Naoki Kawahigashi

The LetsRecover WordPress plugin through 1.2.0 does not sanitize a user-supplied value that is used as a database column name in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to append SQL to the query and read arbitrary data from the database, which is then returned through a second unauthenticated action.

The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenticity of the request, on one of its payment callbacks, allowing unauthenticated users to mark arbitrary WooCommerce orders as completed.

The Simpler Checkout WordPress plugin before 1.5.4 does not properly restrict who can create orders and checks its automatic login link with a key that stays empty until the store owner configures the Simpler Checkout WordPress plugin before 1.5.4, allowing subscribers on stores that have not completed setup to log in as an administrator.

The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending submission's after-payment response, allowing unauthenticated visitors to obtain the post-payment redirect URL and thank-you message of a payment-gated form without paying.

The Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 does not sanitise and escape abandoned-cart data submitted by visitors before outputting it in the admin dashboard, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.

An authentication bypass exists in the Printaura-Woocommerce WordPress plugin due to improper access restrictions on the WooCommerce REST API. This flaw allows unauthenticated attackers to send requests to any WooCommerce REST route to read and modify sensitive store data, including customer orders, personal information, payment settings, and webhooks.

Insufficient validation of the file path before deletion and a lack of access restrictions on administration screens allow users with the Subscriber role or higher to delete arbitrary files on the server. This issue occurs via the button download path and can lead to a full site compromise.

The plugin fails to perform capability or nonce checks before saving settings. This allows unauthenticated users to send POST requests that write unmodified, attacker-controlled content into a standalone PHP file served by the server, resulting in arbitrary PHP code execution.

The Limit Login Attempts Security WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before completing a login and treats a failure to build that step as success, so an attacker who holds a protected user's password can bypass the second factor by sending a request header that breaks the step.

The plugin fails to prevent the disclosure of stored administrator credentials to unauthenticated users and does not correctly verify authentication. This allows unauthenticated attackers to obtain administrator credentials and gain full administrative access to the site.

The Userplace WordPress plugin fails to perform authorization checks on an AJAX action accessible to unauthenticated users. Additionally, the nonce (a unique token used to prevent cross-site request forgery) that protects this action is publicly exposed. This allows unauthenticated attackers to create an administrator account or write arbitrary site options, which can lead to a full site takeover.

An issue exists where a request header is not validated or escaped before being written into a regenerated PHP file on an unprotected admin hook. This allows unauthenticated attackers to execute arbitrary code if the custom database error page is enabled and the attacker wins a race condition against an administrator saving settings.

The iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check capabilities or nonces in several AJAX actions that update a site option chosen by the request, allowing any authenticated user, such as a subscriber, to change arbitrary WordPress options and escalate to administrator, for example by enabling registration with administrator as the default role.

The plugin fails to sanitize or parameterize request values before incorporating them into SQL queries across several unauthenticated REST routes. This allows unauthenticated attackers to execute SQL injection, which can be used to obtain an administrator session.

The All-in-One Video Gallery WordPress plugin before 5.1.0 does not check the type, status or ownership of the target post before writing its view count and duration meta, allowing unauthenticated visitors to create or change that meta on any post, including private and draft posts, and to inflate the view count without limit.

The Quick Event Manager WordPress plugin before 9.19 does not verify the authenticity of PayPal payment notifications before marking event registrations as paid, which could allow unauthenticated attackers to mark registrations as paid without making a payment.

The plugin fails to sanitize a value from its payment callback before incorporating it into a SQL statement. Additionally, the system accepts an empty API key, which is the default setting, as valid authentication. This allows unauthenticated remote attackers to perform an information disclosure by reading arbitrary data from the database.

An issue exists where a public endpoint does not require a valid, non-empty secret to return its stored API token. An unauthenticated attacker can use this token at a second public endpoint to retrieve the order-received URL of any WooCommerce order, allowing them to read the customer's name, address, phone number, and email address. These endpoints are accessible by default and only close after a WATI account is connected.

An authentication flaw exists where the plugin fails to verify the authenticity of payment notifications received by its gateway callback. This occurs because the integrity check is skipped when the webhook secret remains at its empty default value, meaning no signature validation is enforced. Consequently, unauthenticated attackers can mark arbitrary WooCommerce orders as paid or failed without performing an actual payment transaction.

This issue occurs because the plugin fails to verify the authenticity of payment notifications when the merchant secret is unset, which is the default configuration. This lack of server-side payment verification allows unauthenticated attackers to forge payment confirmations and mark orders as paid without completing the actual transaction.