Legion Hunter

The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnect callback() function in versions up to, and including, 1.2.3. The function is registered to the 'wp ajax wcefr-disconnect' AJAX action and unconditionally calls delete option('wcefr-agt'), which removes the Reviso Agreement Grant Token used to authenticate API calls. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's stored Agreement Grant Token, breaking the connection between WooCommerce and the Reviso service.

**Name of the Vulnerable Software and Affected Versions** Udimi Tools versions prior to 3.3 **Description** The Udimi Tools plugin for WordPress allows authenticated users with Subscriber-level access and above to perform unauthorized data modifications. This is caused by missing capability checks in the `ajax disconnect()` and `ajax connect()` functions. An attacker can use `ajax disconnect()` to delete six configuration options, such as the API key, connected Udimi user email, and tracking-script payload, which disconnects the site from the Udimi account. Additionally, the `ajax connect()` function allows attackers to overwrite these configuration options with an attacker-supplied API key. **Recommendations** Update Udimi Tools to version 3.3 or later. As a temporary workaround, restrict access to the `ajax disconnect()` and `ajax connect()` functions.

**Name of the Vulnerable Software and Affected Versions** WPFormify – Stripe Payments with Form and Checkout versions prior to 1.1.2 **Description** Unauthenticated attackers can modify or delete Stripe payment credentials. This occurs because the `wpf stripe callback success()` and `wpf stripe disconnect()` functions, which are hooked to `admin init` on the `admin-post.php` endpoint, lack capability checks and nonce verification. A nonce is a unique token used to prevent replay attacks by ensuring a request is intentional and authentic. This flaw allows an attacker to overwrite Stripe API credentials to redirect payments to their own account or completely disconnect the Stripe integration. **Recommendations** Update WPFormify – Stripe Payments with Form and Checkout to version 1.1.2 or later. As a temporary workaround, restrict access to the `admin-post.php` endpoint or disable the `wpf stripe callback success()` and `wpf stripe disconnect()` functions until the update is applied.

**Name of the Vulnerable Software and Affected Versions** wiseCampaign – WooCommerce Conversions Made Easy versions prior to 1.1.17 **Description** The plugin is susceptible to unauthorized data disclosure and modification because all REST API endpoints are registered with `permission callback => ' return true'`, which bypasses necessary authorization. This allows unauthenticated attackers to read and modify core settings, stockbar configurations, and banner records. Additionally, attackers can toggle feature flags, change the active banner, and upload background-image files using the `wp handle upload()` function without providing a nonce or passing a capability check. **Recommendations** Update the plugin to a version later than 1.1.16.

**Name of the Vulnerable Software and Affected Versions** Fense Proxy & VPN Blocker versions prior to 3.0.2 **Description** Unauthorized modification of data is possible due to a missing capability check and missing nonce validation in the `fense bpvt save settings()` function. The callback is registered to both `wp ajax *` and `wp ajax nopriv *` hooks and unconditionally calls `delete option()` on four plugin options and `delete transient()` on three transients related to the plugin's API key cache and settings. This allows unauthenticated attackers to delete plugin options and transients, resetting the API key and data cache, which forces the plugin to refetch state. **Recommendations** Update to a version newer than 3.0.1. As a temporary mitigation, restrict access to the `fense bpvt save settings()` function.

**Name of the Vulnerable Software and Affected Versions** ThriveDesk – Live Chat, AI Chatbot, Helpdesk & Knowledge Base versions prior to 2.1.8 **Description** Authenticated users with Subscriber-level access and above can perform unauthorized cache deletion. This is caused by a missing capability check on the `thrivedesk clear cache` AJAX action. **Recommendations** Update ThriveDesk – Live Chat, AI Chatbot, Helpdesk & Knowledge Base to version 2.1.8 or later.

**Name of the Vulnerable Software and Affected Versions** GW AI Website Builder versions prior to 1.0.2 **Description** The plugin is susceptible to unauthorized data modification because the `gwaiwebu gravitywrite disconnect handler()` function lacks a proper capability check. Authenticated users with Subscriber-level permissions or higher can exploit this by using the 'gwaiwebu gravitywrite disconnect' AJAX action to disconnect the plugin from GravityWrite. **Recommendations** Update the plugin to version 1.0.2 or later. As a temporary mitigation, restrict access to the `gwaiwebu gravitywrite disconnect handler()` function.

**Name of the Vulnerable Software and Affected Versions** GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference versions prior to 1.1.9 **Description** Cross-Site Request Forgery (CSRF) occurs due to missing nonce verification in the `reset credential()` function, which handles the `wp ajax goodmeet reset google meet credential` AJAX action. Although the function checks for the `manage options` capability, the lack of a nonce allows unauthenticated attackers to trick a site administrator into clicking a malicious link. This action resets and deletes the stored Google Meet API credentials `goodmeet google credentials` and OAuth tokens `goodmeet google token`, resulting in the disablement of the Google Meet integration on the site. **Recommendations** Update to a version newer than 1.1.8.

