Talal Nasraddeen

**Name of the Vulnerable Software and Affected Versions** ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce versions prior to 1.17.9 **Description** An unrestricted file type upload issue exists within the `save attachments()` function. The flaw occurs when CRM Email Connect processes inbound IMAP email attachments due to a lack of file extension validation and path normalization. Unauthenticated attackers can send a crafted email to the configured inbound mailbox using a forged References header and a filename like `../helper.php`. This allows the cron-based IMAP sync job to write attacker-controlled PHP files outside the protected `crm-attachments` directory and into `wp-content/uploads/`. If the server configuration allows PHP execution in the uploads directory, this can result in remote code execution. This issue requires the CRM module and IMAP Email Connect feature to be enabled and configured. **Recommendations** Update to a version newer than 1.17.8. As a temporary mitigation, disable the CRM module or the IMAP Email Connect feature.

**Name of the Vulnerable Software and Affected Versions** Premium Packages – Sell Digital Products Securely versions prior to 6.2.1 **Description** An issue exists where unauthenticated attackers can append additional SQL queries to existing ones to extract sensitive information from the database. This occurs because the `code` parameter of the POST '/wp-json/wpdmpp/v1/cart/coupon' REST API endpoint is interpolated directly into a raw SQL query string within the `CouponCodes::find()` method without proper escaping or the use of `$wpdb->prepare()` or `esc sql()`. **Recommendations** Update the plugin to a version later than 6.2.0. As a temporary mitigation, restrict access to the '/wp-json/wpdmpp/v1/cart/coupon' endpoint or avoid using the `code` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Podlove Podcast Publisher versions prior to 4.5.2 **Description** Missing file type validation in the `podlove handle cache files()` function allows unauthenticated attackers to upload arbitrary files to the server. This flaw in the image cache can lead to remote code execution, where an attacker can execute malicious commands on the affected system. **Recommendations** Update Podlove Podcast Publisher to version 4.5.2 or later.

**Name of the Vulnerable Software and Affected Versions** Gravity Forms versions prior to 2.9.22 **Description** The Gravity Forms plugin for WordPress is susceptible to arbitrary file uploads because of inadequate file type validation within the legacy chunked upload mechanism. The extension blacklist does not include .phar files, allowing unauthenticated attackers to upload executable .phar files. Successful exploitation requires the web server to be configured to process .phar files as PHP. This could lead to remote code execution on the server if an attacker can determine the upload path. **Recommendations** Update Gravity Forms to version 2.9.22 or later.

**Name of the Vulnerable Software and Affected Versions** Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent versions up to and including 1.1.32 **Description** The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is susceptible to arbitrary file uploads. This is due to a lack of file type validation within the `set featured image from external url()` function. This allows unauthenticated attackers to upload arbitrary files to the affected server. In configurations where unauthenticated users have the ability to add featured images, this could lead to remote code execution. **Recommendations** Versions up to and including 1.1.32: Update to a version beyond 1.1.32.

**Name of the Vulnerable Software and Affected Versions** PPOM – Product Addons & Custom Fields for WooCommerce versions up to and including 33.0.15 **Description** The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is susceptible to arbitrary file uploads. This is due to a lack of file type validation within the image cropper functionality. Unauthenticated attackers can exploit this to upload arbitrary files to the server, potentially leading to remote code execution. The issue specifically affected users with the paid version of the software installed and activated. **Recommendations** Update PPOM – Product Addons & Custom Fields for WooCommerce to version 33.0.16 or newer.

**Name of the Vulnerable Software and Affected Versions** PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress versions prior to 33.0.16 **Description** The software contains a SQL Injection flaw in the `PPOM Meta::get fields by id()` function. Insufficient escaping of user-supplied parameters and inadequate SQL query preparation allow unauthenticated attackers to inject additional SQL queries into existing queries, potentially extracting sensitive information from the database. This is exploitable when the Enable Legacy Price Calculations setting is enabled. **Recommendations** Update the PPOM – Product Addons & Custom Fields for WooCommerce plugin to version 33.0.16 or later.

**Name of the Vulnerable Software and Affected Versions** Gravity Forms versions prior to 2.9.21 **Description** The Gravity Forms plugin for WordPress contains a flaw that allows unauthenticated attackers to upload arbitrary files to the server. This issue is caused by missing file type validation within the `copy post image()` function, which could lead to remote code execution. This risk specifically affects sites where the `allow url fopen` setting is enabled, the post creation form is active, and a file upload field for the post is configured. **Recommendations** Update the plugin to a version newer than 2.9.20. As a temporary mitigation, disable the `copy post image()` function or set `allow url fopen` to `Off` in the server configuration.