Stephanie Walters

The software is susceptible to Cross-Site Request Forgery due to a lack of nonce validation in the ss addtoallowlist class. This allows unauthenticated attackers to add arbitrary email addresses to the spam allowlist by deceiving a site administrator into performing an action, such as clicking a link. The issue was partially addressed in version 2026.1.

The issue allows authenticated attackers with Author-level access and above to update the profile picture of any user due to missing validation on a user-controlled key in the `rest api change profile image` function. This is an Insecure Direct Object Reference issue.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `rbs ajax create article` and `rbs ajax reset views` functions. This allows unauthenticated attackers to create new posts and reset gallery view counts via a forged request if they can trick a Contributor+ level user into performing an action such as clicking on a link.

The issue allows unauthorized access and modification of data due to a missing capability check on several functions hooked into `admin init`. This makes it possible for authenticated attackers with subscriber access or higher to modify plugin settings and view discount codes intended for other users.

The issue is related to missing file type validation in the `save post materials` function, allowing authenticated attackers with Instructor-level permissions and above to upload arbitrary files on the affected site's server. This could potentially lead to remote code execution.