Mitchell

**Name of the Vulnerable Software and Affected Versions** Page and Post Restriction versions prior to 1.4.1 **Description** Sensitive information exposure occurs via the WordPress core REST endpoints '/wp-json/wp/v2/pages', '/wp-json/wp/v2/pages/<id>', '/wp-json/wp/v2/posts', and '/wp-json/wp/v2/posts/<id>'. The issue stems from the REST guards `papr restrict page post rest api()` and the `the posts` filter registered by `papr filter posts()` relying solely on `papr get restricted posts id()`. This function only reads the per-page metabox options `papr allowed redirect for pages` and `papr allowed redirect for posts`, ignoring the global toggles `papr access for only loggedin` and `papr access for only loggedin posts` used to make all pages or posts private. Consequently, unauthenticated attackers can read the full rendered content of every published page and post, bypassing the security boundary enforced by `papr restrict logged in users()` on the frontend. **Recommendations** Update the plugin to a version later than 1.4.0.

**Name of the Vulnerable Software and Affected Versions** Wallet for WooCommerce versions prior to 1.6.5 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can enumerate the login name, email address, and user ID of all WordPress accounts, including administrators. This is achieved by submitting arbitrary search terms to the AJAX handler. The required `search-user` nonce is localized within the `wallet param` object on the standard WooCommerce My Account page, which is accessible to any authenticated user. **Recommendations** Update Wallet for WooCommerce to version 1.6.5 or later.

**Name of the Vulnerable Software and Affected Versions** Request a Quote versions prior to 2.5.6 **Description** The Request a Quote plugin for WordPress allows unauthenticated attackers to perform code injection. The issue occurs because the `emd delete file()` function derives a PHP function name from the attacker-controlled `path` parameter and invokes it dynamically. This is accessible via the `emd delete file` AJAX action, which is registered for `wp ajax nopriv`. Although a nonce is used for protection, it is printed into the public quote-form page, allowing attackers to bypass this check and invoke arbitrary zero-argument PHP functions, such as `phpinfo()`, which can expose sensitive server configurations and credentials. **Recommendations** Update the plugin to a version newer than 2.5.5. As a temporary mitigation, restrict access to the `emd delete file` AJAX action.