Mustafa Ahmed

An incorrect authorization issue allows forceful browsing within the Webform module. The module fails to sufficiently restrict access to specific submission view modes. Consequently, a user with permission to view a submission may access a more permissive view mode to see fields that should be restricted. This requires the attacker to already possess access to view the affected submission.

An access issue exists where an application may be able to read files outside of its sandbox. Sandboxing is a security mechanism that isolates applications from the rest of the system to prevent unauthorized access to data.

The settings page of the plugin lacks Cross-Site Request Forgery (CSRF) checks, which is a type of attack that forces an authenticated user to execute unwanted actions. This allows an attacker to trick a logged-in administrator into modifying the configured third-party API key. Consequently, all subsequent member registration data, including name, email, and membership level, is transmitted to an account controlled by the attacker.

The plugin fails to enforce per-object ownership checks on its course content type. This allows users with the instructor role to access and read the content of private courses created by other instructors through an Insecure Direct Object Reference (IDOR), which occurs when an application provides direct access to objects based on user-supplied input without sufficient authorization checks.

The plugin fails to verify if a marketplace vendor owns a review before permitting it to be unapproved or deleted. This allows any vendor to modify or permanently delete reviews associated with stores belonging to other vendors.

An issue exists where the plugin fails to verify if an authenticated employee (provider) is associated with the customer record being accessed. This allows any user with an Employee Panel login to read and modify the personal data of any customer by enumerating sequential identifiers.

An authorization bypass exists in the endpoint that returns saved form drafts. This allows unauthenticated users to access and read personal data stored within these drafts, including names, emails, phone numbers, and addresses.

Stored Cross-Site Scripting (XSS) occurs because the plugin fails to sanitize and escape a settings value before it is rendered on the site front end. This allows administrators, including those lacking the `unfiltered html` capability in multisite environments, to execute malicious scripts in the context of any visitor viewing the affected pages.

An issue exists where the plugin fails to validate the requested quantity during registration for paid events. Because the price is computed based on a quantity controlled by the user, any authenticated user can create a completed booking for a paid event without performing a payment.

An Insecure Direct Object Reference (IDOR) exists where the software fails to perform a per-ticket access check before reassigning a ticket's customer. This allows a restricted support agent to change the assigned customer of any ticket in the system, including those outside their granted scope.

Insufficient authorization verification in a request handler allows users with the Contributor role or higher to access the content of arbitrary posts. This includes the ability to read private, pending, and draft posts belonging to other users via the `get post info` function.

An issue exists where a customer-listing handler fails to perform a per-request capability or nonce check. A nonce is a unique token used to prevent replay attacks by ensuring that a request is intentional and authentic. This allows authenticated users with contributor-level access to read the personal information of all stored customers.

Insufficient input sanitization and output escaping allow authenticated users with a course-editing role or higher to perform Stored Cross-Site Scripting (XSS). The issue occurs because the plugin fails to strip event-handler attributes from a course pricing field before storing and rendering it. This enables an attacker to inject arbitrary JavaScript that executes in the session of an administrator who views the affected course page.

Insufficient authorization enforcement on private messaging endpoints allows any authenticated user with Subscriber level permissions or higher to read, modify, or delete private messages belonging to other users.

This issue is a second-order SQL injection where the plugin fails to validate field identifiers configured by an administrator before incorporating them into a SQL query. The injection is triggered when a visitor performs a search operation. The vulnerable variable is `qc bot str fields`.

An unauthenticated AJAX handler fails to escape a value reconstructed from request input before reflecting it into the HTML response. This allows unauthenticated attackers to execute arbitrary JavaScript in the browser of users who trigger a crafted request, leading to a Reflected Cross-Site Scripting (XSS) attack. Cross-Site Scripting is a technique where malicious scripts are injected into trusted websites.

An issue exists where a capability check is missing on a settings-update action. This allows authenticated users with subscriber-level access and above to modify the plugin settings.

An Insecure Direct Object Reference (IDOR) exists in several lesson AJAX handlers. The plugin fails to verify the ownership of a user-supplied user identifier, which allows authenticated users with subscriber-level access to read and modify lesson notes belonging to other users and mark their lesson content as completed.

An issue exists in a retrieval-augmented-generation (RAG) settings handler where the software fails to perform a capability or nonce check. This allows authenticated users with subscriber-level access to modify the plugin configuration. A nonce is a unique token used to protect against cross-site request forgery (CSRF) attacks.

An issue exists where the plugin fails to perform capability checks or CSRF/nonce verification on an AJAX action. This allows authenticated users with Subscriber-level access and above to modify the parent and menu order of arbitrary posts. CSRF (Cross-Site Request Forgery) is a type of attack that tricks a victim into submitting a malicious request. A nonce is a unique token used to prevent such requests from being replayed.