Sander Horsman

The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that does not properly validate a value before running do shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

**Name of the Vulnerable Software and Affected Versions** Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder versions prior to 1.22.1 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with editor-level access or higher can exploit this to install and activate an arbitrary plugin from a URL under their control, which can lead to remote code execution. This exploitation is possible if a valid Popup Maker Pro license is active on the site and Popup Maker Pro is not yet installed, as these conditions allow the legacy '/v1/connect/info' endpoint to issue a bearer token required to bypass the validation check of the install endpoint. **Recommendations** Update to a version newer than 1.22.0.

**Name of the Vulnerable Software and Affected Versions** Fluent Forms versions prior to 6.1.22 **Description** An authorization bypass exists in the `SubmissionPolicy` class, which authorizes submission-level actions such as reading, modifying, deleting, and adding notes based on a user-supplied `form id` query parameter. Authenticated attackers with Fluent Forms Manager access restricted to specific forms can spoof the `form id` parameter to access, modify the status of, add notes to, or permanently delete form submissions belonging to any other form. **Recommendations** Update to version 6.1.22 or later.

**Name of the Vulnerable Software and Affected Versions** Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder versions prior to 6.2.1 **Description** An Insecure Direct Object Reference (IDOR) exists in the `exportEntries()` function due to missing validation on a user-controlled key. This allows authenticated attackers with manager-level access or higher to bypass form-level restrictions to access unauthorized form submissions, export data from arbitrary database tables, and enumerate database table names through error message disclosure. **Recommendations** Update to a version later than 6.2.0. As a temporary workaround, restrict access to the `exportEntries()` function for users with manager-level permissions until the update is applied.

**Name of the Vulnerable Software and Affected Versions** MW WP Form versions prior to 5.1.2 **Description** Unauthenticated attackers can move arbitrary files on the server, potentially leading to remote code execution. The issue occurs when the `generate user file dirpath()` function fails to properly validate the `$name` parameter, which is passed via the `mwf upload files[]` POST parameter and processed by ` set request valiables()`. During form processing, `regenerate upload file keys()` calls `generate user filepath()` using the attacker-supplied key. Because the `path join()` function returns absolute paths unchanged, the intended base directory is discarded. Subsequently, the ` get attachments()` method passes the resolved path to `move temp file to upload dir()`, which uses `rename()` to move the file into the uploads folder. This flaw is exploitable only if a file upload field is present in the form and the Saving inquiry data in database option is enabled. **Recommendations** Update MW WP Form to version 5.1.2 or later. As a temporary mitigation, disable the Saving inquiry data in database option or remove file upload fields from forms.