Thevietronin

The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable when the [mpg spintax] shortcode is rendered in site-wide content such as a footer or template part, as the vulnerable code path is only reached when the shortcode is active on the requested page.

**Name of the Vulnerable Software and Affected Versions** Frontend Admin by DynamiApps versions prior to 3.29.13 **Description** An authentication bypass allows unauthenticated attackers to take over accounts. The issue occurs because the `pre update value` function lacks capability or ownership checks, and the `ActionPost::conditions logic()` function bypasses the `current user can('edit post')` authorization check when the post ID is non-numeric (for example, using the string `user 1`). This allows unauthenticated form submissions to be routed to arbitrary user records, enabling attackers to overwrite any user's registered email address, including administrators, and subsequently use the native password-reset process to gain full account access. **Recommendations** Update Frontend Admin by DynamiApps to a version newer than 3.29.12.

**Name of the Vulnerable Software and Affected Versions** Pods – Custom Content Types and Fields versions prior to 3.3.9.1 **Description** The Pods – Custom Content Types and Fields plugin for WordPress contains a privilege escalation flaw allowing unauthenticated attackers to gain Administrator privileges or overwrite any user account password, including the site owner's, leading to complete site takeover. The issue resides in the `pods admin` AJAX router, which handles security checks such as method allowlists, nonce verification, login enforcement, and capability gates through the `pods error()` function. Under the JSON `meta-box-loader` compatibility path, `pods error()` only logs failures to the PHP error log and returns false without terminating the request, allowing execution to continue to privileged API methods such as `save user()`. Over 100,000 active installations are potentially affected, and real-world incidents have been reported where attackers added unauthorized administrator users to websites. **Recommendations** Update the plugin to version 3.3.9.1 or the corresponding patched versions for older branches: 2.8.23.4, 2.9.19.4, 3.0.10.4, 3.1.4.2, or 3.2.8.3.

**Name of the Vulnerable Software and Affected Versions** TrueBooker – Appointment Booking and Scheduler System versions prior to 1.2.4 **Description** This issue allows unauthenticated attackers to perform an account takeover by exploiting improper password reset validation. The plugin fails to properly verify a user's identity during the password reset process, enabling attackers to reset passwords for arbitrary accounts, including those with administrator privileges. **Recommendations** Update TrueBooker – Appointment Booking and Scheduler System to version 1.2.4 or later.

**Name of the Vulnerable Software and Affected Versions** Uncanny Automator versions prior to 7.3.3 **Description** The Uncanny Automator plugin for WordPress contains a missing authorization flaw. Authenticated users with Subscriber-level access or higher can exploit this by sending requests to the `automator google contacts fetch labels`, `automator mautic segment fetch`, `automator mautic tags fetch`, and `automator mautic render contact fields` AJAX actions. The issue stems from a lack of capability checks and missing nonce verification (a security token used to prevent cross-site request forgery) in the `ajax fetch labels()`, `segments fetch()`, `tags fetch()`, and `render contact fields()` handlers. This allows attackers to enumerate sensitive Google Contacts groups and labels, as well as Mautic segments, tags, and contact-field definitions, using credentials configured by an administrator. Additionally, this can lead to the consumption of third-party API quotas. **Recommendations** Update the plugin to a version newer than 7.3.2.

**Name of the Vulnerable Software and Affected Versions** Web Directory Free versions prior to 1.7.14 **Description** The Web Directory Free plugin for WordPress contains a generic SQL Injection flaw. This issue occurs because the software fails to properly escape user-supplied input and lacks sufficient preparation of the SQL query. Unauthenticated attackers can exploit this by appending malicious SQL queries via the `levels` parameter to extract sensitive information from the database. **Recommendations** Update the plugin to a version newer than 1.7.13. As a temporary mitigation, restrict or disable the use of the `levels` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell versions prior to 3.12.8 **Description** Unauthenticated attackers can achieve Remote Code Execution by sending unsanitized values through the `postData` parameter. The plugin writes these values into a PHP-includeable .log file, which is later rendered using the `include once` function within `wpfnl show log()`. For successful exploitation, the Log Settings Enable Logs toggle must be active, and an administrator must view the polluted log file via the Log Settings View UI. The nonce required to reach the endpoint is publicly available on every funnel step page, allowing the initial injection to be performed without authentication. **Recommendations** Update the plugin to version 3.12.8 or later. Disable the Enable Logs toggle in Log Settings as a temporary mitigation measure.

**Name of the Vulnerable Software and Affected Versions** Branda plugin for WordPress versions prior to 3.4.30 **Description** The plugin is susceptible to privilege escalation through account takeover. This occurs because the software fails to properly validate a user's identity before updating a password, allowing unauthenticated attackers to change the passwords of arbitrary users, including administrators, to gain unauthorized account access. **Recommendations** Update the plugin to a version later than 3.4.29.

**Name of the Vulnerable Software and Affected Versions** GiveWP versions prior to 4.14.6 **Description** Improper neutralization of input during web page generation in Liquid Web / StellarWP GiveWP allows for DOM-Based Cross-site Scripting (XSS), a flaw where the application contains client-side JavaScript that processes data from an untrusted source in an unsafe way, typically by writing the data to a dangerous sink. **Recommendations** Update to a version newer than 4.14.5.

