Moonge

The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as well as to create arbitrary accounts.

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including administrator passwords, to a known plugin-configured custom value, enabling full account takeover of the site. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.

**Name of the Vulnerable Software and Affected Versions** Uix UserCenter versions prior to 1.0.4 **Description** The Uix UserCenter WordPress plugin fails to verify if the account being modified during an unauthenticated profile-update action belongs to the requester. The process uses a token for authentication that relies on a hardcoded signing key identical across all installations. This allows unauthenticated attackers to forge tokens for any user, overwrite the email and password of an administrator, and gain full control of the account. **Recommendations** Update Uix UserCenter to version 1.0.4 or later.

The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator.

**Name of the Vulnerable Software and Affected Versions** 6Storage Rentals versions prior to 2.27.1 **Description** An authentication bypass exists that allows unauthenticated attackers to log in as any existing WordPress user, including administrators. The issue occurs because the `six storage create wp user()` function is registered on the `wp ajax nopriv six storage create wp user` AJAX endpoint without requiring a nonce, capability, credential, or ownership verification. By providing a target user's email address via the `email` parameter, an attacker can trigger `wp set current user()` and `wp set auth cookie()` to gain unauthorized access. **Recommendations** Update to a version newer than 2.27.0. As a temporary workaround, restrict access to the `wp ajax nopriv six storage create wp user` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** User Session Synchronizer versions prior to 1.4.1 **Description** An authentication bypass exists that can lead to account takeover. The `synchronize session()` function, which executes on every request, fails to validate nonces, capabilities, or shared secrets for the `ussync-key`, `ussync-token`, and `ussync-ref` parameters. If the `ussync-key` refers to an unregistered slot, the AES-256-CBC encryption key reverts to a predictable `md5('')` value and the referer allowlist becomes an empty-string match, while the AES IV (Initialization Vector) is hard-coded as `md5('another-secret')`. This allows unauthenticated attackers to send a crafted request with an encrypted user email address in the `ussync-ref` parameter, triggering `wp set auth cookie()` and granting full access to the targeted account, including administrator privileges. **Recommendations** Update the plugin to a version later than 1.4.0. As a temporary workaround, restrict access to the `synchronize session()` function or disable the plugin until the update is applied.

**Name of the Vulnerable Software and Affected Versions** FoodBoxBooker versions prior to 1.0.7 **Description** Insufficient validation of password reset requests allows unauthenticated attackers to reset passwords for any user, including those with administrator privileges, potentially resulting in a complete site takeover. **Recommendations** Update FoodBoxBooker to version 1.0.7 or later.

**Name of the Vulnerable Software and Affected Versions** AutoNetTV Relay WordPress plugin versions prior to 3.0.14 **Description** The plugin fails to perform capability or authentication checks before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On specific server configurations where the scheduled task executes before the HTTP response is committed, an unauthenticated attacker can trigger the task to obtain the administrator session cookie, granting full administrative access without credentials. **Recommendations** Update AutoNetTV Relay WordPress plugin to version 3.0.14 or later.

**Name of the Vulnerable Software and Affected Versions** Single Sign On For TNG WordPress plugin versions prior to 2.2.0 **Description** Insufficient validation of password reset requests allows unauthenticated attackers to reset passwords for any user, including those with administrator privileges, potentially resulting in a complete site takeover. **Recommendations** Update Single Sign On For TNG WordPress plugin to version 2.2.0 or later.

**Name of the Vulnerable Software and Affected Versions** BricksForge WordPress plugin versions prior to 3.1.8.8 **Description** An issue exists where the plugin fails to verify the identity of the requester during a password change submitted via a form action. This allows unauthenticated attackers to set an arbitrary password for any user, including administrators, leading to full account takeover. This occurs when a site uses the password reset action in update mode. By default, the server-side current-password verification option for this action is disabled. **Recommendations** Update the BricksForge WordPress plugin to version 3.1.8.8 or later.

