Teerachai Somprasong

The plugin contains a flaw allowing unauthenticated attackers to perform unauthorized arbitrary file uploads. This occurs because the `wp save signature image()` function lacks a proper capability check, enabling the upload of arbitrary content to the WordPress uploads directory disguised as png files.

Authenticated attackers with contributor-level access and above can extract sensitive data from arbitrary CRM contact records. This is achieved by enumerating the `contact id` parameter, which leads to the exposure of full names, email addresses, phone numbers, mobile numbers, fax numbers, and physical addresses.

The ShopLentor plugin for WordPress allows arbitrary function execution through the 'woolentoropt/v1/custom-action' REST API endpoint. The issue occurs because the `handle action()` method passes user-supplied input to the `call user func()` function without validating it against an allowlist of permitted callbacks. Consequently, authenticated attackers with Administrator-level access or higher can execute arbitrary PHP callable functions by manipulating the `callback` parameter.

The plugin contains a missing authentication flaw in the REST API webhook endpoint "/wp-json/strabl/webhook/order". The endpoint uses a `permission callback` set to ` return true`, allowing all requests to bypass authentication and authorization checks. Because there is no shared secret, signature validation, HMAC verification, or token-based authentication, unauthenticated users can perform several unauthorized actions. These include creating fraudulent WooCommerce orders and marking them as completed by setting the `paymentStatus` variable to `paid`, manipulating order statuses via the `externalOrderId` variable, creating new WordPress user accounts with the customer role, issuing refunds, cancelling orders, and applying chargeback fees.

The plugin fails to properly verify if a user is authorized to perform specific actions, leading to an authorization bypass. This allows authenticated attackers with subscriber-level access or higher to access arbitrary private `alba card` post data, such as titles, descriptions, assignees, due dates, tags, and comments, which should be restricted to Administrators and Editors. Because the handler is registered via the `wp ajax nopriv ` hook and its nonce is exposed to all site visitors through `wp localize script` on pages containing the `[alba board]` shortcode, the issue is also exploitable by unauthenticated users who can access those pages.

The plugin is subject to sensitive information exposure via the 'ttp get accounts' AJAX action. The `get accounts()` function lacks authorization checks and nonce verification, allowing authenticated attackers with Subscriber-level access or higher to retrieve the full contents of the `ttp tiktok accounts` WordPress option. This includes sensitive TikTok OAuth credentials, specifically `access token` and `refresh token` values from administrator-connected accounts, which can be used to impersonate the site owner when interacting with the TikTok API.

Insufficient file ownership validation in the 'maxi remove custom image size' AJAX action allows authenticated attackers with Author-level access or higher to delete arbitrary media files within the `wp-content/uploads` directory. This includes files uploaded by other users and administrators.

The Age Verification & Identity Verification by Token of Trust plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping within the `description` parameter. Unauthenticated attackers can exploit this to inject arbitrary web scripts into pages, which then execute when a user accesses the affected page.

The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is susceptible to SQL Injection via the `search` parameter. Insufficient escaping of user-supplied input and inadequate preparation of existing SQL queries allow unauthenticated attackers to inject additional SQL queries, potentially extracting sensitive information from the database.

The ShopLentor plugin is susceptible to Email Relay Abuse due to insufficient validation of input parameters. Specifically, the `send to`, `product title`, `wlmessage`, and `wlemail` parameters within the `woolentor suggest price action` API endpoint are not properly validated. This allows unauthenticated attackers to leverage the website as an email relay for malicious purposes, such as spam or phishing campaigns. Attackers gain full control over the email subject line, message content, and sender address through CRLF injection within the `wlemail` parameter.

The Invoct – PDF Invoices & Billing for WooCommerce plugin for WordPress has a flaw that allows unauthorized access to data. This is due to a missing capability check in multiple functions. Authenticated attackers with Subscriber-level access or higher can retrieve invoice clients, invoice items, and a list of WordPress users along with their email addresses.

The software is susceptible to a sensitive information exposure issue. Unauthenticated attackers can extract the site's `magicimport.ai` license key from the page source on any page containing the plugin's shortcode through the `get frontend settings()` function.

The software is susceptible to unauthorized data modification because of a missing authorization check within the `ajax sync usage()` function. This allows unauthenticated attackers to alter the plugin’s license status and credit balance.

The plugin has an authorization bypass due to missing capability checks on the CSV export functionality. This allows unauthenticated attackers to download sensitive form submission data, including personally identifiable information (PII), by accessing the CSV export endpoint. The export key needed for this access is exposed in the publicly accessible page source code. The CSV export handler bypasses user permission filtering, exporting all entries regardless of user roles.

The Integrate Dynamics 365 CRM plugin for WordPress is susceptible to Stored Cross-Site Scripting through admin settings. Insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with Administrator-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.

The RepairBuddy plugin for WordPress is susceptible to Insecure Direct Object Reference. This is due to the absence of appropriate capability checks within the `wc upload and save signature handler` function. Authenticated attackers possessing Subscriber-level access or higher can upload arbitrary signatures to any order, potentially altering order metadata and causing unauthorized status modifications.

The WP-CRM System plugin for WordPress is susceptible to unauthorized access because of absent capability checks within the `wpcrm get email recipients` and `wpcrm system ajax task change status` AJAX functions. This allows authenticated attackers possessing subscriber-level access or higher to enumerate CRM contact email addresses, resulting in potential PII disclosure, and to modify CRM task statuses.

The iPaymu Payment Gateway for WooCommerce plugin for WordPress is susceptible to missing authentication. This occurs because the plugin does not validate the authenticity of webhook requests through signature verification or origin checks. An unauthenticated attacker can send crafted POST requests to the webhook endpoint to falsely mark WooCommerce orders as paid, without actual payment. Additionally, attackers can enumerate order IDs and obtain valid order keys via GET requests, potentially exposing customer Personally Identifiable Information (PII) such as names, addresses, and purchased products. The vulnerable function is `check ipaymu response`.