Phong Nguyen

**Name of the Vulnerable Software and Affected Versions** Katalogportal PDF Sync versions prior to 1.0.1 **Description** The plugin contains a missing authorization flaw where the `katalogportal popup shortcode()` function, registered as an AJAX handler via `wp ajax katalogportal shortcodePrinter`, does not implement capability checks or nonce verification. This allows any authenticated user, such as those with Subscriber roles, to access the endpoint and retrieve a list of all synchronized PDF attachments, including those linked to private or draft posts. The leaked information includes attachment titles, actual filenames, and the `katalogportal userid` configuration value. This occurs because the `WP Query` uses the `post status` parameter set to `any`, which ignores the visibility status of the parent post. **Recommendations** Update the plugin to a version later than 1.0.0. As a temporary mitigation, restrict access to the `wp ajax katalogportal shortcodePrinter` AJAX handler.

**Name of the Vulnerable Software and Affected Versions** e-shot™ form builder plugin for WordPress versions prior to 1.0.3 **Description** The plugin contains a missing authorization flaw in the `eshot form builder update field data()` AJAX handler. The function is registered via the `wp ajax ` hook but fails to implement capability checks using `current user can()` or nonce verification through `check ajax referer()` or `wp verify nonce()`. Consequently, authenticated users with Subscriber-level access or higher can modify form field configurations, such as mandatory status, field visibility, and form display preferences, by interacting with the `eshot form builder update field data` AJAX action. **Recommendations** Update the e-shot™ form builder plugin for WordPress to version 1.0.3 or later.

Name of the Vulnerable Software and Affected Versions LTL Freight Quotes – R+L Carriers Edition plugin for WordPress versions up to and including 3.3.13 Description The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress is susceptible to unauthorized access due to missing authentication, authorization, and nonce verification in its webhook handler. A standalone PHP file directly processes GET parameters and updates WordPress options without proper security checks. This allows unauthenticated attackers to modify the plugin’s subscription plan settings, potentially downgrading a paid plan to the Trial Plan, altering the store type, and manipulating subscription expiration dates, which could disable premium features like Dropship and Hazardous Material handling. Recommendations Update the LTL Freight Quotes – R+L Carriers Edition plugin to a version beyond 3.3.13.

**Name of the Vulnerable Software and Affected Versions** e-shot form builder plugin for WordPress versions up to and including 1.0.2 **Description** The e-shot form builder plugin for WordPress is susceptible to exposure of sensitive information. The `eshot form builder get account data()` function, registered as a wp ajax AJAX handler, does not include appropriate capability checks or nonce verification. This allows authenticated attackers with Subscriber-level access or higher to query the database and retrieve the e-shot API token stored in the eshotformbuilder control table, along with all subaccount data, as a JSON response. This information could be used to access the victim's e-shot platform account. **Recommendations** Versions prior to and including 1.0.2 should be updated to a newer, fixed version when available. As a temporary workaround, consider removing the AJAX handler for the `eshot form builder get account data()` function. Restrict access to the eshotformbuilder control table to authorized users only.

**Name of the Vulnerable Software and Affected Versions** Punnel – Landing Page Builder plugin for WordPress versions through 1.3.1 **Description** The Punnel – Landing Page Builder plugin for WordPress is subject to a missing authorization issue. The `save config()` function, responsible for handling the 'punnel save config' AJAX action, does not include capability checks or nonce verification. This allows authenticated attackers with Subscriber-level access or higher to modify the plugin’s configuration, including the API key, through a POST request to the ''/admin-ajax.php'' endpoint. With access to the API key, attackers can leverage the plugin’s public API endpoint (''/?punnel api=1'')—which validates requests by comparing a POST token against the stored `api key`—to create, update, or delete arbitrary posts, pages, and products on the site. **Recommendations** Versions prior to and including 1.3.1 should be updated to a newer, fixed version when available. As a temporary workaround, consider restricting access to the 'punnel save config' AJAX action.

**Name of the Vulnerable Software and Affected Versions** Smarter Analytics plugin for WordPress versions prior to 2.1 **Description** The Smarter Analytics plugin for WordPress is susceptible to unauthorized access due to missing authentication and capability checks on the configuration reset functionality within the `smarter-analytics.php` file. This allows unauthenticated attackers to reset all plugin configurations and delete per-page/per-post analytics settings by manipulating the `reset` parameter. **Recommendations** Update to version 2.1 or later.

