Osman Hussein

An issue exists allowing PHP Object Injection, a technique where untrusted input is passed to the `unserialize()` function, potentially leading to remote code execution. The flaw occurs via the `form` parameter, specifically within the `ticket label` field of the url-encoded form string. This is caused by a lack of server-side authentication and the absence of a class allowlist during deserialization. The only protection is a nonce, which is publicly exposed on any page using the `[wsdesk support]` shortcode. An unauthenticated attacker can obtain the `wsdesk nonce` value through a GET request to a public page and then execute code on the server via a POST request.

An arbitrary file upload issue exists in the `download one file()` function. The flaw stems from a lack of MIME type validation and a missing file extension whitelist when writing files based on attacker-controlled manifest entries to the plugin directory. Unauthenticated attackers can upload executable files, potentially leading to remote code execution if the `apiType` setting is configured as `custom-local` (self-hosted model mode). This specific configuration is a non-default option requiring a paid license that exposes the REST nonce and one-time session tokens on front-end pages.

Unauthenticated attackers can achieve remote code execution on the server. The issue occurs because the `id` parameter is concatenated directly into a pipe-delimited validation rule string without sanitization. This string is subsequently split, and each resulting token is invoked as a dynamic PHP function without an allowlist check. This flaw is exploitable because WordPress core executes the `validate callback` within `WP REST Server::dispatch()` before the `permission callback` is triggered, bypassing the Project Manage Capability authorization gate.

PHP Object Injection occurs due to insufficient sanitization of the `customer note` parameter. The input is inlined into invoice HTML, entity-decoded by simplehtmldom, reassembled into raw bytes by mPDF, and passed to the `unserialize()` function in ` getObjAttr()` without validation. This allows unauthenticated attackers to execute arbitrary code on the server. The issue can be triggered via the public Store API endpoint '/wc/store/v1/checkout' by placing an anonymous WooCommerce checkout using a cheque or Direct Bank Transfer payment method, which triggers the invoice-generation hook.

An open redirect issue exists due to insufficient validation of a user-supplied URL used in a redirect. This allows unauthenticated attackers to redirect users to arbitrary external websites if they can trick them into performing a specific action.

An issue exists where the plugin fails to verify if a requested link belongs to the settings set used for its display template. This allows unauthenticated users to disclose sensitive information, such as telephone numbers, e-mail addresses, and submitter names, which the settings set is configured to hide.

The plugin allows unauthenticated attackers to perform arbitrary file uploads through the `mbw file upload()` function. The issue stems from a lack of file extension validation on the `image path` parameter, which allows the basename-derived filename to bypass the extension allowlist that is only applied to the `file name` parameter. This can lead to remote code execution if executable files are uploaded. This flaw is exploitable when the board is configured to allow guest posts, which is the default setting, as the necessary nonce is visible on all public board pages.

Insufficient file type validation occurs when saving IMAP email attachments through the `initMailPart()` function. This allows unauthenticated attackers to upload executable files, potentially leading to remote code execution.

An arbitrary file upload issue exists in the `compressCustom()` function. The flaw stems from missing file type validation and extension filtering on the `page id` parameter. This is combined with a leaked REST nonce (`tenwebio rest`) that is automatically serialized to a world-readable file in the `wp-content/uploads/` directory whenever a bulk optimization batch pauses. Since this nonce is generated with a user ID of 0, it allows unauthenticated attackers to bypass authentication checks and upload executable files, leading to remote code execution.

Authenticated users with subscriber-level access and above can perform a limited arbitrary file upload due to incomplete file type validation in the `check mimetype()` function. This flaw allows attackers to bypass extension checks and write remote file content without a MIME check or the WordPress upload helper, potentially leading to remote code execution if executable files are uploaded. This issue is exploitable only when the 'profile videos on bio' option is enabled, as this setting exposes the required nonce on the profile page to lower-level authenticated users.

An unauthenticated arbitrary file upload issue exists that can lead to remote code execution. The `nbdesigner copy image from url` AJAX action is accessible to logged-out users. Within the Google Drive processing branch, the plugin reconstructs the destination filename using the raw `gapi[name]` parameter, which bypasses the image extension allow-list. This allows an attacker to upload a .php file to the `wp-content/uploads/nbdesigner/temp/` directory. By providing a malicious Google Drive file and a valid OAuth token, an attacker can execute arbitrary code on the server. The `nbd check use logged in` endpoint provides the necessary `save-design` nonce to anonymous users, removing any authentication barrier.

An arbitrary file upload flaw exists in the `extcf7 submit` function. The issue stems from missing file extension, MIME type, and size validation within the `validation filter()` of the signature field. Additionally, a bypass of the `sanitize file name()` function allows the conversion of filenames like `shell.php-` into `shell.php`. Combined with a lack of PHP-execution guards in the upload directory, unauthenticated attackers can upload executable files, potentially leading to remote code execution (RCE), which is the ability to execute arbitrary commands on the server.

Remote Code Execution is possible due to missing authentication and nonce checks on the `wp loaded` handler. The issue occurs because the `xpv image` POST parameter is not sanitized before being echoed unescaped into a Dompdf-rendered HTML template with PHP execution enabled. This allows unauthenticated attackers to execute arbitrary code on the server via a single POST request to any URL on the site.

An unauthenticated SQL injection exists in the video search functionality and the router that maps friendly video URLs to database rows. This flaw allows attackers to inject SQL commands into read queries without requiring authentication. Anyone capable of loading a page containing a gallery can exploit this issue.

An issue exists where the software does not require a validated transaction before deleting site options. This allows unauthenticated visitors to delete arbitrary options by providing the option names via request input, which can result in administrators being locked out of the dashboard or the plugin being deactivated on the site.

An issue exists where the plugin fails to validate a submitted per-ticket authorization code before disclosing the actual code to the requester. This allows unauthenticated users to read the contents of any support ticket and extract sensitive user or configuration data.