Shikhali Jamalzade

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not verify that the user redeeming a gift card is its intended recipient, allowing any authenticated user, such as a subscriber, to redeem gift cards belonging to other users, zeroing their balance and crediting the value to themselves. In 3.2.9 an ownership check was added on one of the two affected redemption paths; the one that remains requires a companion Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 from the same vendor to be active.

**Name of the Vulnerable Software and Affected Versions** CatalogX WordPress plugin versions prior to 6.1.3 **Description** An issue exists where the plugin fails to sanitize or escape content stored by an unauthenticated user. This content is subsequently included in the product enquiry notification email sent to the site administrator. An unauthenticated attacker can inject arbitrary content into this email, which is then delivered when a different visitor submits a product enquiry. **Recommendations** Update CatalogX WordPress plugin to version 6.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** MultiVendorX WordPress plugin versions prior to 5.0.15 **Description** Insufficient authorization controls on a REST API listing route allow unauthenticated users to retrieve sensitive information. This includes vendor contact and payout details, pending payout amounts, and administrative notes associated with store applications. **Recommendations** Update the MultiVendorX WordPress plugin to version 5.0.15 or later.

**Name of the Vulnerable Software and Affected Versions** Catfolders Document Gallery Pro versions prior to 2.0.7 **Description** Certain REST API routes lack proper authorization, and the token used to identify requested content can be forged on the client side. This allows unauthenticated users to list and download the contents of folders that have not been published on the site. The issue specifically involves the `download-all` functionality. **Recommendations** Update Catfolders Document Gallery Pro to version 2.0.7 or later.

**Name of the Vulnerable Software and Affected Versions** WCFM Marketplace WordPress plugin versions prior to 3.8.2 **Description** The plugin fails to properly verify if the user requesting a refund is the actual owner of the order. This flaw allows unauthenticated users to initiate refund requests for any guest checkout order present on the site. **Recommendations** Update the WCFM Marketplace WordPress plugin to version 3.8.2 or later.

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not check authorisation when returning question bank entries through one of its REST API routes, allowing users with a role as low as Contributor to read the questions, hints and correct answer keys of quizzes belonging to other users.

**Name of the Vulnerable Software and Affected Versions** StoreGrowth versions prior to 2.1.2 **Description** Insufficient validation of browser-supplied product prices on two unauthenticated actions allows unauthenticated attackers to add products to the cart at an arbitrary price. This manipulation affects the checkout total when the BOGO (Buy One Get One) offer feature is enabled. **Recommendations** Update StoreGrowth to version 2.1.2 or later. Disable the BOGO offer feature as a temporary mitigation measure.

**Name of the Vulnerable Software and Affected Versions** Notifima versions prior to 3.1.4 **Description** An Insecure Direct Object Reference (IDOR) exists in a REST endpoint where the plugin fails to verify if the caller owns the subscription being modified. This allows authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product stock-alert notifications. **Recommendations** Update Notifima to version 3.1.4 or later.

**Name of the Vulnerable Software and Affected Versions** Finale Lite versions prior to 2.21.0 **Description** An issue exists where the plugin fails to perform a capability check on an AJAX action. This allows any authenticated user with Subscriber privileges or higher to access sales-campaign configuration and scheduling data for an arbitrary post ID via the `wcct quick view html` action. **Recommendations** Update Finale Lite to version 2.21.0 or later.

**Name of the Vulnerable Software and Affected Versions** LearnPress versions prior to 4.0.3 **Description** An authorization check is missing on a REST endpoint, which allows unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers. **Recommendations** Update LearnPress to version 4.0.3 or later.

**Name of the Vulnerable Software and Affected Versions** Return Refund and Exchange For WooCommerce WordPress plugin versions prior to 4.6.4 **Description** Certain AJAX actions exposed to unauthenticated users do not correctly verify the ownership of guest orders. This allows an attacker to read private order messages, post messages and attachments on behalf of the customer, and cancel return requests for any guest order. **Recommendations** Update the plugin to version 4.6.4 or later.

**Name of the Vulnerable Software and Affected Versions** Order Tip for WooCommerce versions prior to 1.6.0 **Description** Insufficient capability checks and a lack of path restriction in the `delete exported csv file ajax` function allow users with the Shop Manager role or higher to delete arbitrary files on the server. This flaw could potentially lead to a complete site takeover. **Recommendations** Update Order Tip for WooCommerce to version 1.6.0 or later. As a temporary mitigation, restrict access to the `delete exported csv file ajax` function for users with the Shop Manager role.

**Name of the Vulnerable Software and Affected Versions** GutenKit versions prior to 2.5.0 **Description** Insufficient capability checks on certain REST API endpoints allow users with the Contributor role or higher to retrieve mailing-list audience metadata from the connected marketing account. **Recommendations** Update GutenKit to version 2.5.0 or later.

**Name of the Vulnerable Software and Affected Versions** Easy Appointments versions prior to 4.0.1 **Description** An issue exists where a REST endpoint used for appointment listing does not restrict access to records belonging only to the requesting user. This allows users with contributor-level access to read all bookings on the site, exposing sensitive information such as customer names, schedules, and statuses. **Recommendations** Update Easy Appointments to version 4.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** WPS Bidouille versions prior to 1.33.5 **Description** The plugin lacks proper authorization checks in an AJAX action, which allows any authenticated user, including those with subscriber privileges, to retrieve the email addresses of all registered users through the `wps get users` function. **Recommendations** Update WPS Bidouille to version 1.33.5 or later.

**Name of the Vulnerable Software and Affected Versions** Membership For WooCommerce versions prior to 3.1.2 **Description** An issue exists where the plugin fails to verify if an API consumer secret has been generated before comparing it with the secret provided in a request. This allows unauthenticated attackers to access REST routes and disclose membership plan details of any user on sites where the API is enabled but no keys have been generated. **Recommendations** Update Membership For WooCommerce to version 3.1.2 or later.

**Name of the Vulnerable Software and Affected Versions** CatFolders Document Gallery & PDF Library WordPress plugin versions prior to 2.0.7 **Description** Lack of authorization checks in certain REST API endpoints allows unauthenticated users to retrieve sensitive information about media attachments. This includes the title, type, size, and URL of attachments assigned to any folder, even those not published in a site gallery. **Recommendations** Update the plugin to version 2.0.7 or later.

**Name of the Vulnerable Software and Affected Versions** Order Sync with Zendesk for WooCommerce versions prior to 2.2.3 **Description** An issue exists where a REST API endpoint fails to perform capability checks and does not verify if the requester owns the account being queried. This allows unauthenticated attackers to retrieve the order history and purchase totals of customers by providing an email address that is known or can be enumerated. **Recommendations** Update Order Sync with Zendesk for WooCommerce to version 2.2.3 or later.

**Name of the Vulnerable Software and Affected Versions** Advanced Classifieds & Directory Pro versions prior to 3.4.3 **Description** An issue allows unauthenticated users to expose sensitive information through the AJAX action `acadp public custom fields listings`. This leads to the disclosure of non-public listing custom fields. **Recommendations** Update to version 3.4.3 or later.

**Name of the Vulnerable Software and Affected Versions** Duplicate Post WordPress plugin versions prior to 1.5.5 **Description** Insufficient per-object authorization checks in bulk copy and delete operations allow users with assigned plugin access to permanently delete arbitrary posts on the site, including content belonging to other users. **Recommendations** Update Duplicate Post WordPress plugin to version 1.5.5 or later.