Nabil Irawan

**Name of the Vulnerable Software and Affected Versions** TrueBooker versions prior to 1.2.7 **Description** The plugin is susceptible to account takeover because the `add front user update()` AJAX handler is accessible to unauthenticated users. The handler accepts an arbitrary `truebooker wp user id` value and passes it to the `wp update user()` function without verifying the user's authentication or ownership of the account. This allows an unauthenticated attacker to change the email address of any WordPress user, including administrators, by providing the target user ID and a controlled email address. Subsequently, the attacker can utilize the standard WordPress password reset process to gain full control of the account. **Recommendations** Update the plugin to a version later than 1.2.6. As a temporary mitigation, restrict access to the `add front user update()` AJAX handler.

**Name of the Vulnerable Software and Affected Versions** Astro Booking Engine versions prior to 1.4.1 **Description** The Astro Booking Engine plugin for WordPress contains a Cross-Site Request Forgery (CSRF) flaw. This occurs because the options deletion functionality lacks nonce validation—a security mechanism used to ensure that a request was intentionally sent by the user. Consequently, an unauthenticated attacker can delete all plugin settings by tricking a site administrator into clicking a malicious link. **Recommendations** Update the plugin to a version later than 1.4.0.

**Name of the Vulnerable Software and Affected Versions** Database Collation Fix versions prior to 1.2.11 **Description** The Database Collation Fix plugin for WordPress contains a time-based SQL Injection flaw. This occurs because the plugin fails to properly escape the `force-collation-algorithm` parameter and lacks sufficient preparation of the SQL query. Unauthenticated attackers can exploit this to append malicious SQL queries and extract sensitive information from the database. Successful exploitation requires a `trigger.txt` file to be present in the plugin directory (`/wp-content/plugins/database-collation-fix/trigger.txt`), which typically happens during DesktopServer integration events like site creation, copy, import, move, export, or deploy. **Recommendations** Update the plugin to a version newer than 1.2.10. Avoid using the `force-collation-algorithm` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Theme Editor plugin for WordPress versions prior to 3.2 **Description** The plugin is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into executing unwanted actions on a web application. This occurs due to missing nonce validation—a security measure used to ensure that a request was intentionally sent by the user—on the `ms update` AJAX action. Unauthenticated attackers can exploit this to modify child theme CSS styles by tricking an administrator into clicking a malicious link. **Recommendations** Update the Theme Editor plugin for WordPress to version 3.2 or later. As a temporary mitigation, restrict access to the `ms update` AJAX action.

**Name of the Vulnerable Software and Affected Versions** WP Fast Total Search – The Power of Indexed Search versions prior to 1.80.281 **Description** An unauthenticated SQL Injection exists due to insufficient escaping of user-supplied input and lack of proper preparation of the SQL query. This allows attackers to append additional SQL queries to existing ones to extract sensitive information from the database via the `form data[s]` parameter. **Recommendations** Update WP Fast Total Search – The Power of Indexed Search to a version newer than 1.80.280. Avoid using the `form data[s]` parameter until the plugin is updated.

**Name of the Vulnerable Software and Affected Versions** Hide My WP Lite versions prior to 1.4 **Description** An arbitrary file read issue exists when the `elementor assets filter()` function processes the `he wrapper js` and `he wrapper css` query parameters. The function concatenates user-supplied input directly onto ABSPATH and passes it to `file get contents()` without path traversal validation, allow-list, realpath containment, or extension checks. Although the output is processed by `wp kses post()`, which filters HTML tags, it does not prevent the disclosure of arbitrary file contents. This allows unauthenticated attackers to read sensitive files on the server, such as wp-config. This issue requires the Elementor plugin to be installed and the 'Hide Elementor' feature to be enabled. **Recommendations** Update Hide My WP Lite to a version later than 1.3. As a temporary workaround, disable the 'Hide Elementor' feature to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WP Business Intelligence Lite versions prior to 3.2.1 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with Subscriber-level access or higher can modify stored SQL queries. This can lead to privilege escalation through arbitrary SQL execution when an administrator views the modified query. **Recommendations** Update WP Business Intelligence Lite to a version newer than 3.2.0.

**Name of the Vulnerable Software and Affected Versions** Block, Suspend, Report for BuddyPress versions prior to 3.6.5 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via the `link` parameter, enabling the injection of arbitrary web scripts into pages that execute when accessed by other users. **Recommendations** Update to a version newer than 3.6.4. Avoid using the `link` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Widget Logic Visual versions prior to 1.53 **Description** Authenticated attackers with subscriber-level access and above can achieve remote code execution on the server. The issue occurs during the `widget-logic-update-conditional-tags` AJAX action due to a missing capability check and nonce verification in the `widget logic visual check visibility()` function. Additionally, the `nwlv[cod-tag]` parameter is insufficiently sanitized before being stored and later processed by an `eval()` call, which executes the provided code. **Recommendations** Update the plugin to a version newer than 1.52. As a temporary mitigation, restrict access to the `widget-logic-update-conditional-tags` AJAX action or limit user permissions to prevent subscribers from accessing widget settings.

