Lhking

The Masterstudy - Education WordPress Theme theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.151. This is due to missing authorization and nonce validation on the `masterstudy ms stm set discard transient` AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator by setting the `stm developer access token` transient and using the developer access auto-login flow to obtain administrator session cookies.

Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. Attackers can inject arbitrary web scripts into social profile fields. While the payload is stored in the attacker's user meta, it is publicly exposed on the author archive page at the endpoint '/author/<slug>/', allowing the script to execute when accessed by unauthenticated visitors.

Unauthenticated attackers can escalate privileges to administrator by updating arbitrary WordPress options. This occurs because the `ajax refresh nonce` and `ak admin ajax` handlers fail to perform capability checks before passing attacker-controlled option names and values to the `update option()` function. By manipulating these handlers, an attacker can enable user registration and set the `default role` to administrator via the `users can register` and `default role` variables.

The Tutor LMS plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Authenticated users with subscriber-level access or higher can inject arbitrary web scripts through the `display name` parameter. These scripts execute when another user accesses the affected page. This exploitation is possible if a Legal Consent record exists for the attacker's account, which triggers the appearance of the View Logs button in the `wp-admin/users.php` Consent Logs column.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. By manipulating the `url` parameter, an attacker can inject arbitrary web scripts into pages that execute when an administrator clicks the injected heatmap link.

An issue exists where authenticated attackers with subscriber-level access and above can perform a generic SQL Injection. This occurs due to insufficient escaping of the user-supplied `access privileges` parameter and a lack of sufficient preparation of the SQL query. The flaw allows attackers to append additional SQL queries to extract sensitive information from the database. This is possible on installations where an administrator has saved a role-based deny-list Access Privilege configuration that does not explicitly block the internal `access-privilege` module, allowing the authorization filter to implicitly permit Subscriber-level users to invoke the vulnerable handler.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. This issue is triggered via the `REQUEST URI` path through the `ao ccss enqueue()` function. Exploitation requires the Critical CSS feature to be active and a valid API key to be configured, allowing unauthenticated frontend requests to create queue entries.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS). This occurs through the Mark on Map Longitude and Latitude fields, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page.

Local File Inclusion occurs via the `page` parameter. Authenticated attackers with subscriber-level access or higher can include and execute arbitrary .php files on the server. This allows for the execution of PHP code contained within those files, which can be used to bypass access controls, obtain sensitive data, or achieve remote code execution if .php files can be uploaded to the server.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. The issue arises because a float cast used during quantity validation allows payloads with numeric prefixes, such as `1<img src=x onerror=...>`, to bypass validation. This malicious HTML is then stored in the order item metadata under the ` woosb ids` key via the `qty` parameter.

Authenticated attackers with subscriber-level access or higher can achieve full privilege escalation to administrator. This occurs due to two combined flaws: the 'masterstudy ms stm set discard transient' AJAX endpoint in admin/admin-notices/classes/STMHandler.php accepts an arbitrary transient key without capability checks or nonce validation, and the developer access login mechanism in admin/classes/stm-theme-support.php authenticates users based on a transient value without proper cryptographic validation when in legacy string mode. An attacker can set the `stm developer access token` transient to a known value and then authenticate as any existing user, including administrators, by visiting a specially crafted URL.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages by placing a guest checkout order with a JavaScript payload in a WooCommerce billing field, such as the billing first name. This issue requires the WooCommerce order data integration option `GTM4WP OPTION INTEGRATE WCORDERDATA` to be enabled. The injected scripts execute whenever a user accesses the affected page.

An arbitrary file upload issue exists in the `ajax chunk upload finalize()` function. The flaw occurs because file type validation is performed after the chunk metadata and file contents are written to the disk, and the assembled file is not deleted if validation fails. This allows unauthenticated attackers to upload executable files, potentially leading to remote code execution.

An authentication bypass exists due to SAML Signature Algorithm Confusion. The issue occurs because the `Mo SAML Utilities::mo saml cast key()` function reads the `SignatureMethod` attribute directly from the attacker-controlled `SAMLResponse` parameter instead of using the locally configured algorithm. This allows the plugin to treat the Identity Provider's RSA public key as an HMAC-SHA1 shared secret to validate a forged signature. Consequently, unauthenticated attackers can forge SAML assertions for any account, including administrators, to obtain authentication cookies and achieve full account takeover.

Insufficient file path validation in the `delete converted image size()` function allows authenticated attackers with author-level access or higher to delete arbitrary files on the server. This can be achieved by injecting a server file path into the `convert.path` field of the `tiny compress images` post meta on an attachment owned by the attacker and then triggering the attachment deletion. Deleting critical files, such as `wp-config.php`, can lead to remote code execution.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. This happens because the `panels data` parameter is stored as post meta, bypassing the `wp kses` fallback—a WordPress function used to filter HTML—which allows unsanitized `WP Widget Custom HTML` content to be rendered on the frontend when a user accesses the affected page.