Lucio Sá

Name of the Vulnerable Software and Affected Versions: LiquidThemes WordPress plugins and themes (affected versions not specified) Description: Multiple plugins and/or themes developed by LiquidThemes for WordPress are susceptible to unauthorized access due to the absence of a capability check within the `liquid reset wordpress before` AJAX function. This allows authenticated attackers with Subscriber-level access or higher to deactivate all plugins on a WordPress site. The developer implemented a nonce check as a mitigation, but this measure is insufficient as the nonce is exposed to users with dashboard access. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: School Management System for Wordpress plugin for WordPress versions prior to 93.2.1 Description: The School Management System for Wordpress plugin for WordPress is vulnerable to SQL Injection via several parameters across multiple AJAX actions due to insufficient escaping of user-supplied parameters and a lack of sufficient preparation of existing SQL queries. This allows unauthenticated attackers to append additional SQL queries, potentially extracting sensitive information from the database. Recommendations: Update to version 93.2.1 or later.

Name of the Vulnerable Software and Affected Versions: The DWT - Directory & Listing WordPress Theme versions up to, and including, 3.3.6 Description: The issue allows for privilege escalation via account takeover due to improper checking of an empty token value prior to resetting a user's password through the `dwt listing reset password()` function. This enables unauthenticated attackers to change arbitrary users' passwords, including administrators, and gain access to their accounts. Recommendations: For versions up to, and including, 3.3.6, as a temporary workaround, consider disabling the `dwt listing reset password()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to arbitrary shortcode execution due to the software allowing users to execute an action that does not properly validate a value before running `do shortcode()`. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

The issue is related to arbitrary shortcode execution due to improper validation of a value before running do shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes.

The issue concerns multiple plugins and/or themes for WordPress that are vulnerable to unauthorized access due to a missing capability check on several AJAX actions, such as `gsf reset section options` and `gsf create preset options`. This allows authenticated attackers with Subscriber-level access and above to reset and modify some plugin/theme settings. The problem was reported to Envato over two months ago, and although partial patches have been released, the issues remain vulnerable.

The issue is related to a missing capability check on the `ajaxUploadFonts()` function in various WordPress plugins and themes, allowing authenticated attackers with Subscriber-level access and above to upload arbitrary files. This can potentially lead to remote code execution. The issue was escalated to Envato over two months ago and, while partially patched, remains vulnerable.

The issue is related to Stored Cross-Site Scripting due to a missing capability check on the `saveOptions()` and `importThemeOptions()` functions. This allows authenticated attackers with Subscriber-level access and above to update the plugin's settings, including custom JavaScript that is enabled site-wide.

The issue is related to arbitrary shortcode execution due to the software allowing users to execute an action that does not properly validate a value before running `do shortcode()`. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

The issue is related to Insecure Direct Object Reference, which allows authenticated attackers with Subscriber-level access and above to view other users' invoices and orders containing sensitive information. This is possible due to missing validation on a user-controlled key in the `xc woo printer preview` AJAX action.

The issue allows unauthorized modification and loss of data due to a missing capability check on the `reales delete file`, `reales delete file plans`, `reales add to favourites`, and `reales remove from favourites` functions. This makes it possible for unauthenticated attackers to delete arbitrary attachments, and add or remove favorite property listings for any user.

The issue allows authenticated attackers with Subscriber-level access and above to modify data due to a missing capability check on the 'dzsap delete notice' AJAX action. This can lead to a denial of service by updating option values to cause an error on the site or setting certain values to true, such as registration. Several other functions are also vulnerable to missing authorization.

The issue allows for privilege escalation via account takeover. This is due to the plugin using the Host header to determine if it is in a playground environment, making it possible for unauthenticated attackers to spoof the Host header, set the OTP code to "1234", and authenticate as any user, including administrators.

The issue allows for unauthorized modification of data, potentially leading to a denial of service. This is due to a missing capability check on the `baf set notice status` AJAX action. Authenticated attackers with Subscriber-level access or higher can update option values to `1` on the WordPress site. This can be exploited to create an error on the site, denying service to legitimate users, or to set certain values to true, such as registration.

The issue affects the CozyStay and TinySalt plugins for WordPress, allowing unauthenticated attackers to inject a PHP object through deserialization of untrusted input in the `ajax handler` function. This vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme, it may allow the attacker to perform actions like deleting arbitrary files, retrieving sensitive data, or executing code, depending on the POP chain present.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on several functions, including `foodbakery var backup file delete`, `foodbakery widget file delete`, `theme option save`, `export widget settings`, `ajax import widget data`, `foodbakery var settings backup generate`, `foodbakery var backup file restore`, and `theme option rest all`. This allows unauthenticated attackers to perform various actions, such as deleting arbitrary files, updating theme options, exporting and importing widget options, generating and restoring backups, and resetting theme options, by tricking a site administrator into performing an action.

The CozyStay theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax handler` function. This makes it possible for unauthenticated attackers to execute arbitrary actions.

The issue allows unauthenticated attackers to include and execute arbitrary files on the server through the `template` parameter. This enables the execution of any PHP code in those files, which can be used to bypass access controls, obtain sensitive data, or achieve code execution when images and other "safe" file types can be uploaded and included.

The issue allows unauthorized access and modification of data due to a missing capability check on several functions, including `foodbakery var backup file delete`, `foodbakery widget file delete`, `theme option save`, `export widget settings`, `ajax import widget data`, `foodbakery var settings backup generate`, `foodbakery var backup file restore`, and `theme option rest all`. This enables authenticated attackers with Subscriber-level access and above to perform various malicious actions, such as deleting arbitrary files, updating theme options, exporting and importing widget options, generating and restoring backups, and resetting theme options.

Name of the Vulnerable Software and Affected Versions: The Eco Nature - Environment & Ecology WordPress Theme versions up to, and including, 2.0.4 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify data, potentially leading to a denial of service. This is due to a missing capability check on the 'cmsmasters hide admin notice' AJAX action. Attackers can update option values to 'hide' on the WordPress site, creating an error or denying service to legitimate users. They can also set certain values to true, such as registration. Recommendations: For versions up to, and including, 2.0.4, update to a version that includes a fix for the missing capability check on the 'cmsmasters hide admin notice' AJAX action to prevent unauthorized modification of data. As a temporary workaround, consider restricting access to the 'cmsmasters hide admin notice' AJAX action to prevent exploitation until a patch is available.