Supakiad S

**Name of the Vulnerable Software and Affected Versions** WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode versions prior to 4.4.2 **Description** An arbitrary file upload issue exists due to missing file type validation in the `saas upload logo()` function combined with an authorization bypass on the WPLP connector REST endpoints. This allows unauthenticated remote attackers to upload arbitrary files to the server, which may lead to remote code execution (RCE), a state where an attacker can execute malicious commands on the affected system. **Recommendations** Update WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode to a version newer than 4.4.1. As a temporary mitigation, disable or remove the plugin until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System versions prior to 1.4.53 **Description** An authentication bypass exists that allows for administrator account takeover. The issue resides in the `guest ticket login()` function and its `p` parameter. The site-wide AES-256-CBC encryption key is generated using a low-entropy process involving three two-digit `wp rand(10, 99)` values and a Unix timestamp via `md5()`, resulting in approximately 19.5 bits of entropy. Additionally, the plugin uses a deterministic IV derived from the password and lacks authentication tags on ciphertext, capability checks, nonces, or session validation on the `/sgnix/?p=<token>` endpoint. Attackers with subscriber-level access or higher can use a legitimate guest ticket token as a known-plaintext oracle to recover the encryption key offline. By forging a `{ticket id, ticket user}` token for an administrator-owned ticket and submitting it to the endpoint, the `wp set auth cookie()` function is triggered, granting full administrative access to the site. **Recommendations** Update the plugin to a version later than 1.4.52. As a temporary workaround, restrict access to the `/sgnix/?p=<token>` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Hash Form versions prior to 1.4.2 **Description** Unauthenticated PHP Object Injection occurs in the software. PHP Object Injection is a vulnerability that allows an attacker to inject malicious objects into the application, which can lead to remote code execution or other critical impacts. **Recommendations** Update to a version newer than 1.4.1.

**Name of the Vulnerable Software and Affected Versions** Geo Controller versions prior to 8.9.9 **Description** An unauthenticated PHP Object Injection exists in the Geo Controller. This issue could potentially lead to Remote Code Execution (RCE), which is a method allowing an attacker to execute arbitrary commands on the target machine. **Recommendations** Update Geo Controller to a version newer than 8.9.8. Restrict access to the system to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** miniOrange SAML SSO versions prior to 11.0.2 SAML SP Single Sign On – Login with ADFS versions prior to 6.4 SAML SP Single Sign On – SAML SSO login with Google Apps versions prior to 6.4 **Description** An authentication bypass exists due to the `mo saml validate signature()` function performing a loose boolean check on the integer returned by PHP's `openssl verify()`. Because an error return value of -1 is evaluated as truthy, it is treated as a successful signature verification. Unauthenticated attackers can log in as any existing user, including administrators, by submitting a crafted `SAMLResponse` containing an attacker-controlled `NameID` and a malformed signature value that triggers an OpenSSL processing error, leading to the execution of `wp set auth cookie()` for the targeted account. **Recommendations** Update miniOrange SAML SSO to version 11.0.2. Update SAML SP Single Sign On – Login with ADFS to version 6.4. Update SAML SP Single Sign On – SAML SSO login with Google Apps to version 6.4.

**Name of the Vulnerable Software and Affected Versions** WPeMatico RSS Feed Fetcher versions prior to 2.8.25 **Description** The plugin is susceptible to unauthorized data modification leading to privilege escalation. This occurs because the `wpematico import settings()` function lacks a proper capability check. Authenticated users with subscriber-level access or higher can exploit this to update arbitrary options on the WordPress site, such as changing the default registration role to administrator and enabling user registration to gain full administrative access. **Recommendations** Update WPeMatico RSS Feed Fetcher to version 2.8.25 or later. As a temporary mitigation, restrict access to the `wpematico import settings()` function for users with low-level privileges.

