Thinnawarth Mathuros

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Authentication Library for JavaScript allows an unauthorized attacker to perform spoofing over a network.

An issue exists where authenticated users with Author-level access and above can gain unauthorized access to data. This occurs because the `get all values()` function in the '/wp-json/acf-field-blocks/v1/values' REST endpoint lacks a proper capability check. While the `permission callback` verifies the `publish posts` capability, the handler passes a user-supplied `id` parameter directly to `get field objects()` without confirming if the user is authorized to read the target object. Consequently, attackers can read ACF field values from arbitrary posts, including drafts, private posts, and posts created by other users.

The WP-Members Membership Plugin for WordPress stores user-uploaded files in predictable directories (`wp-content/uploads/wpmembers/user files/<user id>/`) without sufficient access controls. This allows unauthenticated attackers to directly access and download sensitive documents uploaded by site users by guessing or enumerating `user id`s and filenames. Basic directory listing protection (.htaccess with Options -Indexes) is insufficient to prevent access.

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is susceptible to unauthorized modification and deletion of data. This is due to a lack of appropriate capability checks on several REST API endpoints. Authenticated attackers possessing Subscriber-level access or higher can exploit this to perform actions such as uploading or deleting arbitrary media files, modifying or deleting posts, and creating or managing course templates.

The Events Manager plugin for WordPress is susceptible to information disclosure. Insufficient restrictions on location inclusion within the `get location` action allow unauthenticated attackers to access data from event locations that should be protected, including those that are password-protected, private, or in draft status.

The software is susceptible to a Cross-Site Request Forgery (CSRF) issue. This is caused by inadequate or missing nonce validation on the `location delete` action. An unauthenticated attacker could potentially delete locations by exploiting this flaw, provided they can trick a site administrator into performing an action, such as clicking a malicious link.

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress has a flaw related to file uploads. An incorrect capability check within the `uploadVideo()` function allows authenticated attackers with Subscriber-level access or higher to upload mp4 files to the 'wp-content/uploads/<YYYY>/<MM>/' directory.