Sélim Lanouar

**Name of the Vulnerable Software and Affected Versions** All-in-One WP Migration Unlimited Extension versions prior to 2.84 **Description** The plugin is affected by missing authorization. The `Ai1wmve Schedules Controller::save` function for the 'admin post ai1wm schedule event save' endpoint does not verify user capabilities before saving schedule data. This allows authenticated attackers with subscriber-level access or higher to create scheduled export jobs and direct backup notifications to email addresses they control. Since these notifications contain the random backup filename, attackers can download full site backups, leading to the exposure of sensitive information. **Recommendations** Update to a version later than 2.83.

**Name of the Vulnerable Software and Affected Versions** Ninja Forms - File Uploads versions prior to 3.3.27 **Description** An unauthenticated arbitrary file upload issue exists due to missing file type and extension validation in the `NF FU AJAX Controllers Uploads::handle upload()` function. This flaw allows attackers to upload arbitrary files, including PHP webshells, and use path traversal to move these files into the webroot, leading to remote code execution (RCE) and full site takeover. Approximately 50,000 sites are estimated to be affected, with thousands of exploitation attempts observed by security firms. **Recommendations** Update Ninja Forms - File Uploads to version 3.3.27. As a temporary workaround, disable or remove the File Uploads extension. Scan the uploads directory and webroot for unexpected .php or suspicious files and remove them. Apply WAF rules to block exploit patterns. Rotate admin, database, and API credentials if a compromise is suspected.

**Name of the Vulnerable Software and Affected Versions** File Away plugin for WordPress versions up to, and including, 3.9.9.0.1 **Description** The File Away plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check and missing file type validation in the `upload()` function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server, which may make remote code execution possible. **Recommendations** For versions up to, and including, 3.9.9.0.1, consider disabling the `upload()` function until a patch is available. Restrict access to the upload functionality to minimize the risk of exploitation. Avoid using the File Away plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** File Away plugin for WordPress versions up to, and including, 3.9.9.0.1 **Description** The issue allows unauthorized access to data due to a missing capability check on the `ajax()` function. This enables unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information, by leveraging a reversible weak algorithm. **Recommendations** For versions up to, and including, 3.9.9.0.1, update to a version that includes a fix for the missing capability check in the `ajax()` function to prevent unauthorized access. As a temporary workaround, consider disabling the `ajax()` function in the File Away plugin until a patch is available.

**Name of the Vulnerable Software and Affected Versions** WPS Hide Login plugin for WordPress versions up to, and including, 1.9.15.2 **Description** The issue is related to a bypass that allows attackers to discover hidden login pages when the `action` parameter is set to `postpass`. This makes it possible for attackers to easily find any login page that may have been hidden by the plugin. **Recommendations** For versions up to, and including, 1.9.15.2, consider disabling the plugin until a patch is available to prevent exploitation. As a temporary workaround, avoid using the `action=postpass` parameter in affected API endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.