**Name of the Vulnerable Software and Affected Versions** Jssor Slider by jssor.com versions prior to 3.1.25 **Description** The plugin is subject to Directory Traversal, a flaw that allows an attacker to access files and directories that are stored outside the web root folder. Unauthenticated attackers can exploit this by using the `url` parameter to read arbitrary files on the server, potentially exposing sensitive information. **Recommendations** Update the plugin to a version newer than 3.1.24. Avoid using the `url` parameter in the affected plugin until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Backstage - Customizer Demo Access versions prior to 1.4.3 **Description** This issue allows unauthenticated attackers to achieve privilege escalation. The plugin assigns the `manage options` capability to the `backstage customizer user` demo role, which provides permissions exceeding what is required for Customizer-only demo access. Consequently, attackers can navigate beyond the Customizer and modify arbitrary WordPress options, such as the `default role` variable. **Recommendations** Update Backstage - Customizer Demo Access to a version newer than 1.4.2.

**Name of the Vulnerable Software and Affected Versions** WP-BusinessDirectory versions prior to 4.0.2 **Description** Unauthenticated attackers can delete arbitrary files on the server due to insufficient path validation in the `remove()` method of the `JBusinessDirectoryControllerUpload` class. The 'task=upload.remove' endpoint is accessible without authentication. By providing a ` filename` parameter containing path traversal sequences (../) and setting the ` path type` parameter to `2`, an attacker can bypass directory restrictions and trigger the `unlink()` function on critical files, such as `wp-config.php` or `wp-config-backup.php`. **Recommendations** Update WP-BusinessDirectory to version 4.0.2 or later. Restrict access to the 'task=upload.remove' endpoint to prevent unauthenticated requests. Avoid using the ` filename` parameter in the 'task=upload.remove' endpoint until the software is updated.

**Name of the Vulnerable Software and Affected Versions** Paytium versions prior to 5.0.3 **Description** An issue allows unauthenticated users to perform privilege escalation. **Recommendations** Update to a version newer than 5.0.2.

**Name of the Vulnerable Software and Affected Versions** Flash & HTML5 Video versions prior to 2.11.1 **Description** An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. **Recommendations** Update to a version newer than 2.11.0.

**Name of the Vulnerable Software and Affected Versions** SiteGround Email Marketing versions prior to 1.7.6 **Description** The SiteGround Email Marketing plugin for WordPress contains a broken access control issue. A missing capability check in a function allows unauthenticated attackers to perform unauthorized actions. **Recommendations** Update SiteGround Email Marketing to version 1.7.6 or later.

**Name of the Vulnerable Software and Affected Versions** Welcome Software Publishing versions prior to 0.0.32 **Description** The plugin is subject to an Arbitrary Options Update issue caused by a missing capability check in the `nc setOption()` function, which is exposed through the 'nc.setOption' XML-RPC method. While the function verifies credentials via `$wp xmlrpc server->login()`, it fails to perform authorization checks, such as `current user can('manage options')`. This allows authenticated attackers with Subscriber-level access or higher to update arbitrary WordPress options via XML-RPC requests. An attacker can exploit this to change the `default role` option to 'administrator' and register a new administrator account, leading to full privilege escalation and site takeover. **Recommendations** Update to a version later than 0.0.31. As a temporary workaround, restrict access to the 'nc.setOption' XML-RPC method or disable XML-RPC functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Premmerce Dev Tools versions prior to 2.1 **Description** The Premmerce Dev Tools plugin for WordPress allows authenticated attackers with Subscriber-level access and above to achieve remote code execution. The issue occurs because the `generatePluginHandler()` function does not perform authorization checks before processing user-supplied POST data. Additionally, the `createFromStub()` function performs unsanitized string substitution of the `premmerce plugin namespace` parameter into PHP stub files saved in the wp-content/plugins/ directory. An attacker can inject a semicolon and arbitrary PHP code into the `premmerce plugin namespace` parameter, resulting in the creation and execution of a malicious PHP file when accessed via HTTP. **Recommendations** Update the plugin to a version later than 2.0. As a temporary workaround, restrict access to the `generatePluginHandler()` function to prevent unauthorized users from processing POST data.

**Name of the Vulnerable Software and Affected Versions** FPW Category Thumbnails versions prior to 1.9.6 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Subscriber-level access and above can inject arbitrary web scripts via the `id` parameter of the 'fpw fs get file' AJAX action. These scripts execute when an administrator accesses the plugin settings page. **Recommendations** Update to a version newer than 1.9.5. Restrict access to the 'fpw fs get file' AJAX action to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** BirdSeed versions prior to 2.2.1 **Description** The BirdSeed plugin for WordPress is subject to Cross-Site Request Forgery. This occurs because the `birdseed plugin settings page()` function fails to perform nonce validation—a security mechanism used to ensure that a request was intentionally sent by the user. The function processes the `birdseed token` GET parameter and saves it to the database using `update option()` without verification. Consequently, unauthenticated attackers can modify the plugin's BirdSeed token setting by tricking a site administrator into clicking a malicious link. **Recommendations** Update to a version later than 2.2.0. As a temporary workaround, restrict administrative access to the plugin settings page to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** bPlugins Tiktok Feed versions prior to 1.0.25 **Description** A missing authorization issue exists due to incorrectly configured access control security levels, which allows for broken access control. **Recommendations** Update to a version later than 1.0.24.