Yu-Sheng Yu

**Name of the Vulnerable Software and Affected Versions** Advanced Contact Form 7 - Compact DB versions prior to 1.0.1 **Description** Unauthenticated attackers can delete arbitrary contact form submission entries stored in the `wp cf7cdb data` table. This occurs because the `cf7cdb ajax delete user()` function lacks nonce verification, capability checks, and ownership validation. The handler is registered for both `wp ajax cf7cdb delete` and `wp ajax nopriv cf7cdb delete` endpoints, allowing the deletion of data by iterating through sequential primary-key IDs provided as an integer ID. **Recommendations** Update Advanced Contact Form 7 - Compact DB to a version newer than 1.0.0.

**Name of the Vulnerable Software and Affected Versions** Kargo Takip versions prior to 1.3 **Description** The Kargo Takip plugin for WordPress contains a Server-Side Request Forgery (SSRF) issue. This allows unauthenticated attackers to initiate web requests to arbitrary locations from the web application, which can be used to query and modify information from internal services. The issue occurs via the `api url` parameter. The script returns internal API response data, specifically the value of any `auth` key in a JSON response body, directly to the attacker's browser. This enables the exfiltration of responses from internal services, such as cloud instance metadata endpoints. **Recommendations** Update to a version later than 1.2. As a temporary workaround, restrict access to the `api url` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** URL Preview plugin for WordPress versions prior to 1.1 **Description** The plugin is susceptible to Server-Side Request Forgery (SSRF), a flaw where an attacker can force the server to make requests to an unintended location. Unauthenticated attackers can leverage the `url` parameter to make web requests to arbitrary locations originating from the web application, which may be used to query and modify information from internal services. **Recommendations** Update the plugin to a version later than 1.0. As a temporary workaround, restrict access to or avoid using the `url` parameter until the update is applied.