Phat Rio

The Image Buzz plugin for WordPress contains missing authorization checks, allowing unauthenticated attackers to modify API keys configured by site administrators. This is achieved by manipulating the `pixabay api`, `unsplash api`, or `pixels api` parameters.

The PixelPlay plugin for WordPress contains a flaw where authorization checks are missing, allowing unauthenticated attackers to delete API keys configured by site administrators. This is achieved by manipulating the `clear api type` parameter, which can be used to remove keys for services including Pixabay, Unsplash, Pixels, and OpenAI.

Missing authorization checks allow unauthenticated attackers to modify Stripe payment configuration settings. By manipulating payment settings parameters, an attacker can change publishable keys, secret keys, email addresses, success URLs, and cancel URLs, potentially redirecting payments to their own Stripe accounts.

An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions within the application.

Broken access control allows users with subscriber privileges to perform unauthorized actions.

An unauthenticated Cross Site Request Forgery (CSRF) issue exists, which allows an attacker to induce a user to perform actions they did not intend to execute.

The plugin contains a broken access control issue that allows unauthenticated users to bypass authorization restrictions.

Deserialization of untrusted data in the software allows Object Injection, a technique where an attacker can manipulate serialized objects to execute arbitrary code or interfere with application logic.

Broken access control allows users with subscriber privileges to perform unauthorized actions.

An issue exists that allows for contributor local file inclusion, which occurs when an application includes a file without properly validating the input, potentially allowing an attacker to read sensitive files on the server.

Broken access control allows users with subscriber privileges to perform unauthorized actions.

The BookPro - Appointment Booking WordPress Plugin contains a flaw allowing unauthenticated attackers to delete arbitrary files on the server. This occurs due to insufficient file path validation, which can lead to remote code execution if critical files, such as `wp-config.php`, are deleted.

An issue exists that allows unauthenticated attackers to perform privilege escalation, enabling them to elevate their access levels within the system.

The Booknetic plugin for WordPress contains a broken authentication flaw. A missing capability check in a function allows unauthenticated attackers to perform unauthorized actions.

A missing authorization issue allows for the exploitation of incorrectly configured access control security levels. This is a broken access control flaw where the system fails to properly verify if a user has the necessary permissions to perform an action.

A missing authorization issue in Linethemes NanoCare allows for the exploitation of incorrectly configured access control security levels, resulting in broken access control.

The EmallShop theme for WordPress allows unauthenticated attackers to perform PHP Object Injection through the deserialization of untrusted input. PHP Object Injection occurs when an application deserializes data from an untrusted source, potentially allowing an attacker to manipulate the object's properties. While no POP chain (a sequence of gadgets used to achieve code execution) is present in the software itself, the presence of a POP chain via other installed plugins or themes could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

This issue involves PHP Object Injection caused by the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. While no POP chain (a sequence of gadgets used to achieve code execution) is present in the software itself, the presence of a POP chain via another installed plugin or theme could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Unauthenticated attackers can perform PHP Object Injection through the deserialization of untrusted input. This occurs when the application takes user-supplied data and passes it to the PHP `unserialize()` function without proper validation. While no POP chain (a sequence of gadgets used to achieve code execution) is present in the software itself, the presence of a POP chain via other installed plugins or themes could allow for arbitrary file deletion, retrieval of sensitive data, or remote code execution.

The PressMart theme for WordPress allows unauthenticated attackers to perform PHP Object Injection through the deserialization of untrusted input. Deserialization is the process of converting a stored data format back into an object. While no POP chain (a sequence of gadgets used to achieve code execution) is present in the software itself, the presence of a POP chain via other installed plugins or themes could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.