Sanjorn Keeratirungsan

An improper access revocation issue exists where deleted administrators continue to receive document contents. This occurs because the `UserDeletedProcessor` fails to disable `WebhookSubscription` rows. Consequently, former administrators who registered webhooks before their account deletion continue to receive full document bodies, including Markdown and Yjs data, via the `DeliverWebhookTask` for every matching workspace event.

An authorization flaw allows authenticated users to delete food variants belonging to other users. This is possible via the 'DELETE /api/foods/food-variants/:id' endpoint by utilizing variant IDs obtained from public food read endpoints to remove serving and nutrition variants of publicly shared foods.

An issue exists during payment-gated registration where the software fails to roll back the creation of a WordPress account if the subsequent payment step fails. This allows unauthenticated users to create functional accounts without completing the required payment.

Authenticated users, including those with Subscriber roles, can modify the update history of campaigns they do not own and trigger notification emails to backers because the plugin fails to verify campaign ownership.

The plugin fails to perform an authorization check on its waiting-list registration handler. This allows unauthenticated users to create WordPress user accounts using arbitrary email addresses and inject order records.

An Insecure Direct Object Reference (IDOR) exists due to missing authorization checks and validation on a user-controlled key during a wallet and points update action. This allows unauthenticated attackers to arbitrarily modify or corrupt the stored wallet balance and loyalty points of any user, including driving the balance negative. Modifying the wallet balance specifically requires the Wallet System for WooCommerce companion plugin to be active.

The plugin fails to perform a capability check before returning full customer details during an AJAX action. This allows any authenticated user with low-privileged access, such as a Subscriber account, to read personal data of customers, including name, email, phone, and address.

An improper access restriction exists in a REST API endpoint that returns recurring-donation records. This allows unauthenticated users to retrieve sensitive information regarding anonymous recurring donors, such as their names and subscription details.

An Insecure Direct Object Reference (IDOR) exists in several payment-method endpoints. The plugin fails to verify if a subscription belongs to the requesting customer, allowing an authenticated user to modify another customer's subscription—including changing the payment method or cancelling and re-binding it—provided they know the target subscription identifier.

The plugin fails to verify if a booking order belongs to the user making the request before processing a cancellation. This allows any authenticated user, including those with Subscriber or Customer roles, to cancel and void booking orders belonging to other customers.

Several AJAX handlers do not enforce capability checks, which allows authenticated users with Subscriber-level access to read booking line items of other users, enumerate active coupons, and access pricing data.

PHP Object Injection occurs due to the use of `unserialize()` calls within the Workflow, Form block, and File/Set components that do not implement the `allowed classes` restriction. This allows an unauthenticated attacker to trigger arbitrary PHP object instantiation if a malicious serialized payload is present in the database.