**Name of the Vulnerable Software and Affected Versions** Age Verification & Identity Verification by Token of Trust versions prior to 4.0.3 **Description** The plugin is subject to unauthorized access because the `handle export table()` function is registered on the WordPress 'init' hook without a capability check. This hook executes for all requests, including those from unauthenticated users. An attacker can download a CSV file containing sensitive WooCommerce donation data—such as order dates, order IDs, charitable donation amounts, and admin-only order edit URLs—by accessing any page with the `tot export table` GET parameter set to a numeric value between 0 and 3. **Recommendations** Update the plugin to a version later than 4.0.2. As a temporary mitigation, restrict access to the `tot export table` parameter to prevent unauthorized data export.

**Name of the Vulnerable Software and Affected Versions** Webba Booking versions prior to 6.4.14 **Description** Webba Booking contains a missing authorization flaw resulting from incorrectly configured access control security levels. This occurs due to a missing capability check within a function, allowing unauthenticated attackers to perform unauthorized actions. **Recommendations** Update to a version newer than 6.4.13.

**Name of the Vulnerable Software and Affected Versions** WebToffee Product Import Export for WooCommerce versions prior to 2.5.7 **Description** An authorization flaw exists due to a missing capability check in a function, allowing authenticated users with subscriber-level access and above to perform unauthorized actions by exploiting incorrectly configured access control security levels. **Recommendations** Update WebToffee Product Import Export for WooCommerce to version 2.5.7 or later.

**Name of the Vulnerable Software and Affected Versions** RepairBuddy versions prior to 4.1121 **Description** A missing authorization issue in Webful Creations RepairBuddy allows for the exploitation of incorrectly configured access control security levels. **Recommendations** Update to a version later than 4.1121.

**Name of the Vulnerable Software and Affected Versions** WP Search Analytics versions prior to 1.5.0 **Description** A missing authorization issue in the plugin allows for the exploitation of incorrectly configured access control security levels, resulting in broken access control. **Recommendations** Update to version 1.5.0 or later.

**Name of the Vulnerable Software and Affected Versions** QR Redirector versions prior to 2.0.3 **Description** Missing authorization allows the exploitation of incorrectly configured access control security levels. **Recommendations** Update QR Redirector to a version newer than 2.0.3.

**Name of the Vulnerable Software and Affected Versions** Autoship Cloud for WooCommerce Subscription Products versions prior to 2.14.1 **Description** A missing authorization issue exists in the Autoship Cloud for WooCommerce Subscription Products plugin, which allows for the exploitation of incorrectly configured access control security levels. This is a broken access control flaw where the system fails to properly verify the identity or permissions of a user before granting access to restricted resources. **Recommendations** Update to a version later than 2.14.0.

**Name of the Vulnerable Software and Affected Versions** Feeds for YouTube versions prior to 2.6.4 **Description** A missing capability check in the `actions()` function allows users with subscriber privileges or higher to unauthorizedly modify or delete the plugin license key. **Recommendations** Update to version 2.6.4 or later. As a temporary workaround, restrict access to the `actions()` function to only authorized administrative users.

**Name of the Vulnerable Software and Affected Versions** Barcode Scanner with Inventory & Order Manager versions prior to 1.11.0 **Description** A Cross-Site Request Forgery (CSRF) flaw exists in the Barcode Scanner with Inventory & Order Manager. This issue allows an attacker to induce a user to perform actions they did not intend to do by tricking them into clicking a malicious link or visiting a compromised page. **Recommendations** Update to a version later than 1.11.0.

Name of the Vulnerable Software and Affected Versions Eniture technology LTL Freight Quotes – Worldwide Express Edition versions through 5.2.1 Description A missing authorization issue exists in Eniture technology LTL Freight Quotes – Worldwide Express Edition due to incorrectly configured access control security levels. Recommendations Update to a version later than 5.2.1

**Name of the Vulnerable Software and Affected Versions** Funlus Oy WPLifeCycle versions through 3.3.1 **Description** An authorization issue exists in Funlus Oy WPLifeCycle free-php-version-info, allowing exploitation due to incorrectly configured access control security levels. **Recommendations** Versions prior to 3.3.1 should be updated.

**Name of the Vulnerable Software and Affected Versions** Chocolate House versions through 1.1.5 **Description** A missing authorization issue exists in Chocolate House, allowing exploitation of incorrectly configured access control security levels. **Recommendations** Update Chocolate House to a version later than 1.1.5.