Wordfence Argus

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is safe widget instance function. This is due to insufficient protection in is safe widget instance, which can be bypassed because PHP fires magic methods during its pre-parse, combined with enable rendering widget copied() forging a valid wp hash integrity attribute before unserialize() is reached. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable without authentication or approval because the plugin's V2 single-event template runs do blocks() over buffered comment HTML, and WordPress returns a moderation-hash URL that allows an unauthenticated commenter to immediately view their own pending comment, delivering the injected block markup to the vulnerable code path before any moderation occurs. This does require comments to be enabled and visible on events.

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is safe widget instance() object check and reach the callable-invocation sink in Element Classes::parse array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do blocks() processes the single-event HTML including the comment area.

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withdraw method field` parameter of the `tutor save withdraw account` AJAX handler. This is due to the handler lacking any capability or role check, relying solely on a nonce, while also passing attacker-supplied values through `esc sql()`, which replaces every `%` character with a 66-byte HMAC placeholder token before the data is serialized and stored via `update user meta()`; when the meta is later retrieved, the placeholder is collapsed back to a single `%`, leaving serialized string length declarations 65 bytes greater than the actual content, and because array keys originate from entirely unescaped POST field names, `unserialize()` over-reads into attacker-controlled bytes, allowing injection of an arbitrary serialized object stream. This makes it possible for authenticated attackers, with subscriber-level access and above, to achieve remote code execution on the server by triggering the `GuzzleHttpCookieFileCookieJar` POP chain, reachable via the `spl autoload register` loader in `TUTORRestAPI` which loads the plugin's own bundled PayPal Composer autoloader, writing attacker-controlled content to an attacker-specified filename. This has an unauthenticated pathway when user registration is enabled, which is common for students and teachers to register, and it requires the monetization feature to be enabled.

**Name of the Vulnerable Software and Affected Versions** Gravity Forms versions prior to 3.0.3 **Description** An arbitrary file upload issue exists affecting over 1 million WordPress installations. The flaw originates from insufficient validation of the multi-file upload chunk state within the `GFAsyncUpload::upload()` function. Specifically, a cryptographic domain-confusion flaw occurs because `wp hash()` is reused without context separation for both public form state and chunk-continuation authentication, allowing attackers to reuse a legitimate URL hash to authenticate malicious upload requests. Unauthenticated attackers can exploit this when a public form has a File Upload field with Multiple Files enabled by uploading a PNG or PDF polyglot—a file that is valid in two different formats—to a filename of their choice, such as `.php` or `.html`, in the temporary upload directory. This can lead to remote code execution on systems using NGINX or other web servers that do not respect `.htaccess` files. On servers where PHP execution is blocked, such as Apache, uploading an HTML file can result in stored same-origin cross-site scripting (XSS), which occurs when a malicious script is permanently stored on the server and executed in the victim's browser. **Recommendations** Update Gravity Forms to a version newer than 3.0.2. As a temporary mitigation, disable the Multiple Files option in File Upload fields on all public forms.

**Name of the Vulnerable Software and Affected Versions** WPMU DEV Dashboard versions prior to 5.0.2 **Description** An authentication bypass exists in the Hub Single Sign-On (SSO) flow, potentially affecting an estimated 350,000 WordPress sites. The issue stems from HMAC canonicalization confusion—a protocol design failure where the signer and verifier disagree on the message structure—between two unauthenticated AJAX endpoints: 'wdpsso step1' and 'wdpsso step2'. In 'wdpsso step1', the system signs a concatenation of `token`, `state`, `redirect`, and `domain` without delimiters. However, 'wdpsso step2' verifies a concatenation that omits the `domain` field. An attacker can use 'wdpsso step1' as a signing oracle by providing an empty `redirect` value to obtain a valid HMAC for the combined `token`, `state`, and `domain`. By replaying this HMAC to 'wdpsso step2' and moving the `domain` value into the `redirect` field, the resulting byte string remains identical, causing the verification to succeed. This allows an unauthenticated attacker to obtain an authenticated administrator session if Hub SSO is enabled and mapped to an administrator. If the WordPress theme or plugin editor is accessible, this can lead to full site takeover and remote code execution via PHP modification. **Recommendations** Update WPMU DEV Dashboard to version 5.0.2. As a temporary workaround, disable Hub SSO.

**Name of the Vulnerable Software and Affected Versions** Avada versions prior to 7.16.1 Fusion Builder versions prior to 3.16.1 **Description** An unauthenticated attacker can achieve remote code execution and complete site compromise by writing attacker-controlled PHP files to the server. This is possible through a six-stage chain of weaknesses involving authorization, input validation, trust boundaries, privileged behavior, and file handling across the theme and its required plugin. Successful exploitation requires both the theme and the plugin to be installed and active, as well as the presence of certain administrator-authored content. Over 1 million sites are potentially affected. **Recommendations** Update Avada to version 7.16.1 or later. Update Fusion Builder to version 3.16.1 or later.