Matan Bahar

**Name of the Vulnerable Software and Affected Versions** Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.0.12 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to send arbitrary HTML-injected emails to registered users using the site's own mail server, leveraging its SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) reputation to bypass spam filters. The issue occurs because the `emailSubject` parameter is passed to the `wp mail()` function with insufficient sanitization, and `emailBody` text items are concatenated into the HTML body without escaping. Additionally, chip items can be used to embed legitimate WordPress password-reset links for targeted accounts. **Recommendations** Update to version 6.0.12 or later.

The K2 frontend `item.checkin` task accepts an unauthenticated `sigProFolder` query parameter and uses it directly to address a `JFolder::delete()` call under `/media/k2/galleries/`

K2 ≤ 2.26 renders the `# k2 users.image` column directly into HTML `src` attributes via two distinct templates, in both cases without HTML escaping.

K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg user k2`. A Registered Joomla user, by including the field `K2UserForm=1` in a standard `com users` `profile.save` POST, can write arbitrary values into the `notes`, `image`, and `plugins` columns of their own row in the `# k2 users` table — none of which are exposed by the K2 frontend profile-edit form.

A Joomla user with K2 "create item" rights (Author tier by default) can submit an article whose `embedVideo` POST field contains a raw `<script>` tag; K2 stores it verbatim and renders it unescaped to any visitor of the article page.

The K2 article gallery upload path accepts a zip/tar archive, extracts it under `/media/k2/galleries/<id>/`, and only renames image files (gif/jpg/jpeg/png/webp) to safe names — non-image files (including `.php`) are extracted as-is and remain executable via direct HTTP access.

**Name of the Vulnerable Software and Affected Versions** K2 (affected versions not specified) **Description** The frontend article-attachment upload path allows the upload of files with the `.php` extension. When used with Apache's standard mod php, which matches the `.php$` pattern, these files are executed under the K2 web user. This allows a user with K2 Author privileges to upload a malicious file, such as `shell.php`, and access it via the endpoint `/media/k2/attachments/shell.php` to execute arbitrary PHP code within the context of the web server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The K2 frontend article-save handler accepts an `attachment[N][existing]` POST field that is concatenated with `JPATH SITE/` and passed to `JFile::copy()`. `JPath::clean` does NOT strip `..`, and there is no allow-list of source paths. An Author can therefore copy `configuration.php` (or any other file readable by the web user — including `../../../etc/passwd`) into `/media/k2/attachments/`, then retrieve the contents via the K2 attachment-download endpoint.