**Name of the Vulnerable Software and Affected Versions** RockPress versions up to and including 1.0.17 **Description** The RockPress plugin for WordPress is susceptible to a missing authorization issue. This is due to the absence of capability checks on several AJAX actions – `rockpress import`, `rockpress import status`, `rockpress last import`, `rockpress reset import`, and `rockpress check services`. The plugin’s nonce is exposed to all authenticated users through an unconditionally enqueued admin script. Specifically, the ‘rockpress-admin’ script is enqueued on all admin pages, including `profile.php`, without any restrictions. The nonce for the ‘rockpress-nonce’ action is passed to this script via `wp localize script`. Because the AJAX handlers only verify the nonce and do not verify `current user can()`, any authenticated user, even those with Subscriber-level access, can extract the nonce from the HTML source code of any admin page. This allows them to trigger imports, reset import data, check service connectivity, and read import status information, actions that should be restricted to administrators. **Recommendations** Update RockPress to a version later than 1.0.17.

**Name of the Vulnerable Software and Affected Versions** Bonanza – WooCommerce Free Gifts Lite plugin versions up to and including 1.0.0 **Description** The Bonanza – WooCommerce Free Gifts Lite plugin for WordPress is susceptible to unauthorized data modification because of a missing capability check on the `xlo optin call()` function. Authenticated attackers with Subscriber-level access or higher can manipulate the opt-in status to success. **Recommendations** Update the Bonanza – WooCommerce Free Gifts Lite plugin to a version beyond 1.0.0.

**Name of the Vulnerable Software and Affected Versions** Vchasno Kasa plugin for WordPress versions up to and including 1.0.3 **Description** The Vchasno Kasa plugin for WordPress is susceptible to unauthorized data access due to a missing capability check within the `mrkv vchasno kasa wc do metabox action()` function. This allows unauthenticated attackers to generate invoices for arbitrary orders. **Recommendations** Update the Vchasno Kasa plugin to a version newer than 1.0.3.

**Name of the Vulnerable Software and Affected Versions** Vchasno Kasa plugin for WordPress versions up to and including 1.0.3 **Description** The Vchasno Kasa plugin for WordPress is susceptible to unauthorized data loss. This is due to a missing capability check within the `clear all log()` function, allowing unauthenticated attackers to clear log files. **Recommendations** Update the Vchasno Kasa plugin to a version newer than 1.0.3.

**Name of the Vulnerable Software and Affected Versions** Block Editor Gallery Slider plugin for WordPress versions up to and including 1.1.1 **Description** The Block Editor Gallery Slider plugin for WordPress is susceptible to unauthorized data modification. A missing capability check within the `classic gallery slider options()` function allows authenticated attackers with Subscriber-level access or higher to update limited post meta for any post. **Recommendations** Update the Block Editor Gallery Slider plugin to a version later than 1.1.1.

Name of the Vulnerable Software and Affected Versions: WPQuiz plugin for WordPress versions up to, and including, 0.4.2 Description: The issue allows authenticated attackers with Contributor-level access and above to perform SQL Injection via the `id` attribute of the `wpquiz` shortcode. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query, making it possible to extract sensitive information from the database. Recommendations: For WPQuiz plugin for WordPress versions up to, and including, 0.4.2, update to a version that addresses the SQL Injection issue, as the current version allows for the exploitation of sensitive database information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: PayMaster for WooCommerce plugin for WordPress versions up to, and including, 0.4.31 Description: The issue allows authenticated attackers with Subscriber-level access and above to make web requests to arbitrary locations originating from the web application. This can be used to query and modify information from internal services via the `wp ajax paym status` AJAX action. Recommendations: For PayMaster for WooCommerce plugin for WordPress versions up to, and including, 0.4.31, consider disabling the `wp ajax paym status` AJAX action as a temporary workaround until a patch is available. Restrict access to this action to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** GnuPG versions 1.0.2 through 1.2.3 **Description** The issue concerns the creation of ElGamal type 20 keys, which are used for both signing and encryption. In affected versions, the same key component is used for encryption as for signing, allowing attackers to potentially determine the private key from a signature. This could lead to a breach of confidentiality, integrity, and availability of protected information. Exploitation of the issue can be done remotely. **Recommendations** For versions 1.0.2 through 1.2.3, consider regenerating keys to ensure the encryption and signing components are distinct, until a fixed version is available. As a temporary workaround, restrict the use of ElGamal type 20 keys for sensitive operations.