Yat Wu

**Name of the Vulnerable Software and Affected Versions** Offload, AI & Optimize with Cloudflare Images versions prior to 1.10.3 **Description** The Offload, AI & Optimize with Cloudflare Images plugin for WordPress allows authenticated attackers with author-level access and above to execute remote code on the server. The issue exists in the `cf images do setup()` AJAX handler, which incorrectly requires only the `upload files` capability instead of `manage options` before writing to the `wp-config.php` file. Because `sanitize text field()` does not strip single quotes and `filter input(INPUT POST)` bypasses `wp magic quotes()` slashing, a single quote in the `account-id` or `api-key` parameters can break out of the single-quoted PHP string literal in the `write config()` `define()` statement. Additionally, the `cf-images-nonce` nonce required by the handler is exposed to all users with author-level access or higher on `wp-admin/upload.php` via the `CFImages` JavaScript object. **Recommendations** Update the plugin to a version later than 1.10.2. As a temporary workaround, restrict access to the `cf images do setup()` AJAX handler or limit user permissions to prevent users with author-level access from reaching the `wp-admin/upload.php` page.

**Name of the Vulnerable Software and Affected Versions** WP User Manager – User Profile Builder & Membership versions prior to 2.9.18 **Description** The plugin is susceptible to Local File Inclusion, a condition where an application includes files on a local server unexpectedly. This occurs through the `profile template scope` function, allowing unauthenticated attackers to include and execute arbitrary .php files. This can lead to the execution of PHP code, bypassing of access controls, or the acquisition of sensitive data, particularly when .php files can be uploaded to the server. **Recommendations** Update the plugin to version 2.9.18 or later. As a temporary workaround, restrict access to the `profile template scope` function to minimize the risk of exploitation.