**Name of the Vulnerable Software and Affected Versions** WP Travel Engine – Tour Booking Plugin – Tour Operator Software versions prior to 6.8.5 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can view private booking billing details, such as the customer's first name, last name, email address, street address, city, and phone number. This occurs when these details are rendered as default values in checkout form fields by binding an arbitrary `booking id` to the attacker's session. The endpoint relies on a frontend nonce emitted via the `wteL10n` global on trip pages, which only provides CSRF (Cross-Site Request Forgery) protection—a mechanism to prevent unauthorized commands from being transmitted from a user that the web application trusts—and does not restrict unauthenticated access. **Recommendations** Update WP Travel Engine – Tour Booking Plugin – Tour Operator Software to version 6.8.5 or later.

**Name of the Vulnerable Software and Affected Versions** User Profile Builder versions prior to 3.16.5 **Description** An authentication bypass exists due to type confusion within the `wppb log in user()` function. When a registration request is submitted using the `username` parameter with a length between 61 and 70 characters, WordPress core returns a WP Error object. However, the plugin applies the `absint()` function to this return value before verifying it with `is wp error()`. This causes the error object to be coerced into the integer 1, leading the plugin to generate an autologin nonce associated with user ID 1. Consequently, unauthenticated attackers can gain full administrative access to the site. **Recommendations** Update the plugin to a version newer than 3.16.4.

**Name of the Vulnerable Software and Affected Versions** User Access Manager versions prior to 2.3.16 **Description** The User Access Manager plugin for WordPress contains a Directory Traversal flaw. This issue allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitive information. The flaw occurs because when the `attachment url to postid()` function returns 0 for a traversal path, the plugin relies on a global post established by a valid `attachment id` parameter. This causes the access check to validate against a legitimate public attachment while the system streams the file from the path specified by the attacker via the `uamgetfile` parameter. **Recommendations** Update the plugin to version 2.3.16 or later. Avoid using the `uamgetfile` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** SAML Single Sign On – SSO Login versions prior to 5.4.5 **Description** An authentication bypass exists due to the `mo saml validate signature()` function performing a loose boolean check on the integer returned by PHP's `openssl verify()`. An error return value of -1 is evaluated as true, which is treated as a successful signature verification. Unauthenticated attackers can log in as any WordPress user, including administrators, by submitting a crafted SAMLResponse with an attacker-controlled `NameID` and a malformed signature value that triggers an OpenSSL processing error, leading to the execution of `wp set auth cookie()` for the targeted account. **Recommendations** Update the plugin to a version newer than 5.4.4.

**Name of the Vulnerable Software and Affected Versions** Tutor LMS Elementor Addons versions prior to 4.0.1 **Description** The plugin contains a missing authorization flaw where capability checks are absent in the `activate tutor free()` and `activate elementor free()` functions used as `admin action *` handlers. This allows authenticated users with Subscriber-level permissions or higher to activate the Tutor LMS and Elementor plugins without the required authorization. **Recommendations** Update Tutor LMS Elementor Addons to a version newer than 4.0.0. As a temporary mitigation, restrict access to the `activate tutor free()` and `activate elementor free()` functions.

**Name of the Vulnerable Software and Affected Versions** Tutor LMS – eLearning and online course solution plugin for WordPress versions prior to 4.0.1 **Description** An issue exists where authenticated attackers with custom-level access or higher can perform a second-order SQL Injection. This occurs because of insufficient escaping of user-supplied parameters and a lack of preparation in the SQL query. The malicious payload is stored during a quiz attempt via the `wp ajax tutor quiz abandon` handler. The injection is subsequently executed when a privileged user or a Tutor REST API key holder requests the '/wp-json/tutor/v1/quiz-attempt-details/{id}' endpoint, allowing for the extraction of sensitive information from the database. **Recommendations** Update the plugin to a version later than 4.0.0.

