Kuba

Local File Inclusion occurs via the `noptin fields[first name]` parameter. This allows unauthenticated attackers to include and execute arbitrary .php files on the server, enabling the execution of PHP code. This can lead to bypassed access controls, theft of sensitive data, or full code execution if .php files can be uploaded. The Manage Preferences page provides a nonce to unauthenticated visitors, removing authorization barriers. An attacker can store a malicious payload in the `first name` variable, which is then executed when the site operator sends a newsletter. Exploitation requires an administrator to trigger the newsletter sending process.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS). By using a nested shortcode payload, attackers can bypass the `geodir strip shortcodes()` guard and the `wp kses post()` function, which fails to inspect shortcode attribute values. This enables the injection of arbitrary web scripts into pages via the `post content` parameter, which execute when a user visits the affected page.

An issue exists where unauthenticated attackers can extract a merchant's plaintext Yandex Market API key. This occurs via the `y4ym check action` parameter, which allows access to a publicly accessible log file located at wp-content/uploads/y4ym/yml-for-yandex-market.log. Successful exploitation grants full control over the marketplace catalogue, prices, and stock. This requires the targeted feed to have a stored API key and the `y4ym keeplogs` option to be enabled.

Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. By exploiting a missing `current user can()` check in the Factory framework's `connect()` dispatcher, attackers can bypass the `manage options` capability gate to harvest a `wis edit feed` nonce and overwrite the `slidespeed` parameter. This allows the injection of arbitrary web scripts that execute whenever a user views a public page embedding the feed shortcode.

Unauthenticated attackers can execute arbitrary shortcodes because the software fails to properly validate a value before executing the `do shortcode()` function. The `wp ajax nopriv qsm create quiz nonce` endpoint provides a submission nonce to any unauthenticated caller, which allows it to be used as a CSRF (Cross-Site Request Forgery) token—a technique used to trick a user into executing unwanted actions—rather than acting as a security barrier.

An issue exists where unauthenticated attackers can perform a generic SQL Injection, a technique used to interfere with the queries that an application makes to its database. This occurs due to insufficient escaping of user-supplied data and lack of preparation in the SQL query. The flaw is triggered via the `user register` hook during WooCommerce My Account registration, allowing attackers to append malicious queries to extract sensitive information from the database using the `email` parameter.

An Insecure Direct Object Reference exists due to missing validation on a user-controlled key. Unauthenticated attackers can read full billing personally identifiable information (PII), such as name, email address, phone number, and street address, by enumerating sequential order IDs. This occurs because the data is emitted into the inline `fkwcs data` JavaScript object via `wp localize script` on every matching page response. The issue persists even if WooCommerce rejects the request, as the plugin's script call runs independently of the standard order-key validation. The affected endpoint is '/checkout/order-pay/<ID>/' using the `order-pay` parameter.

Unauthenticated attackers can execute arbitrary shortcodes because the software fails to properly validate a value before executing the `do shortcode()` function. This issue occurs when a public post is rendered using an AE template that includes the AE Post Comments widget. Exploitation is possible if the attacker's comment is visible on the page, which can happen if comment moderation is relaxed or if the attacker has a previously approved comment.

Unauthenticated attackers can delete any WordPress media library attachment and its associated file in the uploads directory. This occurs because the `get table data()` AJAX handler, registered via `wp ajax nopriv woot get table data`, fails to perform nonce verification or capability checks. An attacker can pass a specific value to the `wp columns actions` parameter and a numeric attachment ID via the `table id` parameter, which are then processed by `apply filters()`. This allows the execution of `wp delete attachment()` through hooks like `upgrader scheduled cleanup` and `importer scheduled cleanup`. This issue is limited to attachment posts reachable by numeric ID within the `wp-content/uploads` directory.