**Name of the Vulnerable Software and Affected Versions** ChamaWP versions prior to 1.0.13 **Description** Insufficient validation of password reset requests allows unauthenticated attackers to reset passwords for any user, including those with administrator privileges. This flaw can result in a complete takeover of the website. **Recommendations** Update to version 1.0.13 or later.

**Name of the Vulnerable Software and Affected Versions** Lenxel WP versions prior to 1.0.32 **Description** The password-reset action in the Lenxel WP WordPress theme fails to perform authorization or ownership checks, validating only a CSRF (Cross-Site Request Forgery) nonce. This allows unauthenticated attackers to reset the password of any user, including administrators, leading to full account takeover. **Recommendations** Update Lenxel WP to version 1.0.32 or later.

**Name of the Vulnerable Software and Affected Versions** Pronamic Pay versions prior to 10.1.1 **Description** The plugin is subject to privilege escalation. The `maybe update user role()` function passes an attacker-controlled Gravity Forms field value (`$lead[$feed->user role field id]`) directly into `WP User::set role()` without allowlist validation, capability comparison, or permission checks. This allows authenticated users with Subscriber-level access or higher to escalate their account privileges to Administrator by tampering with the role field value during a form submission. This issue occurs when an administrator has configured a Pronamic Pay payment feed in Gravity Forms with the Update User Role option enabled and mapped to a form field. **Recommendations** Update to a version newer than 10.1.0. As a temporary mitigation, disable the Update User Role option in the Pronamic Pay payment feed configuration within Gravity Forms.

**Name of the Vulnerable Software and Affected Versions** Chat On Desk Order Notifications versions prior to 1.0.9 **Description** An issue exists when SMS one-time-password password reset is enabled. The software fails to verify that the one-time password has been validated before processing a password-reset request. This allows unauthenticated attackers to reset the password of arbitrary users, including administrators, leading to full account takeover. **Recommendations** Update Chat On Desk Order Notifications to version 1.0.9 or later.

**Name of the Vulnerable Software and Affected Versions** MemberGlut WordPress plugin versions prior to 1.1.5 **Description** Insufficient validation of the role selected during front-end registration allows unauthenticated users to create an account with any arbitrary role, such as administrator, which can result in full site compromise. **Recommendations** Update MemberGlut WordPress plugin to version 1.1.5 or later.

**Name of the Vulnerable Software and Affected Versions** CAFEHAUS API versions prior to 1.0.1 **Description** The CAFEHAUS API WordPress plugin lacks authentication and authorization mechanisms when updating user passwords. This allows unauthenticated attackers to set the password for any user, including those with administrator privileges, leading to full account takeover. **Recommendations** Update the plugin to a version newer than 1.0.0.

**Name of the Vulnerable Software and Affected Versions** MDJM Event Management versions prior to 1.7.8.5 **Description** This issue allows unauthenticated attackers to grant arbitrary capabilities, such as `mdjm employee` and `mdjm employee edit`, to any registered WordPress role. This is possible because the `MDJM Permissions::init()` function is registered on the public WordPress `init` hook without authentication, making the role-manipulation endpoint accessible without login. The flaw stems from missing capability checks and nonce verification (a unique token used to prevent cross-site request forgery) in the `MDJM Permissions::set permissions()` and `MDJM Employee Manager::init()` functions. Additionally, there is a lack of server-side allow-list validation for the `employee roles[]` and `new role` POST parameters before they are processed by `mdjm set employee role()` and `WP User::set role()`. Consequently, an attacker can use a subscriber-level account to escalate privileges to Administrator. **Recommendations** Update to a version newer than 1.7.8.4.

**Name of the Vulnerable Software and Affected Versions** Happy Coders OTP Login for WooCommerce WordPress plugin versions prior to 2.8 **Description** An authentication bypass exists where the plugin fails to verify if a one-time password was actually validated before authenticating a user based on a supplied identifier. This allows unauthenticated attackers to log in as any existing user, including administrators, and to create new accounts, leading to privilege escalation. **Recommendations** Update the plugin to version 2.8 or later.