Stefan Spasic

Insufficient authorization checks in several settings-save handlers allow users with subscriber-level access and above to overwrite stored settings. This includes the ability to modify stored API credentials as well as feature and template configurations.

The plugin fails to verify if the user initiating a wallet transfer is the actual owner of the wallet being debited. This allows any authenticated user, including those with the Subscriber role, to transfer funds from any other user's wallet, including administrators, into an account they control.

The plugin fails to perform object-level authorization checks on several host-management operations. This allows users assigned to a specific custom administrator role to read, modify, and permanently delete records belonging to other hosts, as well as the WordPress user accounts associated with them.

An improper access control issue allows any authenticated user with subscriber-level access or higher who is enrolled in at least one course to access quiz attempt records belonging to other users. This allows the unauthorized reading of personal data across the entire site, including names, IP addresses, registration dates, and quiz results.