Wordfence Argus

A heap-based buffer overflow occurs in the `unc decoder mixed interleave::processTile()` function. This issue is triggered when a HEIF file is processed with chroma components of unequal bit depths, such as 16-bit Cb and 8-bit Cr. This allows an attacker to perform out-of-bounds writes past the Cr plane, which could lead to arbitrary code execution within image-processing pipelines.

An Insecure Direct Object Reference occurs due to missing validation on a user-controlled key. Unauthenticated attackers can delete arbitrary saved drafts of other users and take over those draft identifiers by overwriting them with attacker-controlled form submissions. This exploitation requires the attacker to obtain a victim's `draft id`, which can be harvested from a shared "continue later" link. The nonce check is bypassed because the nonce is publicly obtainable by any unauthenticated visitor loading a form page. The issue is triggered via the `previous draft id` parameter.

An unauthenticated PHP Object Injection exists due to the deserialization of untrusted database content within the `unserializeTest()` function of the `DUPX UpdateEngine` class during migration. Attackers can store a serialized object in public site content which is then processed when an administrator builds a package and performs a migration or import involving database search-and-replace. In the free version, a Requests 1.7 POP chain allows for direct operating-system command execution via attacker-selected callbacks. In the Pro version, an `IndexList` destructor gadget enables the deletion of a specific file if the directory is writable by the installer PHP process; for instance, deleting `wp-config.php` can trigger the setup wizard, potentially leading to site takeover and code execution if the attacker provides a database they control.

An authorization bypass exists due to improper verification before dispatching a WordPress action hook. The issue occurs when the hook name is derived from an attacker-supplied form-field value via the notification `email message` [field] placeholder and the `{action hook,...}` dynamic-data token. This allows unauthenticated attackers to invoke arbitrary WordPress action hooks, which can lead to permanent destruction of site content, such as the deletion of trashed posts, pages, and comments through the `wp scheduled delete` action. Additionally, it can cause denial of service via `wp maybe auto update` or enable privileged writes if vulnerable third-party handlers are present. The same pipeline allows for a blind arbitrary user or post-meta read, although the result is only delivered to the site owner. Exploitation requires a published Avada form with AJAX submission and a notification template containing an `[all fields]` or explicit `[field]` placeholder.

Stored Cross-Site Scripting occurs due to insufficient authorization, input sanitization, and output escaping in the Popup Builder's `save popup content` AJAX action. Unauthenticated attackers can inject arbitrary web scripts via the `content` parameter into a published Gutenberg popup. These scripts execute when a user visits a page where the popup is configured to display. This issue requires a valid premium license, the Popup Builder module, and at least one published Gutenberg popup configured for display.

A heap-based buffer overflow exists in the JPEG 2000 output adapter within the `base/sjpx openjpeg.c` file. The issue occurs when processing a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. In such cases, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth. This results in memory corruption of internal chunk-allocator metadata, which can lead to a process crash or remote code execution.

Unauthenticated attackers can achieve Remote Code Execution on the server due to insufficient protection in the `is safe widget instance()` function. The issue arises because PHP magic methods are triggered during pre-parse, and the `enable rendering widget copied()` function can forge a valid `wp hash` integrity attribute before the `unserialize()` function is reached. This allows for PHP Object Injection. The flaw is exploitable when comments are enabled and visible on events, as the V2 single-event template processes `do blocks()` over buffered comment HTML. An unauthenticated commenter can use a moderation-hash URL to view their pending comment immediately, delivering injected block markup to the vulnerable code path before moderation occurs.

Unauthenticated attackers can achieve Remote Code Execution on the server through the `parse array()` function in `Element Classes::parse array()`. The issue stems from insufficient validation of the widget `classes` map, which allows a plain-array payload to bypass the `is safe widget instance()` object check and reach a callable-invocation sink. This attack chain is triggered when `do blocks()` processes the single-event HTML including the comment area. Successful exploitation requires that the site has comments enabled on `tribe events` posts and that a comment containing a crafted `wp:legacy-widget` block has been submitted.

The Tutor LMS plugin for WordPress is affected by a PHP Object Injection issue that can lead to remote code execution on over 100,000 sites worldwide. The flaw exists in the `tutor save withdraw account` AJAX handler via the `withdraw method field` parameter. The handler lacks proper capability or role checks, relying only on a nonce. The issue occurs because `esc sql()` is misapplied to values stored via `update user meta()`, causing a serialization length desynchronization where the serialized string length is 65 bytes larger than the actual content. This allows `unserialize()` to over-read into attacker-controlled POST keys and inject an arbitrary serialized object stream. Attackers with subscriber-level access or higher can trigger the `GuzzleHttpCookieFileCookieJar` POP chain (Property-Oriented Programming) via the `spl autoload register` loader in `TUTORRestAPI`, enabling them to write arbitrary content to a file on the server. This can be exploited by unauthenticated users if user registration and the monetization feature are enabled.

An arbitrary file upload issue exists affecting over 1 million WordPress installations. The flaw originates from insufficient validation of the multi-file upload chunk state within the `GFAsyncUpload::upload()` function. Specifically, a cryptographic domain-confusion flaw occurs because `wp hash()` is reused without context separation for both public form state and chunk-continuation authentication, allowing attackers to reuse a legitimate URL hash to authenticate malicious upload requests. Unauthenticated attackers can exploit this when a public form has a File Upload field with Multiple Files enabled by uploading a PNG or PDF polyglot—a file that is valid in two different formats—to a filename of their choice, such as `.php` or `.html`, in the temporary upload directory. This can lead to remote code execution on systems using NGINX or other web servers that do not respect `.htaccess` files. On servers where PHP execution is blocked, such as Apache, uploading an HTML file can result in stored same-origin cross-site scripting (XSS), which occurs when a malicious script is permanently stored on the server and executed in the victim's browser.

An authentication bypass exists in the Hub Single Sign-On (SSO) flow, potentially affecting an estimated 350,000 WordPress sites. The issue stems from HMAC canonicalization confusion—a protocol design failure where the signer and verifier disagree on the message structure—between two unauthenticated AJAX endpoints: 'wdpsso step1' and 'wdpsso step2'. In 'wdpsso step1', the system signs a concatenation of `token`, `state`, `redirect`, and `domain` without delimiters. However, 'wdpsso step2' verifies a concatenation that omits the `domain` field. An attacker can use 'wdpsso step1' as a signing oracle by providing an empty `redirect` value to obtain a valid HMAC for the combined `token`, `state`, and `domain`. By replaying this HMAC to 'wdpsso step2' and moving the `domain` value into the `redirect` field, the resulting byte string remains identical, causing the verification to succeed. This allows an unauthenticated attacker to obtain an authenticated administrator session if Hub SSO is enabled and mapped to an administrator. If the WordPress theme or plugin editor is accessible, this can lead to full site takeover and remote code execution via PHP modification.

An unauthenticated attacker can achieve remote code execution and complete site compromise by writing attacker-controlled PHP files to the server. This is possible through a six-stage chain of weaknesses involving authorization, input validation, trust boundaries, privileged behavior, and file handling across the theme and its required plugin. Successful exploitation requires both the theme and the plugin to be installed and active, as well as the presence of certain administrator-authored content. Over 1 million sites are potentially affected.