Michael Iden

**Name of the Vulnerable Software and Affected Versions** Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin versions prior to 1.6.12.11 **Description** An Insecure Direct Object Reference exists due to missing validation on a user-controlled key within `ssa past appointments`. Authenticated attackers with contributor-level access or higher can exploit the `/wp-json/ssa/v1/render-shortcode` REST endpoint to access appointment records of arbitrary users. This allows the harvesting of per-appointment ownership tokens, which are 32-character hashes embedded in the HTML. These tokens can be used without authentication to read or modify appointments, exposing personally identifiable information (PII) such as names, emails, phone numbers, and private notes. **Recommendations** Update the plugin to a version newer than 1.6.12.10.

**Name of the Vulnerable Software and Affected Versions** PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin versions prior to 3.6.21 **Description** An issue exists where authenticated attackers with Administrator-level access and above can perform SQL Injection. This occurs via the 's' parameter on the Pretty Links listing page due to insufficient escaping of user-supplied input and lack of preparation in the SQL query within the `search links table()` function. This allows the execution of additional SQL queries to extract sensitive information from the database. **Recommendations** Update the plugin to a version newer than 3.6.20. As a temporary mitigation, restrict access to the Pretty Links listing page or avoid using the `s` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** NEX-Forms – Ultimate Forms Plugin for WordPress versions prior to 9.2.3 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to overwrite the `saved admin email`, `saved user email`, and `saved user email address` fields of form entries belonging to other users. Consequently, the site can be manipulated to send attacker-controlled email content to recipient addresses chosen by the attacker. **Recommendations** Update NEX-Forms – Ultimate Forms Plugin for WordPress to version 9.2.3 or later.

**Name of the Vulnerable Software and Affected Versions** LatePoint versions prior to 5.5.1 **Description** A weak password recovery mechanism in the unauthenticated guest booking flow allows for account takeover. The `save connected wordpress user()` function uses `wp update user()` to propagate a customer's email address to a linked WordPress user account without ownership verification. This, combined with the ability to overwrite a customer's email through phone-based merge without authentication, allows unauthenticated attackers to change the email address of a non-super-admin WordPress user account not yet linked to a LatePoint customer. Attackers can then trigger the standard WordPress password-reset flow to an address they control. This occurs when the plugin has WordPress user integration enabled, phone-based contact merging active, and customer authentication disabled. **Recommendations** Update to a version later than 5.5.0. As a temporary mitigation, disable WordPress user integration, phone-based contact merging, or enable customer authentication.

Name of the Vulnerable Software and Affected Versions The Awesome Support – WordPress HelpDesk & Support Plugin versions up to and including 6.3.7 Description The Awesome Support – WordPress HelpDesk & Support Plugin is susceptible to an Insecure Direct Object Reference issue. The `wpas get ticket replies ajax()` function does not properly validate user permissions when accessing support tickets. This allows authenticated attackers with subscriber-level access or higher to access sensitive information from all support tickets by manipulating the `ticket id` parameter. Recommendations For versions up to and including 6.3.7, ensure the `wpas get ticket replies ajax()` function properly verifies user permissions before granting access to support ticket data.

Name of the Vulnerable Software and Affected Versions WP Shortcodes Plugin — Shortcodes Ultimate versions through 7.4.10 Description The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `max width` attribute of the `su box` shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. Recommendations Update WP Shortcodes Plugin — Shortcodes Ultimate to a version later than 7.4.10.

**Name of the Vulnerable Software and Affected Versions** Post SMTP plugin for WordPress versions up to and including 3.8.0 **Description** The Post SMTP plugin for WordPress is susceptible to unauthorized data modification because of a missing capability check within the `handle office365 oauth redirect()` function. This function, connected to the `admin init` action without proper authorization or nonce verification, allows authenticated attackers with Subscriber-level access or higher to alter the Office 365 OAuth mail configuration—specifically, the access token, refresh token, and user email—through a specially crafted URL. This configuration is utilized during the Microsoft365 SMTP wizard setup, available in the Pro version of the plugin. An attacker could potentially deceive an Administrator into connecting the plugin to a malicious Azure application, leading to account compromise after upgrading to the Pro version. **Recommendations** Update Post SMTP plugin to a version later than 3.8.0.

**Name of the Vulnerable Software and Affected Versions** Formidable Forms plugin for WordPress versions up to and including 6.28 **Description** The Formidable Forms plugin for WordPress is susceptible to an authorization bypass due to a user-controlled key. This occurs because the `frm strp amount` AJAX handler, also known as `update intent ajax`, overwrites global `$ POST` data with attacker-controlled JSON input. This input is then used to recalculate payment amounts through field shortcode resolution in the `generate false entry()` function. The handler uses a nonce, exposed in the page’s JavaScript (`frm stripe vars.nonce`), which provides CSRF protection but does not enforce authorization. This allows unauthenticated attackers to manipulate PaymentIntent amounts before payment completion on forms utilizing dynamic pricing with field shortcodes, potentially resulting in reduced payment amounts for goods or services. **Recommendations** Versions up to and including 6.28 should be updated to a newer, fixed version when available. As a temporary workaround, consider disabling the `frm strp amount` AJAX handler (`update intent ajax`) until a patch is available. Restrict access to the `generate false entry()` function to authorized users only.