Nthng

**Name of the Vulnerable Software and Affected Versions** Object Sync for Salesforce versions prior to 2.2.14 **Description** An unauthenticated SQL Injection exists in the `/wp-json/object-sync-for-salesforce/push/` REST endpoint. The issue occurs because the `can process()` permission callback only verifies the HTTP method and fails to check for user capabilities or nonces. The `wordpress object type` parameter is concatenated directly into a SQL query within the `class-object-sync-sf-wordpress.php` file and executed via `$wpdb->get results()` without using `$wpdb->prepare()`. Since REST body parameters are not magic-quoted, an attacker can inject arbitrary SQL, including time-based blind queries, to extract sensitive data such as password hashes from the database. This exploitation requires only a valid `wordpress id` and does not require authentication or a Salesforce connection. **Recommendations** Update Object Sync for Salesforce to version 2.2.14 or later. As a temporary workaround, restrict access to the `/wp-json/object-sync-for-salesforce/push/` REST endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** VikAppointments Service Booking Calendar (affected versions not specified) **Description** An unauthenticated SQL injection exists because a parameter controlling the sorting of the public reviews list is used to construct a database query without proper validation or sanitization. This allows an attacker to inject arbitrary SQL through a booking page to read sensitive data from the database, such as WordPress user credentials. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, allowing unauthorized access to database information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** VikRentItems – Flexible Rental Management System versions prior to 1.2.2 **Description** Stored Cross-Site Scripting occurs via the customer email field of the booking checkout form. The issue stems from insufficient input sanitization and output escaping in the `saveorder()` function, which uses `VikRequest::getString()` and `sanitize text field()` but fails to neutralize HTML attribute-breaking characters like double quotes. Additionally, the `editorder` template echoes the stored `custmail` variable into an HTML input element's value attribute without using `esc attr()`. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses the affected page. **Recommendations** Update VikRentItems – Flexible Rental Management System to version 1.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** WHMCS Bridge versions prior to 7.0 **Description** The WHMCS Bridge plugin for WordPress contains a flaw allowing arbitrary file uploads. This occurs because the `connect()` function fails to validate file types. Authenticated attackers with Custom-level access or higher can exploit this to upload files to the server, potentially leading to remote code execution. **Recommendations** Update the plugin to a version later than 6.9. As a temporary mitigation, restrict access to the `connect()` function for users with Custom-level permissions.

**Name of the Vulnerable Software and Affected Versions** Bulk Order Update for WooCommerce versions prior to 1.7 **Description** An unauthenticated arbitrary file read exists due to the `bouw fetch csv data()` AJAX handler being registered on the `wp ajax nopriv ` hook without capability or nonce checks. The handler accepts the `csv url` POST parameter, which is filtered by `esc url raw()` and `validate file()`. Because `esc url raw()` allows absolute filesystem paths and `validate file()` only blocks directory traversal patterns, the input is passed directly to `fopen()` and `fgetcsv()`. This allows an attacker to read the first line of arbitrary files on the server or use the handler as a file-existence oracle, which is a method used to verify if a specific file exists on a system. **Recommendations** Update to a version later than 1.6. As a temporary workaround, restrict access to the `bouw fetch csv data()` function until a patch is applied.