T0Ann9Uy3N

**Name of the Vulnerable Software and Affected Versions** MailChimp Forms by MailMunch versions prior to 3.2.8 **Description** The plugin is susceptible to unauthorized data modification because the `sign in()` and `sign up()` AJAX handlers lack proper capability checks. Authenticated users with Subscriber-level access or higher can exploit this by submitting their own credentials to relink the site integration to an account they control. This allows the attacker to intercept all subscriber data captured by the forms and control the landing pages rendered on the site. **Recommendations** Update the plugin to version 3.2.8 or later. As a temporary mitigation, restrict access to the `sign in()` and `sign up()` AJAX handlers for users with Subscriber-level permissions.

**Name of the Vulnerable Software and Affected Versions** TypeSquare Webfonts for ConoHa versions prior to 2.0.5 **Description** The plugin fails to properly verify if a user is authorized to perform specific actions, leading to an authorization bypass. Authenticated attackers with subscriber-level access or higher can modify site-wide font settings by submitting a POST request to any 'wp-admin' page. The affected settings include the `typesquare auth` option (`fontThemeUseType`), `show post form`, and `typesquare fonttheme`. Additionally, when `fontThemeUseType` is set to 1 or 3, the lack of nonce verification—a unique token used to prevent duplicate or forged requests—makes these branches susceptible to cross-site request forgery. **Recommendations** Update to a version later than 2.0.4.