Ryan Fabella

The Mine CloudVod WordPress plugin before 2.6.6 does not verify that an order belongs to the requesting user before returning its payment status, allowing any authenticated user, such as subscriber, to read other customers' order status, the purchased item and, while an Alipay payment is in progress, the buyer's Alipay account identifier.

The AskAny WordPress plugin before 2.2.1 does not verify that a chat session belongs to the requester before returning or changing it, allowing unauthenticated users who obtain or guess another visitor's session identifier to read that visitor's chat transcript, name, email address and IP address, and to add messages to their conversation or overwrite their details.

Unauthenticated users can upload PHP files and execute arbitrary code on the site server when visitor attachments are enabled. This occurs because the plugin fails to validate the extension or content of files attached to chat messages, relying instead on the file type supplied by the browser.

The plugin fails to enforce the SMS-retry limit on the server side. This allows unauthenticated users to send an unlimited number of verification SMS messages to phone numbers specified by an attacker, which can lead to the exhaustion of the site owner's paid SMS credits and the spamming of third parties.

Insufficient restriction on user-creation actions allows authenticated users with Subscriber-level access and above to create a new administrator account or grant themselves unauthorized capabilities, leading to privilege escalation.

An Insecure Direct Object Reference (IDOR) exists where the plugin fails to verify if the requester owns a guest order before returning its details. This allows unauthenticated visitors who possess a guest order identifier to view the order status, payment status, and total. The issue stems from missing validation on a user-controlled key.

An Insecure Direct Object Reference occurs because the plugin fails to verify ownership or session binding when loading a previously saved shopping cart. An unauthenticated user can load another shopper's cart contents—including selected products, quantities, and custom field data—by obtaining the saved-cart identifier. This is caused by missing validation on a user-controlled key.

A race condition exists due to a non-atomic read-modify-write operation on the gift card balance. This occurs when a gift card is redeemed at checkout, as the system fails to lock or atomically update the balance. An unauthenticated attacker possessing a valid gift card code with a non-zero balance can spend more than the funded value by submitting multiple simultaneous checkout requests to bypass the balance check before it is decremented.

Insufficient input sanitization and output escaping allow authenticated users, such as those with subscriber-level access, to inject arbitrary web scripts. This occurs because the software fails to verify a capability or a nonce before creating a WordPress role from a name provided in the request. The injected scripts execute when an administrator accesses standard user management screens or other affected pages. Stored Cross-Site Scripting (XSS) is a flaw where malicious scripts are permanently stored on the target server.

Unauthenticated visitors can overwrite the stored price of items in their shopping cart, enabling the creation of orders for any product at an arbitrary total. This occurs due to a missing capability check in a function, which allows unauthorized users to perform restricted actions.

An issue exists where the plugin fails to verify if the requester has the necessary permissions to manage a form before exporting its configuration. This allows unauthenticated users to download stored settings for any form, which may include sensitive data such as notification recipient email addresses and reCAPTCHA secret keys that are not visible on the public-facing form.

The plugin fails to perform an authorization check before rendering posts via the recipe print feature. This allows unauthenticated users to disclose the title, ID, and recipe content of unpublished posts, including drafts, pending, private, and password-protected posts that contain a recipe card block. The optional print only published posts protection is ineffective because the status check is applied to a different post than the one rendered.

An issue exists where the software fails to properly validate a parameter before utilizing it as a column identifier within a SQL query. This allows unauthenticated attackers to execute SQL injection attacks, a technique where malicious SQL statements are inserted into entry fields for execution. The vulnerable parameter is `datacolumn`.

An issue exists where the plugin fails to verify the payment status of a booking with the payment provider before marking the transaction as paid and confirmed. This allows unauthenticated attackers to mark bookings as paid without completing the actual payment process.

An issue exists where the software fails to validate the origin of password-reset requests. This allows an unauthenticated attacker to intercept a user who is in the process of resetting their password and set it to a value chosen by the attacker via a forged request, leading to full account takeover.

Insufficient authorization checks when serving shipping label downloads allow unauthenticated users to obtain shipping labels for arbitrary orders. These labels contain sensitive customer information, including names, addresses, and phone numbers.

The plugin fails to perform authorization checks before creating WooCommerce coupons. This allows unauthenticated attackers to create arbitrary coupons, such as those providing 100% discounts or free shipping.

The plugin fails to properly restrict access to protected WooCommerce product downloads. This allows unauthenticated users to bypass payment requirements and retrieve paid downloadable files for any product.

The plugin fails to verify if the payment provider response confirms a completed and approved transaction before updating a WooCommerce order status to paid. This allows unauthenticated attackers to mark arbitrary orders as paid without actually completing the payment process.

Insufficient access restrictions to analytics data allow unauthenticated attackers to retrieve the stored crawl-analytics log. This occurs because the plugin treats a credential value included in its public source code as a valid API key. The exposed data includes each recorded visitor's IP address, user agent, and referer.