**Name of the Vulnerable Software and Affected Versions** SureCart versions prior to 4.2.4 **Description** An issue exists that allows privilege escalation via account takeover. The software fails to properly validate a user's identity when updating details, such as the email address, during customer profile synchronization from webhook events. An unauthenticated attacker who knows the customer ID can change the linked user's email address, including that of an administrator if the account is linked to a SureCart customer record, and subsequently reset the password to gain unauthorized account access. **Recommendations** Update SureCart to version 4.2.4 or later.

**Name of the Vulnerable Software and Affected Versions** miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) versions prior to 7.7.1 **Description** An authentication bypass exists in the Profile Completion flow that allows for account takeover. The issue occurs because the plugin accepts an arbitrary email address via the `email field` POST parameter without verifying if the email belongs to the identity provided by the OAuth provider. Additionally, the `send otp token()` function returns a transaction hash to the client generated by SHA-512 of the `customer key` and the One-Time Password (OTP). Since the OTP space is limited to 99,000 values and the `customer key` is a static option, an unauthenticated attacker can trigger an OTP email to an administrator's address, crack the OTP offline using the leaked hash, and submit it to the `mo openid social login validate otp()` function to gain full administrator access. **Recommendations** Update the plugin to a version newer than 7.7.0.

**Name of the Vulnerable Software and Affected Versions** User Registration & Membership versions prior to 5.2.1 **Description** Missing validation checks in the `confirm payment()` function allow unauthenticated attackers to perform unauthorized modification of data. This flaw enables the bypass of payment processing to activate paid memberships. **Recommendations** Update the plugin to a version later than 5.2.0. As a temporary workaround, consider restricting access to the `confirm payment()` function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** SlimStat Analytics versions prior to 5.4.12 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS) via the `User-Agent` header. This enables the injection of arbitrary web scripts into pages that execute when a user accesses them. This issue requires the `show complete user agent tooltip` setting to be explicitly enabled by an administrator to render and execute the stored payload. **Recommendations** Update SlimStat Analytics to version 5.4.12 or later. Disable the `show complete user agent tooltip` setting to prevent the execution of stored payloads.

**Name of the Vulnerable Software and Affected Versions** User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder versions prior to 5.1.6 **Description** An Insecure Direct Object Reference exists due to missing ownership validation on a user-controlled attachment ID. This allows authenticated attackers with subscriber-level access or higher to store and permanently delete arbitrary media attachments uploaded by any other user, including administrators, because the plugin fails to verify if the referenced attachment belongs to the requesting user. **Recommendations** Update the plugin to version 5.1.6 or later.

**Name of the Vulnerable Software and Affected Versions** User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration versions prior to 4.3.3 **Description** The plugin is subject to unauthorized data modification because the `user subscription cancel()` function lacks a proper capability check. This allows authenticated attackers with Subscriber-level permissions or higher to cancel subscription packs for any user, including those with administrator privileges. **Recommendations** Update to a version later than 4.3.2. As a temporary workaround, restrict access to the `user subscription cancel()` function to prevent unauthorized subscription cancellations.

**Name of the Vulnerable Software and Affected Versions** Subscribe To Comments Reloaded versions prior to 240120 **Description** The Subscribe To Comments Reloaded plugin for WordPress allows unauthenticated attackers to modify data without authorization. This is caused by a leaked secret key and the use of a weak hash generation algorithm. Attackers can extract the global key from any public post page to forge authorization keys, enabling them to manage comment subscription preferences for arbitrary users. **Recommendations** Update the plugin to a version later than 240119.

**Name of the Vulnerable Software and Affected Versions** WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress versions prior to 6.7.26 **Description** An Insecure Direct Object Reference (IDOR) exists due to missing validation on the `customerid` user-controlled key within the 'wcfm delete wcfm customer' function. This allows authenticated attackers with Vendor-level access or higher to delete arbitrary users, including Administrators. IDOR is a type of access control flaw that occurs when an application provides direct access to objects based on user-supplied input. **Recommendations** Update the plugin to a version later than 6.7.25.