Jamshed Yergashvoyev

The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'delete item permissions check' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to delete arbitrary course progress records belonging to any student.

**Name of the Vulnerable Software and Affected Versions** Jenkins Project Jenkins versions prior to LTS 2.555.3 **Description** An incomplete patch allows an authenticated remote attacker with Item/Configure permission to read arbitrary files on the Jenkins controller filesystem. The issue exists because the `untarFrom()` function validates symlink destinations during tar extraction in `FilePath.java` but fails to validate symlink targets. A symlink located inside the workspace can point to arbitrary paths outside of it, enabling the disclosure of sensitive files readable by the Jenkins process user, such as `secrets/master.key`, `credentials.xml`, and other configuration files. Exploitation can occur if an administrator points a tool installer, such as `DownloadFromUrlInstaller` or `ZipExtractionInstaller`, to an attacker-controlled URL. Subsequently, a request to the endpoint '/job/{name}/build' extracts the malicious tar archive and plants symlinks in the tool cache. Sensitive data is then exposed via the endpoints '/job/{name}/lastBuild/consoleText' or '/job/{name}/ws/{file}', potentially revealing files like `/etc/passwd`. **Recommendations** Update Jenkins Project Jenkins to a version later than LTS 2.555.3.

**Name of the Vulnerable Software and Affected Versions** LearnPress – WordPress LMS Plugin for Create and Sell Online Courses versions prior to 4.3.7 **Description** An issue exists that allows unauthenticated attackers to extract sensitive data through an unrestricted SELECT * fallback query. By sending a request to the '/wp-json/lp/v1/courses/archive-course' endpoint with the `c status` parameter set to 'all' and the `return type` parameter set to 'json', attackers can bypass the publish-only post status filter and prevent the safe ID field override. This exposure includes the plaintext `post password` of password-protected courses, as well as the `post content`, `post author`, and `post name` of unpublished draft, private, and pending courses. **Recommendations** Update the plugin to a version later than 4.3.6. Avoid using the `return type` parameter in the '/wp-json/lp/v1/courses/archive-course' endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** ArthurFiorette steam-trader version 2.1.1 **Description** A sensitive information exposure issue exists. An unauthenticated attacker can send a request to the `/users` API endpoint to retrieve sensitive Steam account data, including the account username, password, identity secret, and shared secret. Application logs also expose authentication artifacts such as access tokens, refresh tokens, and session identifiers. This information allows an attacker to generate valid Steam Guard (2FA) codes, hijack authenticated sessions, and obtain full control over the affected Steam account, including unauthorized access to inventory and trading functionality. The vulnerable parameter is not specified. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Job Board by BestWebSoft plugin for WordPress versions up to and including 1.2.1 **Description** The plugin is susceptible to Stored Cross-Site Scripting. The issue arises from storing unsanitized data from the `$ GET` superglobal array directly into the database using the `update user meta()` function when users save search results. This data is then output without proper escaping, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts execute when a user accesses the saved search or views their profile, provided the attacker can induce the user to save the search results. The vulnerability allows for the injection of malicious scripts via the `$ GET` parameters. **Recommendations** Update the Job Board by BestWebSoft plugin to a version beyond 1.2.1.

**Name of the Vulnerable Software and Affected Versions** WP-DownloadManager plugin for WordPress versions up to, and including, 1.68.10 **Description** The issue is due to a lack of restriction on the directory an administrator can select for storing downloads, making it possible for authenticated attackers with Administrator-level access and above to download and read any file on the server, including system and configuration files. This can lead to remote code execution (RCE). **Recommendations** For WP-DownloadManager plugin for WordPress versions up to, and including, 1.68.10: Update to a version that includes the necessary restrictions on the directory an administrator can select for storing downloads to prevent arbitrary file read. As a temporary workaround, consider restricting access to sensitive files and directories on the server to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WP-DownloadManager versions 1.68.10 and earlier **Description** The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file deletion due to a lack of restriction on the directory from which a file can be deleted. This allows authenticated attackers with Administrator-level access and above to delete arbitrary files on the server, potentially leading to remote code execution when the right file is deleted, such as wp-config.php. **Recommendations** For WP-DownloadManager versions 1.68.10 and earlier, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation. Avoid using the plugin's file deletion functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.