Hiroho Shimada

**Name of the Vulnerable Software and Affected Versions** The WordPress Review Plugin: The Ultimate Solution for Building a Review Website versions up to, and including, 5.3.5 **Description** The WordPress Review Plugin is vulnerable to Local File Inclusion, allowing authenticated attackers with Contributor-level access and above to include and execute arbitrary files on the server. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP file types can be uploaded and included, or pearcmd is enabled on a server with register argc argv also enabled. **Recommendations** For versions up to, and including, 5.3.5, update to a version that fixes the Local File Inclusion issue to prevent authenticated attackers from including and executing arbitrary files on the server. As a temporary workaround, consider restricting access to Post custom fields to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** HUSKY – Products Filter Professional for WooCommerce plugin for WordPress versions up to, and including, 1.3.6.5 **Description** The issue allows unauthenticated attackers to include and execute arbitrary files on the server via the `template` parameter of the "woof text search" AJAX action. This enables the execution of any PHP code in those files, which can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. **Recommendations** For versions up to, and including, 1.3.6.5, consider disabling the `woof text search` AJAX action or restricting access to it until a patch is available. Additionally, restrict the upload of files to only necessary types and ensure proper validation and sanitization of the `template` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Keap Official Opt-in Forms plugin for WordPress versions up to, and including, 2.0.1 **Description** The Keap Official Opt-in Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.1 via the `service` parameter. This makes it possible for unauthenticated attackers to include PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included. If `register argc argv` is enabled on the server and `pearcmd.php` is installed, this issue might lead to Remote Code Execution. **Recommendations** For versions up to, and including, 2.0.1, update to a version higher than 2.0.1 to resolve the issue. As a temporary workaround, consider disabling the `service` parameter until a patch is available. Restrict access to the `pearcmd.php` file to minimize the risk of exploitation if `register argc argv` is enabled on the server.

**Name of the Vulnerable Software and Affected Versions** Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress versions up to, and including, 1.6.10 **Description** The issue allows authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server via the `theme` parameter of the `post type ajax handler()` function. This enables the execution of any PHP code in those files, which can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. **Recommendations** For versions up to, and including, 1.6.10, consider disabling the `post type ajax handler()` function or restricting access to the `theme` parameter until a patch is available. As a temporary workaround, restrict the ability to upload and include files, especially those that can contain PHP code, to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MasterStudy LMS plugin for WordPress versions up to, and including, 3.3.3 **Description** The issue allows unauthenticated attackers to include and execute arbitrary files on the server via the `template` parameter. This enables the execution of any PHP code in those files, which can be used to bypass access controls, obtain sensitive data, or achieve code execution, especially in cases where images and other “safe” file types can be uploaded and included. **Recommendations** For versions up to, and including, 3.3.3, update to a version later than 3.3.3 to resolve the issue. As a temporary workaround, consider restricting access to the `template` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** MasterStudy LMS plugin for WordPress versions up to, and including, 3.3.0 **Description** The issue allows unauthenticated attackers to include and execute arbitrary files on the server via the `modal` parameter. This enables the execution of any PHP code in those files, which can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. **Recommendations** For MasterStudy LMS plugin for WordPress versions up to, and including, 3.3.0, consider disabling the `modal` parameter until a patch is available to prevent exploitation. Restrict access to sensitive files and directories to minimize the risk of arbitrary file inclusion. Avoid using the `modal` parameter in API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MasterStudy LMS plugin for WordPress versions up to, and including, 3.3.1 **Description** The issue is due to insufficient validation checks within the ` register user()` function called by the 'wp ajax nopriv stm lms register' AJAX action. This allows unauthenticated attackers to register a user with administrator-level privileges when MasterStudy LMS Pro is installed and the LMS Forms Editor add-on is enabled. **Recommendations** For MasterStudy LMS plugin for WordPress versions up to, and including, 3.3.1: Update the plugin immediately to secure the WordPress site. As a temporary workaround, consider disabling the ` register user()` function or restricting access to the 'wp ajax nopriv stm lms register' AJAX action until a patch is available.

**Name of the Vulnerable Software and Affected Versions** The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress versions up to, and including, 3.2.10 **Description** The issue allows unauthenticated attackers to extract sensitive data, including all registered users' usernames and email addresses, which can be used to help perform future attacks. This can lead to information exposure. **Recommendations** For versions up to, and including, 3.2.10, update to a version higher than 3.2.10 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Backup Migration plugin for WordPress versions 1.0.8 through 1.3.9 **Description** The issue allows unauthenticated attackers to include remote files on the server, resulting in code execution, via the `content-dir` HTTP header. Successful exploitation requires the target server's php.ini to be configured with `allow url include` set to `on`. This feature is deprecated as of PHP 7.4 and is disabled by default but can still be explicitly enabled in later versions of PHP. **Recommendations** For versions 1.0.8 through 1.3.9, consider disabling the `content-dir` HTTP header until a patch is available. Additionally, ensure the `allow url include` setting in php.ini is set to `off` to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Backup Migration plugin for WordPress versions up to, and including, 1.3.9 **Description** The issue allows unauthenticated attackers to perform Path Traversal via the `content-backups` and `content-name`, `content-manifest`, or `content-bmitmp` and `content-identy` HTTP headers. This enables the deletion of arbitrary files, including the wp-config.php file, potentially leading to site takeover and remote code execution. **Recommendations** For versions up to, and including, 1.3.9, update to a version later than 1.3.9 to resolve the issue. As a temporary workaround, consider restricting access to the `content-backups`, `content-name`, `content-manifest`, `content-bmitmp`, and `content-identy` HTTP headers until a patch is available. Avoid using the affected HTTP headers in the Backup Migration plugin until the issue is resolved.