Niv Kochan

**Name of the Vulnerable Software and Affected Versions** WCFM – Frontend Manager for WooCommerce versions prior to 6.7.28 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Specifically, the `wcfm-my-account-enquiry-manage` branch lacks `is user logged in()` or `current user can()` checks, relying solely on a nonce that is embedded in public page loads. This allows unauthenticated attackers to inject arbitrary reply content into store inquiries, overwrite the main inquiry record in `wp wcfm enquiries`, and trigger unsolicited notification emails to customers and vendors. **Recommendations** Update WCFM – Frontend Manager for WooCommerce to version 6.7.28 or later.

**Name of the Vulnerable Software and Affected Versions** KiviCare – Clinic & Patient Management System (EHR) versions prior to 4.4.1 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can exploit this to mark pending appointments as Confirmed and forge completed payment records in the `wp kc payments appointment mappings` table using a supplied payment ID, effectively bypassing the payment process. This is possible on default installations because the gateway resolution logic returns all registered gateways regardless of their admin-enabled status, ensuring the manual (KCPayLater) gateway is always selectable via the `/payment-success` REST endpoint. **Recommendations** Update the plugin to a version newer than 4.4.0. Restrict access to the `/payment-success` REST endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) versions 4.0.26 through 4.1.15 **Description** An authorization bypass exists because the `payment complete()` function in `PaymentController.php` fails to properly verify if a user is authorized to perform an action. Unauthenticated attackers can mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash. This allows unauthorized users to obtain paid event access, QR-code attendee tickets, and order confirmation emails without payment. The required `wp rest` nonce is available on every public event page, removing the need for WordPress sessions or credentials. This issue is a regression, as the function and endpoint were previously patched but the fix was lost in later releases. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GamiPress – Gamification plugin for WordPress versions prior to 7.9.5 **Description** An Insecure Direct Object Reference (IDOR) exists due to missing validation on a user-controlled key. This allows unauthenticated attackers to view private activity log entries of any user, including points balance changes, badge earnings, and event records from integrated plugins like WooCommerce, LearnDash, and BuddyPress. The issue is exploitable via the `access` parameter. The authentication mechanism is bypassed because the `gamipress` nonce is broadcast to all front-end users through the `wp localize script` function on the `wp enqueue scripts` hook. **Recommendations** Update the plugin to version 7.9.5 or later. As a temporary mitigation, restrict access to the `access` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.0.12 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to send arbitrary HTML-injected emails to registered users using the site's own mail server, leveraging its SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) reputation to bypass spam filters. The issue occurs because the `emailSubject` parameter is passed to the `wp mail()` function with insufficient sanitization, and `emailBody` text items are concatenated into the HTML body without escaping. Additionally, chip items can be used to embed legitimate WordPress password-reset links for targeted accounts. **Recommendations** Update to version 6.0.12 or later.

**Name of the Vulnerable Software and Affected Versions** JetFormBuilder — Dynamic Blocks Form Builder versions prior to 3.6.4 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to retrieve every distinct value stored under any arbitrary `wp postmeta` key on the site. This includes WooCommerce billing personally identifiable information (PII) such as ` billing email`, ` billing phone`, and ` billing address` fields, order totals, attachment paths, and third-party plugin credentials or tokens stored in post meta. Exploitation is possible if the site has at least one published JetFormBuilder form with a field where the `generator function` is set to `get from db`. The attacker must provide a matching form ID, field name, and generator ID in the request, which can be discovered by browsing public forms. **Recommendations** Update to version 3.6.4 or later.

