Junhee Cho

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to make another user's private activity public or hide it.

**Name of the Vulnerable Software and Affected Versions** Solace Extra WordPress plugin versions prior to 1.7.0 **Description** An issue exists where the plugin fails to perform authorization or post-status checks within an AJAX action. This allows unauthenticated visitors to access and read the content of Site Builder parts that are not published, including those with statuses such as draft, pending, private, or trashed, which are normally restricted by WordPress. **Recommendations** Update Solace Extra WordPress plugin to version 1.7.0 or later.

**Name of the Vulnerable Software and Affected Versions** WPBulky versions prior to 1.2.3 **Description** An issue exists that allows users with contributor privileges to perform SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** Update WPBulky to a version newer than 1.2.2.

**Name of the Vulnerable Software and Affected Versions** Push Notification for Post and BuddyPress versions prior to 3.21 **Description** Broken Access Control allows users with Subscriber privileges to perform unauthorized actions within the plugin. **Recommendations** Update Push Notification for Post and BuddyPress to a version newer than 3.20.

**Name of the Vulnerable Software and Affected Versions** Beautiful Taxonomy Filters versions 2.4.6 and earlier **Description** An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database, potentially allowing them to view data they are not normally able to retrieve. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Suggestion Engine for WooCommerce versions prior to 2.0.12 **Description** An issue exists that allows users with contributor privileges to perform a SQL Injection, which is a technique used to insert malicious SQL statements into entry fields for execution by the database. **Recommendations** Update Suggestion Engine for WooCommerce to version 2.0.12 or later.

**Name of the Vulnerable Software and Affected Versions** Solace Extra versions prior to 1.6.1 **Description** The Solace Extra WordPress plugin fails to perform capability or nonce checks in an AJAX action. This allows any authenticated user, including those with subscriber privileges, to update post meta on arbitrary posts and deactivate the active site templates. This can be achieved directly by an authenticated user or via Cross-Site Request Forgery (CSRF), where a logged-in user is tricked into performing the action. The issue is located in the `solace update sitebuilder status` action. **Recommendations** Update Solace Extra to version 1.6.1 or later.

**Name of the Vulnerable Software and Affected Versions** Solace Extra versions prior to 1.6.1 **Description** Insufficient capability checks in several AJAX actions, combined with the exposure of the protecting nonce on admin pages accessible to low-privileged users, allow individuals with roles as low as Subscriber to modify site-wide presentation settings and delete imported site-builder content. A nonce is a unique token used to protect against cross-site request forgery. **Recommendations** Update Solace Extra to version 1.6.1 or later.