Karl Emil Nikka

Name of the Vulnerable Software and Affected Versions: The Uncanny Groups for LearnDash plugin for WordPress versions up to, and including, 6.1.0.1 Description: The issue arises from the plugin's failure to properly restrict what users a group leader can edit. This allows authenticated attackers with group leader-level access and above to change admin account email addresses, potentially leading to admin account access. Recommendations: For versions up to, and including, 6.1.0.1, update to a version that properly restricts user editing capabilities for group leaders. As a temporary workaround, consider restricting group leader-level access to prevent potential exploitation until a patch is available.

Name of the Vulnerable Software and Affected Versions: Uncanny Groups for LearnDash plugin for WordPress versions up to, and including, 6.1.0.1 Description: The issue allows authenticated attackers with group leader-level access and above to exploit a missing capability check on the "/wp-json/ulgm management/v1/add user/" REST API endpoint. This enables them to add users to their group, potentially leading to privilege escalation by leveraging the ability to change admin account email addresses, which can subsequently lead to admin account access. Recommendations: For versions up to, and including, 6.1.0.1, update to a version that includes a fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to the "/wp-json/ulgm management/v1/add user/" API endpoint until a patch is available. Restrict group leader-level access and above to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** GP Unique ID plugin for WordPress versions up to, and including, 1.5.5 **Description** The issue is due to insufficient input validation, allowing unauthenticated attackers to tamper with the generation of a unique ID on a form submission and replace the generated unique ID with a user-controlled one. This leads to a loss of integrity in cases where the ID's uniqueness is relied upon in a security-specific context. **Recommendations** For versions up to, and including, 1.5.5, update to a version later than 1.5.5 to resolve the issue. As a temporary workaround, consider restricting access to form submissions to minimize the risk of exploitation. Avoid using the `unique ID` generated by the plugin in security-specific contexts until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** LearnDash LMS plugin for WordPress versions up to, and including, 4.10.1 **Description** The issue allows unauthenticated attackers to obtain uploaded assignments due to insufficient protection, making it possible for them to access sensitive information via direct file access. **Recommendations** For versions up to, and including, 4.10.1, update to a version later than 4.10.1 to resolve the issue. As a temporary workaround, consider restricting access to uploaded assignments to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** LearnDash LMS plugin for WordPress versions up to, and including, 4.10.1 **Description** The issue is related to Sensitive Information Exposure, which can be exploited via API, allowing unauthenticated attackers to obtain access to quizzes. The vulnerability is associated with insufficient protection of service data when processing the `sfwd-question` and `ld-exam` endpoints. This can enable a remote attacker to gain unauthorized access to protected information. **Recommendations** For versions up to, and including, 4.10.1, update to a version later than 4.10.1 to resolve the issue. As a temporary workaround, consider restricting access to the `sfwd-question` and `ld-exam` API endpoints until a patch is available.

**Name of the Vulnerable Software and Affected Versions** LearnDash LMS plugin for WordPress versions up to, and including, 4.10.2 **Description** The issue is related to insufficient protection of sensitive data when handling the `sfwd-question` and `ld-exam` endpoints, allowing remote attackers to gain unauthorized access to protected information. This makes it possible for unauthenticated attackers to obtain access to quiz questions. **Recommendations** For versions up to, and including, 4.10.2, update to a version later than 4.10.2 to resolve the issue. As a temporary workaround, consider restricting access to the `sfwd-question` and `ld-exam` API endpoints until a patch is available.

**Name of the Vulnerable Software and Affected Versions** FluentCRM - Marketing Automation For WordPress versions up to, and including, 2.7.40 **Description** The issue allows unauthorized modification of data due to the use of an MD5 hash without a salt to control subscriptions. This enables unauthenticated attackers to unsubscribe users from lists and manage subscriptions if they gain access to a targeted subscriber's email address. **Recommendations** For versions up to, and including, 2.7.40, update to a version that utilizes a secure hashing method with a salt to control subscriptions.