Lyris Vale

**Name of the Vulnerable Software and Affected Versions** PeproDev WooCommerce Receipt Uploader versions prior to 2.8.1 **Description** The plugin is vulnerable to an unauthenticated Insecure Direct Object Reference (IDOR) write, which occurs when an application provides direct access to objects based on user-supplied input without proper authorization. This allows an unauthenticated attacker to perform order receipt tampering. The issue requires WooCommerce to be installed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin versions prior to 7.8.0 **Description** The optional email-verification (Profile Completion) feature fails to bind the one-time code to the specific account for which it was issued. This allows unauthenticated attackers to obtain a valid session for any account, including those with administrator privileges, by requesting a code for an email address they control and replaying it against the victim's email address. This issue is exploitable only if the Profile Completion feature is enabled and social login is configured. **Recommendations** Update the plugin to version 7.8.0 or later. As a temporary mitigation, disable the Profile Completion feature.