**Name of the Vulnerable Software and Affected Versions** The Visualizer – Tables & Charts Manager with Built-in AI Generator versions prior to 4.0.4 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to access and export the contents of any chart on the site, including those with draft, private, pending, future, or trash status, in CSV, Excel, or HTML formats. The issue occurs via the `/wp-json/visualizer/v1/action/{chart}/{type}/` REST endpoint. This is significant because the plugin-registered route bypasses the capability checks enforced by the standard WordPress REST endpoint for the non-public 'visualizer' custom post type. **Recommendations** Update to a version newer than 4.0.3. Restrict access to the `/wp-json/visualizer/v1/action/{chart}/{type}/` REST endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** K2 (affected versions not specified) **Description** The frontend article-attachment upload path allows the upload of files with the `.php` extension. When used with Apache's standard mod php, which matches the `.php$` pattern, these files are executed under the K2 web user. This allows a user with K2 Author privileges to upload a malicious file, such as `shell.php`, and access it via the endpoint `/media/k2/attachments/shell.php` to execute arbitrary PHP code within the context of the web server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A Joomla user with K2 "create item" rights (Author tier by default) can submit an article whose `embedVideo` POST field contains a raw `<script>` tag; K2 stores it verbatim and renders it unescaped to any visitor of the article page.

The K2 frontend `item.checkin` task accepts an unauthenticated `sigProFolder` query parameter and uses it directly to address a `JFolder::delete()` call under `/media/k2/galleries/`

K2 ≤ 2.26 renders the `# k2 users.image` column directly into HTML `src` attributes via two distinct templates, in both cases without HTML escaping.

K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg user k2`. A Registered Joomla user, by including the field `K2UserForm=1` in a standard `com users` `profile.save` POST, can write arbitrary values into the `notes`, `image`, and `plugins` columns of their own row in the `# k2 users` table — none of which are exposed by the K2 frontend profile-edit form.

The K2 frontend article-save handler accepts an `attachment[N][existing]` POST field that is concatenated with `JPATH SITE/` and passed to `JFile::copy()`. `JPath::clean` does NOT strip `..`, and there is no allow-list of source paths. An Author can therefore copy `configuration.php` (or any other file readable by the web user — including `../../../etc/passwd`) into `/media/k2/attachments/`, then retrieve the contents via the K2 attachment-download endpoint.

The K2 article gallery upload path accepts a zip/tar archive, extracts it under `/media/k2/galleries/<id>/`, and only renames image files (gif/jpg/jpeg/png/webp) to safe names — non-image files (including `.php`) are extracted as-is and remain executable via direct HTTP access.

**Name of the Vulnerable Software and Affected Versions** Fluent Forms versions prior to 6.2.2 **Description** Insufficient path validation in the `getAttachments()` function of `EmailNotificationActions` allows authenticated attackers with administrator access to read arbitrary files accessible by the web-server user, such as `wp-config.php` containing database credentials and authentication salts. The issue occurs because attacker-supplied file-upload URLs are resolved into filesystem paths without ensuring the path remains within the WordPress uploads directory. A prefix check using `strpos()` can be bypassed with traversal sequences, as `wp normalize path()` does not resolve `...` segments, which are subsequently resolved by `file exists()` at the kernel level. An attacker can exploit this by submitting a form where the admin notification is configured to attach a file-upload field and providing a crafted URL in the format `<upload baseurl>/../../<target>` as the file-field value. The targeted file is then attached to the outbound admin-notification email via `wp mail()`. **Recommendations** Update the plugin to a version later than 6.2.1.

**Name of the Vulnerable Software and Affected Versions** LatePoint versions prior to 5.5.1 **Description** The LatePoint plugin for WordPress contains a Stored Cross-Site Scripting issue. The problem occurs at the customer cabinet profile update endpoint because the `OsCustomerModel` does not override `params to sanitize()`, allowing raw POST parameters `first name`, `last name`, `phone`, and `notes` to be stored unsanitized in the database via `set data()`. Additionally, the `generate preview()` function fails to use `esc html()` when injecting these values into notification template HTML using `str replace()`. Authenticated attackers with customer-level access or higher can inject arbitrary web scripts that execute in the browser of an administrator or agent when a notification template referencing variables such as `customer full name`, `customer first name`, `customer last name`, `customer phone`, or `customer notes` is previewed. **Recommendations** Update the plugin to a version later than 5.5.0.