Marc-Alexandre Montpas

**Name of the Vulnerable Software and Affected Versions** SiteGround Optimizer plugin for WordPress versions up to 5.0.12 Caldera Forms versions prior to the latest update **Description** The vulnerability is related to authorization bypass, leading to Remote Code Execution and Local File Inclusion. This is due to incorrect use of an access control attribute on the `switch php` function called via the "/switch-php" REST API route. Attackers can include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. **Recommendations** For SiteGround Optimizer plugin for WordPress versions up to 5.0.12: Update to the latest version immediately to mitigate risks. For Caldera Forms versions prior to the latest update: Update to the latest version immediately to mitigate risks. As a temporary workaround, consider disabling the `switch php` function until a patch is available. Restrict access to the vulnerable API endpoint "/switch-php" to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WordPress versions prior to 4.7.2 Debian (affected versions not specified) **Description** The issue concerns a problem with access restrictions in WordPress, specifically in the Press This feature. It allows remote attackers to bypass intended access restrictions by reading terms due to improper restriction of visibility of a taxonomy-assignment user interface. **Recommendations** For WordPress versions prior to 4.7.2, update to version 4.7.2 or later to resolve the issue. For Debian, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WordPress versions 4.7.0 through 4.7.1 **Description** The issue allows remote attackers to modify arbitrary pages. This is achieved by exploiting the `register routes` function in the REST API, which does not require an integer identifier. Attackers can send a request for `wp-json/wp/v2/posts` followed by a numeric value and a non-numeric value. For example, the `wp-json/wp/v2/posts/123?id=123helloworld` URI can be used for this purpose. **Recommendations** For WordPress versions 4.7.0 through 4.7.1, update to version 4.7.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** WordPress versions prior to 4.2.4 **Description** A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of administrators for requests that lock a post, potentially causing a denial of service (editing blockage) via a 'get-post-lock' action. **Recommendations** For versions prior to 4.2.4, update to version 4.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the `wp-admin/post.php` file to minimize the risk of exploitation. Avoid using the 'get-post-lock' action in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** WordPress versions prior to 4.2.4 **Description** A cross-site scripting (XSS) issue exists due to insufficient input validation in the `refreshAdvancedAccessibilityOfItem` function. This allows remote attackers to inject arbitrary web script or HTML via an accessibility-helper title. **Recommendations** For versions prior to 4.2.4, update to version 4.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the `nav-menu.js` file in `wp-admin/js` to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WordPress versions prior to 4.2.4 **Description** A cross-site scripting (XSS) issue exists in the legacy theme preview implementation, allowing remote attackers to inject arbitrary web script or HTML via a crafted string. **Recommendations** For versions prior to 4.2.4, update to version 4.2.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** WordPress versions prior to 4.2.4 **Description** A cross-site scripting (XSS) issue exists in the form function in the WP Nav Menu Widget class. This allows remote attackers to inject arbitrary web script or HTML via a widget title. **Recommendations** For versions prior to 4.2.4, update to version 4.2.4 or later to resolve the issue. As a temporary workaround, consider restricting the ability to edit widget titles to trusted users until the update is applied.

**Name of the Vulnerable Software and Affected Versions** WordPress versions prior to 4.2.4 **Description** A SQL injection issue exists due to mishandling of comments retrieved from the trash in the wp untrash post comments function. This allows remote attackers to execute arbitrary SQL commands. **Recommendations** For versions prior to 4.2.4, update to version 4.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the wp untrash post comments function until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** WordPress versions prior to 4.2.4 **Description** The issue concerns a timing side-channel attack. It is related to the `sanitize widget instance` function, which does not use a constant-time comparison for widgets. This allows remote attackers to conduct an attack by measuring the delay before inequality is calculated. **Recommendations** For versions prior to 4.2.4, update to version 4.2.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Disqus Comment System plugin versions prior to 2.76 for WordPress **Description** The issue allows remote attackers to hijack the authentication of administrators for requests, conducting cross-site scripting (XSS) attacks. This is achieved via the `disqus replace`, `disqus public key`, or `disqus secret key` parameter to "wp-admin/edit-comments.php" in manage.php, or by resetting or deleting plugin options via the `reset` parameter to "wp-admin/edit-comments.php". **Recommendations** For Disqus Comment System plugin versions prior to 2.76, update to version 2.76 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Disqus Comment System plugin versions prior to 2.76 **Description** The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the `step` parameter in the upgrade.php file. **Recommendations** For versions prior to 2.76, update to version 2.76 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** MailPoet Newsletters (wysija-newsletters) plugin versions prior to 2.6.7 **Description** The issue allows remote attackers to bypass authentication and execute arbitrary PHP code. This is achieved by uploading a crafted theme using the "wp-admin/admin-post.php" endpoint and then accessing the theme in "wp-content/uploads/wysija/themes/mailp/". **Recommendations** For versions prior to 2.6.7, update to version 2.6.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the "wp-admin/admin-post.php" endpoint and the "wp-content/uploads/wysija/themes/mailp/" directory to minimize the risk of exploitation.