Javitoia

**Name of the Vulnerable Software and Affected Versions** GiveWP versions prior to 4.15.4 **Description** The GiveWP plugin for WordPress contains a Cross-Site Request Forgery (CSRF) flaw. This occurs because the `give set notification status handler()` function fails to perform nonce validation. A nonce is a unique token used to ensure that a request was intentionally sent by the user. Consequently, unauthenticated attackers can disable donation email notifications by tricking a site administrator into clicking a malicious link. **Recommendations** Update the plugin to version 4.15.4 or later. As a temporary mitigation, restrict administrative access to the WordPress dashboard to trusted networks.

**Name of the Vulnerable Software and Affected Versions** LearnPress versions prior to 4.3.9.2 **Description** An Insecure Direct Object Reference (IDOR) exists due to missing validation on a user-controlled key. Authenticated attackers with subscriber-level access or higher can exploit the `userId` parameter to view course enrollment progress and completion data of users with the `LP TEACHER ROLE` or administrator roles. This issue does not affect regular subscribers as cross-subscriber access is blocked. **Recommendations** Update to a version newer than 4.3.9.1. Avoid using the `userId` parameter in requests until the update is applied.