**Name of the Vulnerable Software and Affected Versions** Classified Listing versions prior to 5.3.9 **Description** An improper limitation of a pathname to a restricted directory, known as Path Traversal, allows for arbitrary file download. This occurs when the application fails to properly validate user-supplied input used to construct a file path, enabling access to files outside the intended directory. **Recommendations** Update to a version newer than 5.3.8.

**Name of the Vulnerable Software and Affected Versions** myCred versions prior to 3.0.5 **Description** Improper neutralization of input during web page generation allows for stored Cross-site Scripting (XSS), a condition where malicious scripts are permanently stored on the target server and executed in the browser of users who view the affected page. **Recommendations** Update to a version newer than 3.0.4.

**Name of the Vulnerable Software and Affected Versions** WeGIA versions prior to 3.5.1 **Description** WeGIA is a Web Manager for Institutions. A SQL Injection issue exists in the `/html/funcionario/cadastro funcionario pessoa existente.php` API endpoint, specifically affecting the `cpf` parameter. Successful exploitation allows attackers to execute arbitrary SQL commands, potentially compromising the database's confidentiality, integrity, and availability. **Recommendations** Update to version 3.5.1 or later.

**Name of the Vulnerable Software and Affected Versions** WeGIA versions prior to 3.5.1 **Description** WeGIA is a Web Manager for Institutions. A SQL Injection issue exists in the `/html/funcionario/dependente listar.php` API endpoint, specifically through the `id funcionario` parameter. Successful exploitation allows attackers to execute arbitrary SQL commands, potentially compromising the database's confidentiality, integrity, and availability. **Recommendations** Update to version 3.5.1 or later.

**Name of the Vulnerable Software and Affected Versions** WeGIA versions prior to 3.5.1 **Description** WeGIA is a web management application for institutions. A Reflected Cross-Site Scripting (XSS) issue exists in the `/html/atendido/cadastro atendido parentesco pessoa nova.php` API endpoint. Attackers can inject malicious scripts through the `idatendido` parameter. **Recommendations** Update to version 3.5.1 or later.

**Name of the Vulnerable Software and Affected Versions** The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress versions up to, and including, 2.2.8 **Description** The issue is related to Insecure Direct Object Reference, which allows authenticated attackers with Subscriber-level access and above to remove profile photos from users' accounts via the `deleteUserPhoto()` function. This is due to missing validation on a user-controlled key. The attack does not officially delete the file. **Recommendations** For versions up to, and including, 2.2.8, consider disabling the `deleteUserPhoto()` function until a patch is available to prevent exploitation. Restrict access to the `deleteUserPhoto()` function to minimize the risk of unauthorized profile photo removal.

Name of the Vulnerable Software and Affected Versions: reNgine versions up to and including 2.20 Description: An unrestricted project deletion vulnerability in reNgine allows attackers with specific roles, such as `penetration tester` or `auditor`, to delete all projects in the system. This can lead to a complete system takeover by redirecting the attacker to the onboarding page, where they can add or modify users, including Sys Admins, and configure critical settings like API keys and user preferences. Recommendations: For versions up to and including 2.20, update to version 2.21 to resolve the issue. As a temporary workaround, consider restricting access to the `penetration tester` and `auditor` roles to minimize the risk of exploitation. Restrict access to the onboarding page to prevent attackers from adding or modifying users and configuring critical settings. Avoid using the vulnerable project deletion feature until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress versions up to, and including, 2.2.6 **Description** The issue is related to an Insecure Direct Object Reference vulnerability. This vulnerability is due to the lack of validation on a user-controlled key in the `deleteCompanyLogo()` function. As a result, unauthenticated attackers can delete arbitrary company logos. **Recommendations** For versions up to, and including, 2.2.6, update to a version higher than 2.2.6 to resolve the issue. As a temporary workaround, consider disabling the `deleteCompanyLogo()` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress versions up to, and including, 2.2.6 **Description** The issue is related to Insecure Direct Object Reference, which affects the plugin due to missing validation on a `key` controlled by the user. This allows authenticated attackers with Employer-level access and above to delete other users' companies via the `enforcedelete()` function. **Recommendations** For versions up to, and including, 2.2.6, consider disabling the `enforcedelete()` function until a patch is available to prevent unauthorized deletion of companies. Restrict access to the `enforcedelete()` function to minimize the risk of exploitation. Avoid using the `key` variable in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress versions up to, and including, 2.2.6 **Description** The issue concerns an Insecure Direct Object Reference vulnerability. This vulnerability arises due to missing validation on a user-controlled key, specifically through the `getresumefiledownloadbyid()` and `getallresumefiles()` functions. As a result, unauthenticated attackers can download users' resumes without proper authorization. **Recommendations** For versions up to, and including, 2.2.6, update to a version higher than 2.2.6 to resolve the issue. As a temporary workaround, consider disabling the `getresumefiledownloadbyid()` and `getallresumefiles()` functions until a patch is available. Restrict access to resume download functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress versions up to, and including, 2.2.6 **Description** The issue is related to Insecure Direct Object Reference, which allows authenticated attackers with employer-level access and above to delete arbitrary data. This is possible due to missing validation on a user-controlled key via the `jobenforcedelete` endpoint. **Recommendations** For versions up to, and including, 2.2.6, consider disabling the `jobenforcedelete` endpoint until a patch is available to prevent arbitrary deletion of data. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using the `jobenforcedelete` endpoint with user-controlled input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.