Paul Serban

A missing authorization issue exists in the Abilities API within the `main/abilitiesregister.php` file. This flaw allows attackers with contributor-level permissions to bypass intended restrictions because the API only requires the `edit posts` capability. Consequently, an attacker can create, read, update, or delete private posts and pages belonging to other users, as well as modify site-wide theme templates, including headers and footers.

An authorization flaw exists in the gallery conversion REST endpoint. The endpoint verifies if a user can edit the source post but fails to check if they have the necessary permissions to publish a gallery, while simultaneously using a hard-coded publish status. This allows authenticated users with low privileges, such as those with Contributor roles, to create and publish galleries. Additionally, attackers can provide arbitrary image IDs without ownership verification to publish unauthorized content using attachments they are not authorized to use. Over 100,000 installations are potentially affected.

A stored cross-site scripting issue allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements. This occurs because the `ditty layout render tag wrapper()` function inserts wrapper attribute values directly as HTML element names without allowlist validation. This process bypasses `wp kses post()` sanitization, as the sanitization occurs during the save process before the layout tag attributes are resolved during rendering. Consequently, the injected payload executes in the browser of any visitor viewing posts or pages that embed the affected Ditty item.

The Log Viewer component contains an OS command injection flaw. Authenticated attackers can execute arbitrary commands by submitting unsanitized input through the `filter` parameter, which is interpolated directly into a shell command within File.php. By using command substitution payloads in the `filter` parameter, attackers can execute commands as the webconfig user and subsequently escalate privileges to root due to default NOPASSWD sudo permissions granted to that user.