Sungbyeongchan

The Pie Register WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, allowing users with a role as low as contributor to modify existing administrator-created invitation-code records.

An Insecure Direct Object Reference (IDOR) exists due to missing validation on a user-controlled key. This allows an authenticated user with subscriber or customer-level access to delete media library attachments belonging to other users, including those owned by administrators, without verifying ownership of the media attachment.

These plugins fail to prevent unauthenticated users from storing a serialized PHP object in user metadata. This object is subsequently deserialized when a public profile is viewed, enabling PHP object injection. This flaw can lead to arbitrary file write and potential remote code execution.

An issue in the memberful-wp plugin allows the retrieval of embedded sensitive system information, exposing it to an unauthorized control sphere.

Internal state files in the `mod dav fs` module are accessible to external parties. This allows a remote client to read WebDAV dead properties of resources they are not authorized to author by sending a GET request to the `.DAV` state directory.

Improper validation of the FTP PASV reply address in the `mod proxy ftp` module allows an untrusted FTP server to force the proxy to open a data connection to an arbitrary third-party host. This occurs in forward proxy configurations when the server processes a crafted PASV response.

An unauthenticated SQL Injection exists in the Books Gallery – Book Showcase, Library & Affiliate Plugin for WordPress. The issue stems from insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. This allows attackers to append additional SQL queries to existing ones to extract sensitive information from the database.

The Appointment Booking Plugin & Scheduling System – Webba Booking Calendar plugin for WordPress contains an Insecure Direct Object Reference (IDOR) issue. This occurs due to missing validation on a user-controlled key, allowing authenticated attackers with subscriber-level access or higher to perform unauthorized actions.

A broken access control issue exists that allows users with contributor privileges to perform unauthorized actions.

A broken access control issue exists that allows users with Subscriber privileges to perform unauthorized actions.

A broken access control issue exists that allows users with the Subscriber role to perform unauthorized actions.

An unauthenticated broken access control issue exists in the Kali Forms plugin. Broken access control occurs when a system fails to properly enforce restrictions on what authenticated or unauthenticated users are allowed to do, potentially allowing unauthorized access to functions or data.