Leonid Semenenko

**Name of the Vulnerable Software and Affected Versions** wpForo Forum plugin for WordPress versions prior to 2.4.18 **Description** Unauthenticated attackers can perform SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution, by manipulating the `referer` parameter. This occurs because the plugin does not sufficiently escape user-supplied input or properly prepare the SQL query, allowing the addition of unauthorized queries to extract sensitive information from the database. **Recommendations** Update the plugin to version 2.4.18 or later. Avoid using the `referer` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** My Calendar – Accessible Event Manager versions prior to 3.7.9 **Description** An issue exists where unauthenticated attackers can perform time-based blind SQL Injection. This occurs due to insufficient escaping of user-supplied input and a lack of proper preparation of the SQL query. By manipulating the `mc auth` parameter, an attacker can append additional SQL queries to extract sensitive information from the database. **Recommendations** Update the plugin to version 3.7.9 or later. As a temporary mitigation, restrict access to the functionality utilizing the `mc auth` parameter.

**Name of the Vulnerable Software and Affected Versions** AMP for WP versions prior to 1.1.13 **Description** An Arbitrary File Write issue exists due to unsafe ZIP file extraction within the `ampforwp save local font()` function, coupled with inadequate cleanup that fails to remove nested directories and files. Authenticated attackers with Author-level access or higher, and permissions granted by an Administrator, can write arbitrary files to a web-accessible location on the server. This may lead to remote code execution on hosts that execute PHP files in the uploads directory. **Recommendations** Update the plugin to a version newer than 1.1.12.

**Name of the Vulnerable Software and Affected Versions** Contest Gallery versions prior to 28.1.7 **Description** The Contest Gallery plugin for WordPress contains a SQL Injection flaw. This occurs because the unauthenticated 'post cg gallery form upload' AJAX action fails to properly escape the `form input` parameter and lacks sufficient preparation of the SQL query within the 'cb' branch of the `users-upload-check.php` file, where the `$f input id` variable is concatenated unquoted into a SELECT statement. The endpoint is protected only by a public frontend nonce (`cg1l action` / `cg nonce`) visible in the page source of public gallery pages. This allows unauthenticated attackers to append malicious SQL queries to extract sensitive information from the database. **Recommendations** Update to a version later than 28.1.6. As a temporary workaround, restrict access to the 'post cg gallery form upload' AJAX action or avoid using the `form input` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** The Motors – Car Dealership & Classified Listings Plugin versions prior to 1.4.108 **Description** Insufficient file path validation in the become-dealer logo upload flow allows authenticated users with subscriber level access and above to delete arbitrary files on the server. This occurs because the profile update handler permits the setting of an arbitrary filesystem path. **Recommendations** Update the plugin to a version later than 1.4.107.

**Name of the Vulnerable Software and Affected Versions** Betheme versions prior to 28.5 **Description** The Betheme theme for WordPress allows authenticated attackers with author-level access or higher to upload arbitrary files, including PHP scripts. This occurs because the `upload icons()` function moves and unzips user-controlled ZIP files into a public uploads directory without validating the types of the extracted files. This flaw can lead to remote code execution via the Icons icon-pack upload flow. **Recommendations** Update to a version later than 28.4. As a temporary workaround, restrict access to the Icons icon-pack upload flow for users with author-level permissions.

**Name of the Vulnerable Software and Affected Versions** Betheme versions prior to 28.5 **Description** The Betheme theme for WordPress allows authenticated attackers with contributor-level access and above to move or delete arbitrary local files via path traversal. This occurs because the `upload icons()` function uses a user-controlled upload path `mfn-icon-upload` in a filesystem move operation without restricting it to the uploads directory. **Recommendations** Update to a version later than 28.4. As a temporary workaround, restrict access to the `upload icons()` function for users with contributor-level permissions.

**Name of the Vulnerable Software and Affected Versions** Geo Mashup versions prior to 1.13.20 **Description** The Geo Mashup plugin for WordPress contains a time-based blind SQL Injection, a technique that allows an attacker to infer data by observing the time the server takes to respond to specific queries. The issue exists due to insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. Authenticated attackers with subscriber-level access or higher can exploit the `geo mashup null fields` parameter to append additional SQL queries and extract sensitive information from the database. **Recommendations** Update the plugin to a version later than 1.13.19. As a temporary workaround, restrict access to the `geo mashup null fields` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Drag and Drop Multiple File Upload for Contact Form 7 versions prior to 1.3.9.7 **Description** Insufficient file type validation occurs when custom blacklist types are configured, as the system replaces the default dangerous extension denylist instead of merging with it. Additionally, the `wpcf7 antiscript file name()` function can be bypassed using filenames containing non-ASCII characters. This allows unauthenticated attackers to upload arbitrary files, such as PHP files, to the server, potentially leading to remote code execution. **Recommendations** Update to a version later than 1.3.9.6.

**Name of the Vulnerable Software and Affected Versions** DirectoryPress – Business Directory And Classified Ad Listing versions prior to 3.6.27 **Description** An issue exists where unauthenticated attackers can perform SQL Injection, a technique used to interfere with the queries that an application makes to its database. This occurs due to insufficient escaping of user-supplied input and a lack of proper preparation of the SQL query. The flaw is triggered via the `packages` parameter, allowing attackers to append additional SQL queries to extract sensitive information from the database. **Recommendations** Update DirectoryPress – Business Directory And Classified Ad Listing to version 3.6.27 or later. Avoid using the `packages` parameter until the plugin is updated.

**Name of the Vulnerable Software and Affected Versions** wpForo Forum plugin for WordPress versions prior to 3.0.3 **Description** A logic flaw exists in the `topic add()` and `topic edit()` action handlers that allows authenticated users with subscriber-level access and above to delete arbitrary files writable by the PHP process. The issue occurs because the handlers accept arbitrary user-supplied `data` arrays from `$ REQUEST` and store them as postmeta. An attacker can provide a malicious file path via the `data[body][fileurl]` parameter, which is then persisted in the database. When a subsequent `topic edit` request is made using the `wpftcf delete[]=body` parameter, the `add file()` method retrieves the stored path, processes it through `wpforo fix upload dir()`, and passes the unvalidated path to `wp delete file()`, enabling the deletion of critical files such as `wp-config.php`. **Recommendations** Update the wpForo Forum plugin for WordPress to version 3.0.3 or later.

Name of the Vulnerable Software and Affected Versions wpForo Forum plugin for WordPress versions up to and including 2.4.16 Description The wpForo Forum plugin for WordPress is susceptible to arbitrary file deletion due to a missing file name/path validation against path traversal sequences. Authenticated attackers with subscriber level access or higher can delete arbitrary files on the server by embedding a crafted path traversal string within a forum post body and then deleting the post. Recommendations Update the wpForo Forum plugin to a version later than 2.4.16.

**Name of the Vulnerable Software and Affected Versions** WP Job Portal plugin for WordPress versions prior to 2.4.9 **Description** The WP Job Portal plugin for WordPress is susceptible to SQL Injection due to inadequate input sanitization and insufficient SQL query preparation. Specifically, the `radius` parameter is not properly escaped, allowing unauthenticated attackers to inject additional SQL queries into existing database queries. This could enable attackers to extract sensitive information from the database. **Recommendations** Update the WP Job Portal plugin to version 2.4.9 or later.