Pedro Pinho

The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping media attachments, allowing any authenticated user with the upload capability (the Author role by default) to read the metadata of, and overwrite the generated thumbnail files and stored metadata of, media attachments belonging to other users.

The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify the authenticity of incoming bank-transfer payment notifications on a default installation, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid.

An issue exists where the plugin fails to restrict who can trigger booking verification-code emails and does not bind the recipient to server-side state. This is caused by a missing capability check on a function, allowing unauthenticated users to force the site to send templated verification-code emails to arbitrary recipients.

The plugin fails to properly authenticate incoming bank-transfer payment notifications because the verification token is empty by default. This allows unauthenticated attackers to forge notifications and update the status of any pending WooCommerce order to paid, regardless of the payment method used. The issue stems from a missing capability check in a function used to process these updates.

A memory integrity issue exists due to improper handling of copy-on-write pages, which is a mechanism where a resource is shared between multiple callers until one attempts to modify it, at which point a private copy is created. This flaw allows an application to cause unexpected changes to copy-on-write memory.

An issue exists where the plugin fails to verify that payment notifications originate from the legitimate payment provider before marking an order as paid. This allows unauthenticated attackers to mark arbitrary orders as paid without completing any actual payment.

The plugin fails to verify if a payment was successfully completed before marking an order as paid. This allows unauthenticated users to mark any unpaid order as paid and modify the order total.

An unauthenticated AJAX action fails to properly sanitize and escape user input before reflecting it within an HTML attribute. This leads to a Reflected Cross-Site Scripting (XSS) issue, where a malicious script is reflected back to the user, potentially affecting any visitor, including logged-in administrators. The issue specifically involves the `data-shortcode` attribute.

Insufficient access restrictions for guest-submitted quotes allow unauthenticated users to retrieve sensitive information belonging to other guests. By providing an enumerable identifier, an attacker can access the buyer's name, email address, and requested line items.

The plugin fails to validate a user-supplied sort value against an allowlist before incorporating it into a database query. Because the affected administrative list screen requires only lower-privilege capabilities instead of administrator rights, users with editor-level access or higher can execute SQL injection to read arbitrary information from the database. In multisite environments, a sub-site editor can access the network-global users table, which may include the password hash of the super administrator.

An issue exists where one-time-password verification attempts are not adequately limited. The attempt limit is tracked against a value supplied by the client that can be changed freely. This allows an unauthenticated attacker to bypass the limit and brute-force the short numeric login code to take over an account without knowing the password.

The plugin fails to restrict access to the secret used to authenticate its payment gateway webhook, allowing unauthenticated users to obtain it. This disclosure makes the webhook signature check ineffective, enabling unauthenticated attackers to forge payment-confirmation notifications. Consequently, attackers can record arbitrary donations as completed, specifying their own amounts, donor names, and messages.

An issue exists where the plugin fails to verify order ownership before returning billing details. This allows unauthenticated attackers to obtain a customer's name, email address, phone number, postal address, and order history by providing the customer's email address.

An issue exists where the plugin fails to verify that incoming payment notifications are authentic when no webhook secret is configured. This lack of server-side payment verification allows unauthenticated attackers to forge notifications and mark orders as paid without completing the actual payment.

The plugin fails to verify if a payment-confirmation request is legitimately associated with the order and customer it intends to confirm. This allows unauthenticated attackers to mark any arbitrary order as paid without completing an actual transaction.

The plugin creates a privileged POS account upon activation that uses a hard-coded, publicly known PIN. The system does not require this PIN to be changed before use and authenticates the public POS login endpoint based solely on this PIN without performing identity or capability checks. This allows unauthenticated attackers to obtain a privileged POS session to read personal data of customers and site users, as well as modify store data.

An issue exists where the plugin fails to perform authorization or post-visibility checks on a REST API route. This allows unauthenticated users to disclose the custom field key names of arbitrary posts, including those that are private, draft, pending, scheduled, or password-protected.

The plugin fails to verify the authenticity of payment notifications with the payment provider before marking an order as paid. This allows unauthenticated users to mark pending orders as paid without actually completing the payment process.

The UpsellWP WordPress plugin fails to verify if products added to the cart via a Frequently Bought Together campaign are actually part of that specific campaign. This allows unauthenticated users to manipulate the pricing and purchase arbitrary products at the discounted rate associated with the campaign.

An authorization bypass exists that allows unauthenticated attackers to access non-published car listings, including those in draft, pending, and private status. By providing a target's numeric `user id`, an attacker can retrieve sensitive information such as titles, prices, media URLs, and seller notes.