Nox Axter

The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the 'q' parameter of the wpForo integration AJAX selector (action gamipress wpforo get posts) in versions up to, and including, 7.9.7. The value is passed only through $wpdb->esc like() and interpolated directly into a single-quoted LIKE clause with no %s placeholder. Because esc like() runs after WordPress core magic quotes, it doubles the injected backslash (' -> '), which MySQL reads as one literal backslash followed by a live closing quote, allowing the attacker to break out of the string and inject boolean-based SQL. The wpForo plugin only needs to be active to register the callback; no wpForo vulnerability is used. Requires a Subscriber account, which can read the gamipress admin nonce (exposed on every admin page, e.g. /wp-admin/profile.php). Note: the researcher's Simple:Press vectors (PoC 2 & 3) do not reproduce in current code, which uses $wpdb->prepare() with %s placeholders; only the wpForo selector is confirmed.

**Name of the Vulnerable Software and Affected Versions** User Access Manager versions prior to 2.3.13 **Description** Authenticated attackers with subscriber-level access and above can perform a Second-Order SQL Injection. This occurs via the 'id' parameter of the `wp ajax save-attachment-compat` AJAX action. The issue stems from insufficient validation of the `objectId` value within the `saveAjaxAttachmentData()` function. This value is later retrieved from the database and used as an array key in the `addQueryExcludedPostFilter()` function, where it is directly imploded into a SQL NOT IN() clause without integer casting or prepared statements. This allows attackers to append additional SQL queries to extract sensitive information from the database. **Recommendations** Update to a version newer than 2.3.12. As a temporary mitigation, restrict access to the `wp ajax save-attachment-compat` AJAX action for users with subscriber-level permissions.

**Name of the Vulnerable Software and Affected Versions** Cost Calculator Builder PRO versions prior to 4.0.4 **Description** Unauthenticated attackers can achieve remote code execution on the server via the `js to php()` function. The issue stems from insufficient sanitization of the `orderDetails[*].originalValue` field, which is injected into a calculator formula string and processed by the PHP `eval()` function. While the `evaluateFormula()` function uses a regex allow-list to filter alphanumeric tokens, it fails to filter non-word punctuation characters, allowing the use of non-word XOR gadgets to bypass security checks. Although a nonce check is present, the required nonce is publicly exposed on every front-end page through the `wp head` hook, rendering the authentication barrier ineffective. **Recommendations** Update Cost Calculator Builder PRO to version 4.0.4 or later. As a temporary mitigation, restrict access to the `js to php()` function or the `orderDetails[*].originalValue` field until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Admin and Site Enhancements (ASE) Pro versions prior to 8.9.1 **Description** Unauthenticated attackers can achieve Remote Code Execution on the server through the `recursive html()` function. The issue occurs because the frontend save handler only requires a publicly emitted nonce and lacks authentication checks. Additionally, CAPTCHA validation can be bypassed by omitting an attacker-supplied key. Repeater row keys from the `cfgroup[input]` parameter are stored without sanitization and subsequently passed into an `eval()` call. This exploitation requires the `[post cf form]` shortcode to be active on a publicly accessible page, as it exposes the necessary nonce and session ID to visitors. **Recommendations** Update to a version newer than 8.9.0. As a temporary mitigation, remove the `[post cf form]` shortcode from all publicly accessible pages to prevent unauthenticated access to the save handler.