entries. This allows unauthenticated attackers to overwrite, permanently erase, reassign, or append to any previously submitted form entry by referencing its sequential identifier via a user-controlled key.

Insufficient capability checks in the calendar view AJAX actions allow users with the Contributor role to access and view order details belonging to other customers.

The plugin fails to verify the signature of webhooks received from PayPal when processing payment and subscription notifications. This allows unauthenticated attackers to forge payment confirmations and subscription-cancellation events for any order, provided they possess the transaction ID. A webhook is an automated message sent from one application to another to notify it about an event.

Insufficient access restrictions and missing nonce verification for a post-cloning action allow users with Contributor-level permissions or higher to duplicate arbitrary posts of any type or status. This includes the ability to clone private or draft content belonging to other users, granting the attacker read access to the duplicated copy. A nonce is a unique token used to protect against cross-site request forgery (CSRF) by ensuring that a request was intentionally sent by the user.

Insufficient access restrictions on the field-management AJAX action allow authenticated users with Subscriber-level permissions or higher to create, modify, and delete arbitrary post meta on any post. This includes WooCommerce products, regardless of who owns them. An attacker can use this to manipulate stored pricing rules on a product to lower its price during checkout.

Authenticated users with Subscriber privileges or higher can credit their own accounts with an unlimited amount of loyalty points. This occurs because the plugin fails to validate the claimed reward amount or restrict access to the Win Wheel claim handler. Additionally, if a companion wallet is active, the user can also manipulate their wallet balance.

An authorization check is missing in an appointment-retrieval action. This allows users with a low-privilege role specific to the plugin to access appointment records of other users, leading to the disclosure of personally identifiable information such as customer names, email addresses, phone numbers, and private booking comments.

The plugin fails to perform authorization checks on endpoints that return booking service and category records. This allows unauthenticated attackers to access and read private internal notes associated with each service and category.

An issue exists where the plugin fails to verify store ownership within a REST API route. This allows any authenticated user, including those with subscriber privileges, to overwrite store details, modify payout settings, and change the ownership records of any store.

The plugin fails to perform authorization checks on the endpoint that returns booking confirmation details. Because bookings are identified by sequential numeric identifiers, unauthenticated attackers can use Insecure Direct Object Reference (IDOR)—a flaw where an application provides direct access to objects based on user-supplied input—to enumerate these identifiers and access sensitive customer information, including names, emails, phone numbers, booking details, and payment status.

Insufficient input sanitization and output escaping in a Beaver Builder widget allow users with contributor-level access and above to inject arbitrary web scripts. This occurs because the plugin fails to validate a user-supplied HTML tag name before echoing it into the rendered markup, resulting in Stored Cross-Site Scripting (XSS), where scripts execute when any visitor views the affected page.

The plugin contains an Insecure Direct Object Reference (IDOR) flaw, which occurs when an application provides direct access to objects based on user-supplied input. The issue stems from missing validation of a client-supplied price identifier when an item is added to the cart. This allows unauthenticated users to manipulate the price by using an identifier defined elsewhere on the site, enabling them to purchase items at a lower cost and complete orders at that price.

Unauthenticated users can assign themselves to restricted B2B customer groups and bypass the manual account-approval workflow during self-registration. This occurs because the plugin fails to validate whether the registration role submitted by the user is actually among the publicly available, published, and selectable roles offered on the registration form.

An Insecure Direct Object Reference (IDOR) exists where the plugin fails to verify if a subscription belongs to the customer associated with the active customer-portal session before processing a cancellation. This allows an authenticated user with a valid portal session to cancel subscriptions belonging to other customers, provided they know the specific subscription identifier. This identifier is high-entropy, meaning it is a complex string that is difficult to guess or enumerate.

When debug logging is enabled, the plugin fails to restrict access to its debug log. Because the log is stored at a fixed and publicly reachable location, unauthenticated users can read sensitive information, including issued OAuth tokens, authorization codes, and user records containing password hashes.

An issue exists where the plugin fails to verify if a requester is authorized to access a customer-uploaded file before serving it. This allows unauthenticated users to retrieve files if they obtain the stored file name. The exploitation of this issue depends on the web server configuration; it affects servers that honor deny-all rules in upload directories, such as Apache. On servers where such rules are ignored, like default nginx setups, files are already accessible via their direct URL, and the `getpublicfileupload` endpoint provides no additional exposure.

The plugin fails to validate the audience of accepted Google identity tokens. This allows unauthenticated users to authenticate as any user, including administrators, by providing a token containing the target user's email address.

Insufficient authorization in the plugin allows users with the Contributor role and above to read the full configuration of any chart on the site. This includes charts that the interface normally restricts and allows the retrieval of all chart configurations in a single request. The exposed configuration may contain credentials for remote data sources used by the charts.

An issue exists where withdrawal requests are not validated against the requesting user's actual earned balance. This allows any authenticated user, including those with the subscriber role and no sales history, to submit a payout request for an arbitrary amount. If an administrator approves the request, the funds may be paid out.