Kenneth Dunn

The MP3 Audio Player plugin for WordPress has an issue related to Insecure Direct Object Reference. This occurs due to a lack of validation on a user-controlled key within the `load track note ajax` function. This allows unauthenticated attackers to view the contents of private posts.

The IDonate plugin for WordPress has a flaw that allows unauthorized privilege escalation. Attackers with Subscriber-level access or higher can exploit a missing capability check in the `idonate donor profile()` function. This allows them to hijack accounts by changing the associated email address and initiating a password reset, potentially gaining full administrator privileges.

The Tablesome Table – Contact Form DB plugin for WordPress has a flaw where a missing capability check in the `get table data()` function allows authenticated users with Subscriber-level access or higher to retrieve plugin data, including email logs. This unauthorized access can be used to escalate privileges and potentially trigger a password reset to obtain the reset key.

The software contains a flaw that allows redirection to potentially malicious sites. This occurs because of inadequate validation of the `requested page` POST parameter within the `verify username password` function. An unauthenticated attacker can exploit this by tricking users into performing an action, such as clicking a link, which triggers the redirection.

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress has a Server-Side Request Forgery issue. Attackers with author-level access or higher can make web requests to arbitrary locations from the web application. This can be used to query and modify information from internal services via the `load lyrics ajax callback` function.

The Search Atlas SEO plugin for WordPress has a flaw that allows authentication bypass. This occurs because of a missing capability check within the `generate sso url` and `validate sso token` functions. Attackers with Subscriber-level access or higher can extract the `nonce token` authentication value and use it to log in as the first Administrator account.

The All-in-One Video Gallery plugin for WordPress has a flaw that allows unauthorized modification of data. This is due to a missing capability check within the `ajax callback store user meta()` function. Authenticated attackers with Subscriber-level access or higher can update arbitrary string-based user meta keys for their own account. The vulnerable function is `ajax callback store user meta()`.

The AffiliateX – Amazon Affiliate Plugin for WordPress is susceptible to unauthorized data modification because of a missing capability check on the `save customization settings` AJAX action. This allows authenticated attackers with Subscriber-level access or higher to inject arbitrary JavaScript code that will execute when an AffiliateX block is rendered on a website.

The GamiPress – Gamification plugin for WordPress is susceptible to unauthorized data access. A missing capability check in the `gamipress ajax get posts` and `gamipress ajax get users` functions allows authenticated attackers with Subscriber-level access or higher to enumerate users, including their email addresses, and retrieve titles of private posts.

The HTML5 Audio Player WordPress Plugin is susceptible to a Server-Side Request Forgery (SSRF) condition. This allows unauthenticated attackers to initiate web requests to arbitrary locations from the web application. The issue resides within the `getIcyMetadata()` function and can be leveraged to query and modify information from internal services.

The Fox LMS – WordPress LMS Plugin does not properly validate the `role` parameter when creating new users via the `/fox-lms/v1/payments/create-order` API endpoint. This allows unauthenticated attackers to create new user accounts with arbitrary roles, including administrator, potentially leading to complete site compromise.

The rtMedia plugin for WordPress, BuddyPress, and bbPress has an information disclosure issue. Missing authorization within the `handle rest pre dispatch()` function, specifically when the Godam plugin is active, allows unauthenticated attackers to access media items linked to draft or private posts.

The WP3D Model Import Viewer plugin for WordPress is susceptible to arbitrary file uploads. This is due to a lack of file type validation within the `handle import file()` function. Authenticated attackers with Author-level access or higher can upload arbitrary files to the server, potentially leading to remote code execution.

The Postem Ipsum plugin for WordPress has a flaw that allows unauthorized modification of data, leading to privilege escalation. Attackers with Subscriber-level access or higher can create arbitrary user accounts with administrator privileges due to a missing capability check on the `postem ipsum generate users()` function.

The JAY Login & Register plugin for WordPress has a flaw in authentication. Incorrect authentication checking within the `jay login register process switch back` function, utilizing the `jay login register process switch back` cookie, allows attackers to bypass authentication. This enables unauthenticated attackers to log in as any existing user, including administrators, if they have access to the user id.

The Infility Global plugin for WordPress is susceptible to arbitrary file uploads because of inadequate file type validation and missing capability checks. The `upload file` function within the `infility import file` class validates only the MIME type, which can be easily manipulated. Additionally, the `import data` function lacks proper capability checks. This allows authenticated attackers with subscriber-level access or higher to upload arbitrary files to the server, potentially leading to remote code execution.

An issue exists where a missing capability check on the `flow flow social auth` AJAX action allows authenticated users with Subscriber-level access or higher to modify plugin settings. This flaw enables the storage of arbitrary JavaScript, which executes when the plugin settings page is accessed.

The Blaze Demo Importer plugin for WordPress is susceptible to unauthorized database resets and file deletion. This is due to a missing capability check within the `blaze demo importer install demo()` function. Authenticated attackers with subscriber-level access or higher can truncate all database tables (excluding options, usermeta, and users), delete sidebar widgets, theme modifications, and content within the uploads folder.

The Player Leaderboard plugin for WordPress is susceptible to Local File Inclusion through the 'player leaderboard' shortcode. The issue stems from the plugin utilizing an unsanitized value from the 'mode' attribute within the shortcode in conjunction with the `include()` function, lacking adequate path validation. This allows authenticated attackers with Contributor-level access or higher to include and execute arbitrary PHP files on the server. Successful exploitation could lead to bypassing access controls, obtaining sensitive data, or achieving full remote code execution, particularly if file upload functionality is also available. The vulnerable parameter is `mode`.

The All-in-One Video Gallery plugin for WordPress has a flaw that allows unauthorized file uploads. This is due to a lack of proper file type checking within the `resolve import directory()` function. Attackers with Author-level access or higher can upload any file type to the server, potentially leading to remote code execution. The vulnerable parameter is the file being uploaded through the import directory functionality.