Pedro Pinho

The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.

The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own configured API keys.

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates the site owner intended to keep closed.

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel or fail them.

**Name of the Vulnerable Software and Affected Versions** ePayco Payment Gateway for WooCommerce WordPress plugin versions prior to 8.4.7 **Description** The plugin fails to properly verify the authenticity of payment confirmation requests. This allows unauthenticated attackers to mark orders as paid by bypassing the requirement for a valid gateway signature. **Recommendations** Update the ePayco Payment Gateway for WooCommerce WordPress plugin to version 8.4.7 or later.

**Name of the Vulnerable Software and Affected Versions** OAuth Single Sign On versions prior to 7.0.1 **Description** The plugin fails to verify the identity assertion returned during the Steam single sign-on flow. This allows unauthenticated attackers to log in as any non-administrator user or create new accounts. **Recommendations** Update to version 7.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** Project Manager WordPress plugin versions prior to 4.0.7 **Description** An Insecure Direct Object Reference (IDOR) exists where several REST API routes are not restricted to the projects a user belongs to. This allows any authenticated user, including those with subscriber privileges, to read task content and user email addresses from other projects, as well as modify task boards belonging to other projects. **Recommendations** Update Project Manager WordPress plugin to version 4.0.7 or later.

**Name of the Vulnerable Software and Affected Versions** Conekta Payment Gateway versions prior to 6.2.2 **Description** The plugin fails to verify the authenticity of incoming payment gateway webhook notifications. Additionally, it does not bind confirmed payments to the targeted order or verify the payment amount. This allows unauthenticated attackers to mark arbitrary orders as paid without actually completing the payment. **Recommendations** Update the plugin to version 6.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** ShopSmart Loyalty for WooCommerce versions prior to 1.0.1 **Description** The ShopSmart Loyalty for WooCommerce WordPress plugin fails to perform authorization or ownership checks on a phone-number lookup feature available to unauthenticated users. An attacker who possesses a customer's phone number can use the `shopsmart check phone` function to retrieve the customer's loyalty profile, which includes sensitive information such as name, email, and account balance. **Recommendations** Update ShopSmart Loyalty for WooCommerce to a version newer than 1.0.0. As a temporary mitigation, restrict access to the `shopsmart check phone` function to prevent unauthorized information disclosure.

**Name of the Vulnerable Software and Affected Versions** Epeken All Kurir for Woocommerce WordPress versions prior to 2.1.3 **Description** An issue exists where the plugin fails to verify if a payment-confirmation request is sent by the order owner or if a payment was actually processed. This allows unauthenticated attackers to mark arbitrary orders as confirmed and, depending on the configuration, as paid. **Recommendations** Update Epeken All Kurir for Woocommerce WordPress to version 2.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** Gammu versions 4.6.0 through 4.6.7 **Description** A crash in the DCT3 trace file parser allows for a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or origin check. Because these are pay-later methods, an attacker can mark their own unpaid order as settled and obtain fulfilment without paying.

**Name of the Vulnerable Software and Affected Versions** WP Directory Kit versions prior to 1.5.6 **Description** An issue exists where the software fails to sanitize and escape parameters before incorporating them into a SQL statement. This allows unauthenticated users to perform a SQL injection when a non-default search field type is configured. The affected parameters are `search location` and `search category`. **Recommendations** Update WP Directory Kit to version 1.5.6 or later.

**Name of the Vulnerable Software and Affected Versions** Autopay WordPress plugin versions prior to 5.0.1 **Description** An issue exists where the software fails to perform capability or nonce checks before saving a styling option from a public request. Additionally, the saved value is not escaped when output on the checkout page. This allows unauthenticated attackers to store JavaScript that executes in the browser of any user, including administrators, who loads the checkout page. A nonce is a unique token used to prevent replay attacks by ensuring that a request is intentional and comes from a trusted source. **Recommendations** Update Autopay WordPress plugin to version 5.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** Iptanus File Upload versions prior to 5.1.8 **Description** An issue exists where the software fails to properly sanitize and escape the `uniqueuploadid` parameter before incorporating it into a SQL statement. This allows unauthenticated users to perform an SQL injection, which is a technique used to manipulate a database by inserting malicious SQL code into a query. **Recommendations** Update Iptanus File Upload to version 5.1.8 or later. Avoid using the `uniqueuploadid` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Create WordPress plugin versions prior to 2.5.4 **Description** An authorization check is missing before returning content over a REST API route. As a side effect, this route publishes the requested content, which allows unauthenticated attackers to read unpublished content and make it publicly available. **Recommendations** Update the Create WordPress plugin to version 2.5.4 or later.

**Name of the Vulnerable Software and Affected Versions** Subscriptions for WooCommerce versions prior to 2.0.1 **Description** An issue exists in the WooCommerce order-received flow where the plugin fails to validate the payment amount or bind the PayPal order token to the order being completed. The system captures a client-supplied token and marks the order as paid whenever the capture status is COMPLETED, without verifying if the captured amount matches the order total. This allows an unauthenticated attacker, when guest checkout is enabled, to use an approved but uncaptured PayPal order token to mark an expensive order as paid without paying the actual price. **Recommendations** Update Subscriptions for WooCommerce to version 2.0.1 or later.

The RegistrationMagic WordPress plugin before 6.0.9.5 does not compare the verified PayPal capture's amount, currency, payee, or prior use against the registration it is finalising: its server-side check only confirms the capture status is COMPLETED. An unauthenticated attacker can therefore finalise an expensive paid registration with any genuinely-completed low-value capture, and replay a single capture across unlimited registrations because captures are not de-duplicated.

**Name of the Vulnerable Software and Affected Versions** GetPaid WordPress plugin versions prior to 2.8.55 **Description** The plugin fails to verify the authenticity of incoming Worldpay payment notifications. This allows unauthenticated attackers to forge notifications that mark pending invoices as paid without actual payment being processed. **Recommendations** Update the GetPaid WordPress plugin to version 2.8.55 or later.

**Name of the Vulnerable Software and Affected Versions** EONSR AEO Agent WordPress plugin versions prior to 3.8.0 **Description** The plugin fails to perform authorization checks on a REST API route and disables HTML sanitization before saving posts. This allows unauthenticated attackers to create published posts attributed to administrators that contain arbitrary web scripts. These scripts execute in the browser of any visitor, including administrators, resulting in Stored Cross-Site Scripting (Stored XSS), which is a vulnerability where malicious scripts are permanently stored on the target server. **Recommendations** Update the EONSR AEO Agent WordPress plugin to version 3.8.0 or later.