Sanjorn Keeratirungsan

**Name of the Vulnerable Software and Affected Versions** WP Crowdfunding WordPress plugin versions prior to 2.2.1 **Description** Authenticated users, including those with Subscriber roles, can modify the update history of campaigns they do not own and trigger notification emails to backers because the plugin fails to verify campaign ownership. **Recommendations** Update WP Crowdfunding WordPress plugin to version 2.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** Eventin WordPress plugin versions prior to 4.1.20 **Description** The plugin fails to perform an authorization check on its waiting-list registration handler. This allows unauthenticated users to create WordPress user accounts using arbitrary email addresses and inject order records. **Recommendations** Update the Eventin WordPress plugin to version 4.1.20 or later.

**Name of the Vulnerable Software and Affected Versions** GiveWP WordPress plugin versions prior to 4.16.3 **Description** An improper access restriction exists in a REST API endpoint that returns recurring-donation records. This allows unauthenticated users to retrieve sensitive information regarding anonymous recurring donors, such as their names and subscription details. **Recommendations** Update GiveWP WordPress plugin to version 4.16.3 or later.

The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is available to unauthenticated users, and does not verify that the requester owns the account being changed, allowing unauthenticated attackers to arbitrarily modify or corrupt (including driving it negative) the stored wallet balance and loyalty points of any user. Modifying the wallet balance additionally requires the companion Wallet System for WooCommerce Points and Rewards for WooCommerce WordPress plugin before 2.10.1 to be active.

The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account (Subscriber and above) to read the personal data, including name, email, phone, and address, of any customer.

**Name of the Vulnerable Software and Affected Versions** FluentCart A New Era of eCommerce WordPress plugin versions prior to 1.4.0 **Description** An Insecure Direct Object Reference (IDOR) exists in several payment-method endpoints. The plugin fails to verify if a subscription belongs to the requesting customer, allowing an authenticated user to modify another customer's subscription—including changing the payment method or cancelling and re-binding it—provided they know the target subscription identifier. **Recommendations** Update the plugin to version 1.4.0 or later.

**Name of the Vulnerable Software and Affected Versions** WPS Bookings for WooCommerce WordPress plugin versions prior to 3.11.7 **Description** The plugin fails to verify if a booking order belongs to the user making the request before processing a cancellation. This allows any authenticated user, including those with Subscriber or Customer roles, to cancel and void booking orders belonging to other customers. **Recommendations** Update WPS Bookings for WooCommerce WordPress plugin to version 3.11.7 or later.

**Name of the Vulnerable Software and Affected Versions** WP Hotel Booking versions prior to 2.3.1 **Description** Several AJAX handlers do not enforce capability checks, which allows authenticated users with Subscriber-level access to read booking line items of other users, enumerate active coupons, and access pricing data. **Recommendations** Update to version 2.3.1 or later.

**Name of the Vulnerable Software and Affected Versions** Concrete CMS versions prior to 9.5.2 **Description** PHP Object Injection occurs due to the use of `unserialize()` calls within the Workflow, Form block, and File/Set components that do not implement the `allowed classes` restriction. This allows an unauthenticated attacker to trigger arbitrary PHP object instantiation if a malicious serialized payload is present in the database. **Recommendations** Update to version 9.5.2 or later.