Wesley

Sensitive information exposure occurs because the `W3TC DYNAMIC SECURITY` constant is hardcoded to a publicly known value. This allows unauthenticated attackers to obtain the W3 Total Cache mfunc security key. If W3 Total Cache is also installed, this exposure may enable arbitrary PHP code injection, which is the execution of unauthorized PHP scripts on the server.

The plugin is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a logged-in user into performing actions they did not intend. This occurs because the `/install plugin` and `/activate plugin` REST API endpoints use ` return true` as the `permission callback`, which bypasses the standard nonce verification (a unique token used to prevent CSRF) in the WordPress REST API. While internal `current user can()` checks are present, the lack of nonce verification allows a forged request from an administrator's browser to pass these checks using the administrator's session cookies, enabling unauthenticated attackers to install arbitrary plugins.

The RTMKit (rometheme-for-elementor) plugin for WordPress contains a Local File Inclusion flaw. This occurs because the `render templates` AJAX endpoint does not properly validate the `template` parameter before using it in a require/include statement. Authenticated users with Contributor-level access or higher can exploit this to include and execute any server files ending in templates.php, leading to the execution of arbitrary PHP code.

The RTMKit plugin for WordPress contains an incorrect authorization flaw. The 'get submission content' AJAX endpoint does not perform a capability check to verify if a user is authorized to access specific form submission data. Consequently, authenticated attackers with Contributor-level access or higher can view arbitrary form submissions from other users by iterating the `entries id` parameter.

The plugin is susceptible to time-based SQL Injection, a technique where an attacker sends queries that force the database to wait a specific amount of time before responding, allowing them to infer data. This occurs due to insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. Unauthenticated attackers can append additional SQL queries to existing ones to extract sensitive information from the database via the `wpmlsubscriber id` parameter.

Name of the Vulnerable Software and Affected Versions W3 Total Cache versions up to and including 2.9.3 Description The W3 Total Cache plugin for WordPress is susceptible to information disclosure. The plugin bypasses its output buffering and processing when the User-Agent header contains "W3 Total Cache", leading to the rendering of raw mfunc/mclude dynamic fragment HTML comments, including the `W3TC DYNAMIC SECURITY` security token, in the page source. This allows unauthenticated attackers to discover the value of the `W3TC DYNAMIC SECURITY` constant by sending a crafted User-Agent header to pages with enabled fragment caching. Recommendations Update W3 Total Cache to a version later than 2.9.3.

The WP-WebAuthn plugin for WordPress is susceptible to Unauthenticated Stored Cross-Site Scripting through the `wwa auth` API endpoint. This is due to inadequate input sanitization and output escaping of user-supplied attributes when the plugin logs data. An unauthenticated attacker can inject arbitrary web scripts into pages, which will execute when a user accesses the plugin’s log page, provided logging is enabled in the plugin settings.

The software is susceptible to authentication bypass through brute-force attacks. This is caused by a weak One-Time Password (OTP) generation process, utilizing only six numeric digits with a ten-minute validity period and lacking rate limiting on verification attempts. An attacker knowing a target’s phone number can potentially bypass authentication as any user, including administrators, if the target does not promptly notice or disregard the SMS notification containing the OTP.

The GSheetConnector For Gravity Forms plugin for WordPress is susceptible to an authorization bypass. This occurs because of a missing capability check on the `install plugin` function. Attackers with subscriber-level access or higher can install plugins on the target site, potentially leading to arbitrary code execution on the server.

The software is susceptible to Cross-Site Request Forgery due to inadequate nonce validation in the `activate plugin` and `deactivate plugin` functions. This allows attackers to potentially trick authenticated administrators into activating or deactivating plugins through a forged request, such as a malicious link or compromised webpage.

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress has a flaw that allows arbitrary file deletion through renaming due to inadequate file path validation within the `set user profile image` function. This enables unauthenticated attackers to delete files on the server, potentially leading to remote code execution if critical files, such as wp-config.php, are removed.

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is susceptible to a Local File Inclusion issue in versions up to and including 6.6.7. This allows unauthenticated attackers to include and execute arbitrary .php files on the server through the `mode` parameter. Successful exploitation could allow attackers to bypass access controls, obtain sensitive data, or execute PHP code if .php file uploads are permitted.

The LatePoint plugin for WordPress has a flaw that allows bypassing authentication. This is due to inadequate identity verification within the `steps load step` route of the `latepoint route call` API endpoint. The endpoint processes client-supplied customer email and related fields before invoking the internal login handler without verifying login status, capability checks, or a valid AJAX nonce. This allows unauthenticated attackers to log into any customer’s account. The vulnerable API endpoint is `/latepoint route call`. The vulnerable parameter is `customer email`.

The software is susceptible to Cross-Site Request Forgery due to the absence of nonce validation. This occurs on the `change password()` function within the `customer cabinet change password` AJAX route. The plugin utilizes `wp ajax` and `wp ajax nopriv` hooks for this endpoint without verifying a nonce or user capability before allowing password resets. This allows unauthenticated attackers to potentially take over accounts by tricking logged-in customers, or administrators with “WP users as customers” enabled, into visiting a malicious link.

The Kubio AI Page Builder plugin for WordPress is susceptible to unauthorized plugin installation due to a missing capability check on the `kubio-image-hub-install-plugin` AJAX action. This allows authenticated attackers with Subscriber-level access or higher to install the Image Hub plugin.

The WP Legal Pages plugin for WordPress is susceptible to unauthorized access of functionality due to a missing capability check on the `wplp gdpr install plugin ajax handler()` function. This allows authenticated attackers with Contributor-level access or higher to install arbitrary repository plugins.

The Blaze Demo Importer plugin for WordPress is susceptible to unauthorized limited plugin installation due to a missing capability check within the `blaze demo importer install plugin` function. This allows authenticated attackers with Subscriber-level access or higher to install and activate a limited set of specific plugins. The News Kit Elementor Addons plugin and a BlazeThemes theme must be installed and activated for exploitation.

Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the `bdfe install activate rswpbs only()` function. This allows unauthenticated attackers to install the 'rs-wp-books-showcase' plugin by tricking a site administrator into clicking a malicious link. Nonce validation is a security measure used to ensure that a request was intentionally sent by the user and not forged by a third party.

Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the `zoho flow deactivate plugin()` function. This allows unauthenticated attackers to modify typography settings by tricking a site administrator into clicking a malicious link.

The LWSCache plugin for WordPress is susceptible to unauthorized data modification because of insufficient authorization within the `lwscache activatePlugin()` function. This allows authenticated attackers with Subscriber-level access or higher to activate any whitelisted LWS plugins.