Farrukh Ziyaev

The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the `mipl wc upload file` function in all versions up to, and including, 1.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

**Name of the Vulnerable Software and Affected Versions** Gallery by BestWebSoft versions prior to 4.8.0 **Description** An SQL Injection issue exists where authenticated attackers with Editor-level access and above can extract sensitive information from the database. The `gllr save postdata()` function stores unsanitized array keys from `$ POST` directly into post meta, which are subsequently used in SQL queries without prepared statements. This occurs via the ` gallery order {post id}` parameter array keys due to insufficient escaping of user-supplied parameters and a lack of sufficient preparation of the SQL query. **Recommendations** Update to a version newer than 4.7.9.

**Name of the Vulnerable Software and Affected Versions** Firebase Support & Chat Management plugin for WordPress versions prior to 3.1.2 **Description** An issue allows authenticated attackers with Subscriber-level access or higher to escalate privileges and achieve full account takeover. The `firebase auth()` function authenticates requests based on the email provided in the `user email` POST parameter without verifying the ownership of that email, as it fails to validate the Firebase ID token signature, issuer, or audience. By submitting a target user's email address to the `acb firebase auth` AJAX action, an attacker can log in as any existing user, including an Administrator. **Recommendations** Update to a version later than 3.1.1. As a temporary workaround, restrict access to the `acb firebase auth` AJAX action or avoid using the `user email` parameter until the update is applied.