Vaibhav Narkhede

An unauthenticated AJAX action fails to perform authorization or visibility checks when returning team member records by ID. This allows unauthenticated attackers to enumerate and disclose sensitive information, such as email addresses and phone numbers, of team members that the administrator has not published publicly.

The plugin fails to perform capability, nonce, or session checks on a public AJAX action, specifically within the `formychat get gf entry()` function. This allows unauthenticated users to read submitted entries from any form created with a supported third-party form. A nonce is a unique token used to prevent replay attacks by ensuring that a request is intentional and comes from a trusted source.

The plugin fails to exclude registered account email addresses from the structured data output on public pages by default. This allows unauthenticated visitors to obtain the email addresses of any user who has published content.

An authorization bypass exists in the public submission handler that allows unauthenticated users to retrieve the full stored configuration of a form. This can lead to the disclosure of sensitive information, such as notification recipient addresses, confirmation redirect targets, and integration settings, including data from forms that have not been published.

The plugin fails to verify the status of a document before generating a download token and streaming the file. This allows unauthenticated attackers to download arbitrary documents, including those marked as private or drafts, by enumerating document IDs.

An authorization check is missing on a REST route that returns stored account data. This allows unauthenticated visitors to retrieve the connected service's API secret and account details, which can subsequently be used to disconnect the plugin's integration.

An issue exists where the plugin fails to properly verify if a customer portal session has completed its confirmation step before returning data. This allows unauthenticated users to access and read the subscription and billing information of other customers.

The plugin fails to perform a capability check on certain endpoints of a public AJAX action, specifically within the `kirki get apis` function. This allows unauthenticated users to retrieve email addresses of registered users and comment authors, along with non-public page content and settings.

An issue exists where the plugin fails to perform capability or ownership checks on the reservation-status update action. This action is exposed to unauthenticated users and is protected only by a nonce (a number used once to prevent replay attacks) that is publicly available to visitors, allowing unauthenticated attackers to modify the status of arbitrary reservations.

The plugin fails to perform capability or nonce checks on a public REST endpoint action. This allows unauthenticated users to delete generated album export ZIP archives stored by the system via the `delexportzips` action. A nonce is a unique token used to prevent replay attacks by ensuring that a request is intentional and comes from a trusted source.

Insufficient access control in a REST endpoint allows users with the Contributor role or higher to save arbitrary global CSS. This stored CSS is rendered site-wide on the front end, which can lead to defacement, content hiding, and UI redressing (a technique used to trick a user into performing an action in a different application than the one they intended).

Insufficient sanitization of uploaded SVG and SVGZ files allows authenticated users with the `upload files` capability (Author level and above) to upload files containing malicious JavaScript. This leads to Stored Cross-Site Scripting, where arbitrary web scripts are injected into pages and execute whenever a user accesses the affected page.

An issue exists where a user-search handler is not properly restricted to users authorized to list users. This allows any authenticated user with Contributor-level access or higher to retrieve the email addresses of all registered users, including administrators, via the `geodir json search users` function.

An unauthenticated user can upload arbitrary files because the plugin fails to validate the type, extension, content, or size of files submitted to its public response endpoint. These files are stored in the uploads directory. Since the original extension is discarded and files are stored using a bare UUID (Universally Unique Identifier), this issue does not allow for code execution or stored XSS (Cross-Site Scripting). The impact is limited to content hosting and disk consumption. This issue requires the channel's response storage or mail-forwarding to be configured.

An issue exists where the plugin fails to perform capability checks or nonce validation—a security mechanism used to prevent cross-site request forgery—on an AJAX action used to process payment capture refunds. This allows any authenticated user, including those with Subscriber privileges, to trigger refunds for captured orders.

Upon activation, the plugin grants support-agent capabilities to the Contributor role. Additionally, it fails to perform a capability check on a user-listing handler, which allows users with Contributor-level privileges to enumerate the email addresses of all registered WordPress users.

Insufficient administrative capability requirements for the dashboard template-import action allow users with `edit posts` permissions, such as Contributors, to import templates. An attacker can include an Elementor HTML widget configured for site-wide display to inject JavaScript that executes in the session of any visitor or administrator who loads the site.

An issue exists in an administration search feature that fails to perform per-user read-capability checks on returned results. This allows users with low-privilege roles, such as Contributor, to disclose non-public content that is normally restricted, including unpublished post titles from other authors, pending comment content, user account names, and the plugin inventory.

The Decent Comments WordPress plugin fails to restrict access to comment author and post author email addresses through its REST API endpoint. This allows unauthenticated attackers to enumerate the email addresses of registered users.