Pascal Sun

**Name of the Vulnerable Software and Affected Versions** CubeWP Framework versions prior to 1.1.31 **Description** Authenticated users with subscriber-level access and above can perform SQL Injection. The issue exists in the `cubewp remove relation()` AJAX function due to insufficient input sanitization of the `relation id` parameter. The function uses `wp unslash()`, which removes backslash escaping from POST data, and then interpolates the value directly into a raw SQL query without using `$wpdb->prepare()`. While `sanitize text field()` is applied, it does not provide protection against SQL injection, allowing attackers to append additional SQL queries to the existing one. **Recommendations** Update CubeWP Framework to a version newer than 1.1.30. As a temporary workaround, restrict access to the `cubewp remove relation()` function for users with subscriber-level permissions.

**Name of the Vulnerable Software and Affected Versions** Frontend Admin by DynamiApps versions prior to 3.28.29 **Description** The plugin is subject to generic SQL Injection, which occurs when an application fails to properly sanitize or escape user-supplied data before including it in a database query. Authenticated attackers with administrator-level access or higher can append additional SQL queries to extract sensitive information from the database. This is possible via the `order` parameter, provided that a valid `orderby` parameter is also supplied in the same request to reach the vulnerable code path. **Recommendations** Update the plugin to a version later than 3.28.28. As a temporary mitigation, restrict access to the `order` parameter in the affected functionality.

**Name of the Vulnerable Software and Affected Versions** WP Contact Form 7 DB Handler versions prior to 3.1 **Description** This issue involves Cross-Site Request Forgery (CSRF) that can lead to arbitrary file deletion through SQL Injection and PHP Object Injection. The flaw exists in the `process bulk action()` function due to missing nonce verification, as the check is only performed if the ` wpnonce` variable is present in the POST body. This allows an attacker to bypass the security check by omitting the field. Furthermore, the function uses an unsanitized, unparameterized user-supplied value in a numeric SQL context (`WHERE ID = $ID`) and performs unsafe deserialization of the `post content` field from the query result. An attacker can trick a logged-in administrator into triggering a UNION-based SQL injection payload that returns a malicious serialized PHP array. During deserialization, values associated with keys containing `ys cfdbh file` are used as file paths and passed to `wp delete file()` without path traversal validation, enabling the deletion of arbitrary server files such as `wp-config.php`. **Recommendations** Update WP Contact Form 7 DB Handler to a version later than 3.0. As a temporary mitigation, restrict administrative access to the plugin settings to trusted IP addresses to reduce the risk of CSRF attacks.

**Name of the Vulnerable Software and Affected Versions** User Registration & Membership versions prior to 5.1.5 **Description** The User Registration & Membership plugin for WordPress contains an open redirect issue. This occurs because user-supplied URLs provided through the 'redirect to on logout' GET parameter are not sufficiently validated before being processed by the `wp redirect()` function. Although `esc url raw()` is used to sanitize malformed URLs, it fails to restrict the destination to the local domain. This allows an attacker to create a link that redirects users to external malicious websites after they log out, which can be used to facilitate phishing attacks. **Recommendations** Update the plugin to a version later than 5.1.4. As a temporary workaround, restrict access to the 'redirect to on logout' parameter until the update is applied.