Winrace

**Name of the Vulnerable Software and Affected Versions** Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin versions prior to 1.6.11.9 **Description** Missing authorization in the bulk appointments REST API endpoint allows unauthenticated attackers to modify arbitrary appointment records. This includes the ability to change customer PII (Personally Identifiable Information), payment status, and meeting URL fields. Additionally, full customer PII can be exposed through the bulk endpoint response. The issue stems from the use of a public nonce—a static, user-independent security token—found in the HTML source of pages using the `[ssa booking]` shortcode, which allows any visitor to bypass authentication. **Recommendations** Update the plugin to a version newer than 1.6.11.8.

**Name of the Vulnerable Software and Affected Versions** LearnPress – WordPress LMS Plugin for Create and Sell Online Courses versions prior to 4.3.6 **Description** Improper handling of user-supplied request parameters in the REST API endpoint allows authenticated attackers with subscriber-level access and above to bypass payment requirements. The issue occurs because an unsanitized parameter array is passed to the `add to cart()` function, where `array merge()` enables attacker-controlled values to overwrite hardcoded defaults. By supplying a `quantity` value of zero, an attacker can cause the order total to be calculated as $0, allowing them to enroll in paid courses for free. **Recommendations** Update to a version later than 4.3.5.