Michael Perla

**Name of the Vulnerable Software and Affected Versions** Motors – Car Dealership & Classified Listings Plugin versions prior to 1.4.112 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can mark or unmark any other user's car listing as sold. This is achieved by replaying a valid nonce—a unique token used to prevent replay attacks—harvested from their own listing against an arbitrary victim post ID. This action triggers a site-wide Sold badge on the victim's listing and removes its `special car` featured post meta. To exploit this, the attacker must have their own active listing to obtain a valid nonce for the `stm mark as sold car` action. **Recommendations** Update to a version newer than 1.4.111.

Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar - Amelia plugin for WordPress versions through 2.1.2. Description The Booking for Appointments and Events Calendar - Amelia plugin for WordPress is susceptible to SQL injection through the `sort` parameter in the payments listing endpoint. This is due to insufficient escaping of the user-supplied `sort` parameter and inadequate preparation of the SQL query in `PaymentRepository.php`, where the sort field is directly interpolated into an ORDER BY clause without sanitization or whitelist validation. PDO prepared statements do not protect ORDER BY column names. GET requests also bypass Amelia's nonce validation. This allows authenticated attackers with Manager-level (`wpamelia-manager`) access and above to append additional SQL queries to existing queries, potentially extracting sensitive information from the database via time-based blind SQL injection. Recommendations Update to a version beyond 2.1.2.