Incorrect authorization allows for privilege escalation. The plugin fails to enforce row-filter (`defaultWhere`) or per-column allow-list (`isSelected`) restrictions on write endpoints, unlike the read endpoints. This allows authenticated users with Subscriber-level access or higher, or unauthenticated users if the `rest api.authorization` is set to 'anonymous', to write to arbitrary rows and columns. An attacker can overwrite the `user pass` field of the WordPress administrator account in the `wp users` table to achieve full site takeover. This occurs when an administrator publishes a Data App that enables write transactions (update, delete, or insert). The affected endpoints are 'wpda/app/update', 'wpda/app/delete', and 'wpda/app/insert', which pass the `key` and `val` parameters directly to the `$wpdadb->update`, `$wpdadb->delete`, and `$wpdadb->insert` functions.

Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts via the `display name` parameter, which execute when a user accesses the affected page.

Authenticated attackers with custom-level access and above can execute arbitrary shortcodes. This occurs because the software fails to properly validate a value before executing the `do shortcode()` function. The issue is linked to the `ampforwp-cat-description` setting, which is enabled by default.

An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can enumerate WooCommerce order IDs using the `preview order` parameter to exfiltrate customer personally identifiable information (PII), including billing names, addresses, phone numbers, and email addresses. The process involves two unauthenticated requests: first, obtaining a reusable nonce from the 302 Location header returned by the `admin init()` handler, and second, sending that nonce with an arbitrary order ID to the preview endpoint.

Unauthenticated attackers can execute arbitrary shortcodes because the software fails to properly validate a value before running the `do shortcode()` function. Shortcodes are small pieces of code used in WordPress to dynamically generate content.

An issue exists that allows unauthenticated attackers to extract all rows and columns from the database table associated with any anonymously published app. This includes sensitive data such as WordPress user password hashes, email addresses, and password-reset keys from the `wp users` table. The flaw is triggered via the `rel tab` parameter. Exploitation is possible if an administrator has published at least one app with its REST API authorization configured as 'anonymous', which is the default setting for publicly embedded apps.

Unauthenticated attackers can permanently delete any WordPress media library attachment, including files on disk, by exploiting a flaw in the `delete reviews image()` function. The issue occurs because the `delete comment` hook trusts attachment IDs provided via the `wcpr image upload id` POST parameter without verifying ownership or user capabilities. While the `viwcpr filter review image ids()` function checks if the ID refers to an attachment post type, it does not verify the submitter's authorization. An attacker can embed specific attachment IDs into a review comment and trigger deletion when a moderator removes the review or when the `wp scheduled delete` cron process purges it. The `wcpr image upload` nonce is a shared public value, allowing this action to be performed without an account.

Unauthenticated attackers can execute arbitrary shortcodes because the software fails to properly validate a value before running the `do shortcode()` function. This issue occurs when an administrator configures an ad block containing dynamic tags such as `{title}`, `{tag}`, `{category}`, or `{smart-tag}` with display enabled on search pages.

Unauthorized account access is possible due to the use of predictable passwords for built-in dummy user accounts. The function `get dummy user passowrd()` generates a shared password based on a hash of the `AUTH KEY` and `site url()`. The full hash value is exposed in the hidden `uwp register hash` field within registration form responses. This information is accessible without authentication via the `/register/` endpoint and the `wp ajax nopriv uwp ajax register form` AJAX handler, regardless of whether user registration is enabled. An attacker can recover the password from a single HTTP request and authenticate as any of the 25 dummy accounts through `wp-login.php`, which may lead to privilege escalation if a dummy account has an elevated role. This issue only affects sites where an administrator has created dummy users via the Tools page.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. By manipulating the `align` shortcode attribute within comments, an attacker can inject arbitrary web scripts that execute when users visit the affected page. This issue occurs when an administrator enables the 'Parse Vimeo and YouTube links' (`parse comments`) setting, which triggers the `do shortcode()` function on the `comment text` filter, rendering stored shortcode attributes without proper escaping.

Unauthenticated attackers can extract personally identifiable information of staff members, including full names, email addresses, phone numbers, gender, and timezones. Additionally, internal notes authored by administrators for every published event can be retrieved. This occurs because the raw providers array is not stripped before being serialized into the JSON response via the `page` parameter.