Zickzick2

An issue in Windows Remote Desktop Services allows an authorized attacker to disclose sensitive system information over a network to an unauthorized control sphere.

Weak authentication in the Windows App Readiness Service allows an authorized attacker to perform local tampering, which can enable them to affect the system.

An issue exists where authenticated users with subscriber-level access and above can perform a generic SQL Injection. This occurs due to insufficient escaping of the `description` parameter and a lack of preparation in the SQL query. An attacker can append additional SQL queries to extract sensitive information from the database. Exploitation requires an administrator to perform the plugin's standard local database export and restore operation on the site, as the attacker cannot trigger the process independently.

Authenticated attackers with subscriber-level access and above can perform a time-based SQL Injection. This occurs due to insufficient escaping of the user-supplied `id` parameter and a lack of sufficient preparation of the SQL query. Attackers can append additional SQL queries to extract sensitive information from the database. An attacker can obtain the necessary nonce and `subscriberauth` cookie without a pre-existing WordPress account by subscribing via the public newsletter form and accessing the management link sent by email, as the ownership check only verifies the `subscriber id` field and fails to validate if the injected `id` parameter belongs to the authenticated subscriber.

An authentication bypass exists due to SSO Email-Collision Account Binding. When no contact-ID mapping is found during an SSO login, the plugin uses a network-global `get user by('email', ...)` lookup in `Module.php` to resolve a WordPress user. Subsequently, `UserSynchronizer::syncWaContact()` binds the account and `Controller::login()` issues a session cookie via `wp set auth cookie()` without requiring proof of ownership, such as a password or inbox verification. This allows an attacker with a WildApricot contact email matching a target WordPress administrator's email to obtain a network-global authentication cookie and gain administrator access on a path-based Multisite network.

Stored DOM-Based Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. This requires a site administrator to have configured a public map using the [leaflet-map]+[leaflet-geojson]+[choropleth] shortcode combination with a GeoJSON src URL controlled by the attacker, such as through a compromised external data host or subdomain takeover. The issue is triggered via the `feature.properties[<template-token>]` parameter.

Stored Cross-Site Scripting occurs via the 'Last referrers' meta box on the plugin's Overview admin page. The issue arises because the `newstatpress generate overview lastreferrers()` function fails to properly escape the visitor-supplied query string stored in the statistics table. Specifically, the `urlrequested` variable is concatenated into a single-quoted href attribute using only FILTER SANITIZE URL, which does not encode apostrophes. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a high-privileged user, such as an administrator, accesses the Overview page and hovers over the injected link.

The plugin is subject to time-based SQL Injection, a technique where an attacker sends a query that forces the database to wait a specific amount of time before responding, allowing them to infer data. This occurs due to insufficient escaping of user-supplied input and lack of preparation in the SQL query. Unauthenticated attackers can append malicious SQL queries to extract sensitive information from the database. The issue is accessible via the unauthenticated mobile app endpoint, which executes the library action without validating the Mobile App feature flag, a nonce, or WordPress authentication, requiring no account or session for exploitation. The vulnerable parameter is `gmedia in`.

Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This occurs via the `custom text attribute (user-defined field name)` parameter. The issue is exploitable when an administrator configures a Text attribute with a display format that places the `%value%` token inside an HTML attribute. This allows the injection of arbitrary web scripts that execute when a user accesses the affected page.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue occurs via the `attachments[name]` parameter, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page.

An unauthenticated SQL Injection exists due to insufficient escaping of user-supplied input and lack of proper preparation of the SQL query. This allows attackers to append additional SQL queries to existing ones to extract sensitive information from the database. The issue is triggered via the `booking[service id]` parameter.

Insufficient file path validation in the `extract()` function allows unauthenticated attackers to delete arbitrary files on the server. This issue can lead to remote code execution if critical files, such as `wp-config.php`, are deleted. Exploitation is possible provided that at least one File-type custom field is published on the confirmation page shortcode, as this configuration is not active by default.

The WP Directory Kit plugin for WordPress contains a SQL Injection flaw. Authenticated attackers with custom-level access or higher can exploit this by manipulating the `data fields list` parameter. The issue stems from insufficient escaping of user-supplied input and a lack of proper preparation of the SQL query, allowing attackers to append malicious queries to extract sensitive information from the database.

An authentication bypass exists in the `login customer after checkout` function via the `checkout form` parameter. The issue occurs because the publicly accessible `wu ajax nopriv wu validate form` AJAX handler accepts a freely obtainable checkout nonce. When the `checkout form` parameter is set to `wu-finish-checkout`, the `get validation rules()` function discards all validation rules and `finish checkout form fields()` returns an empty step list, causing `is last step()` to return true. This routes the request directly to order processing, where `maybe create customer()` resolves an attacker-supplied `email address` to an existing WordPress user ID without authentication. Subsequently, `login customer after checkout()` executes `wp set auth cookie()` for that user ID through a passwordless path. This allows unauthenticated attackers to log in as any WordPress user, including a Network Super Admin, provided the target account has no pre-existing Ultimate Multisite customer record.

Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This is achieved by manipulating the `display name` parameter via the '/wp-admin/profile.php' endpoint and the `bbp reply content` parameter via the bbPress reply form. To bypass WordPress's wpautop/wptexturize processors, which normally neutralize attribute-injection by converting double quotes into curly-quote entities, the attacker must wrap the crafted reply in a <pre> block. This allows the injection of arbitrary web scripts that execute when a user accesses the affected page.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue occurs via the Multiple Choice 'Other' value, enabling the injection of arbitrary web scripts. These scripts execute within the context of the WordPress admin results view, primarily targeting administrators who review submitted form entries.

The Security Hardener plugin for WordPress contains a missing authorization flaw. The issue occurs because the user-enumeration protection, enabled by default, uses the `secure user endpoints()` function to hook the `rest endpoints` filter. This process overwrites the `permission callback` for all handlers on the '/wp/v2/users' and '/wp/v2/users/{id}' endpoints—including POST, PUT, PATCH, and DELETE methods—with a closure that only checks if a user is logged in via `is user logged in()`. Consequently, original WordPress Core capability checks such as `create users`, `promote user`, `edit users`, and `delete users` are removed. This allows authenticated users with Subscriber-level access or higher to create new Administrator accounts via POST requests to '/wp/v2/users' or reset Administrator passwords via PUT/POST requests to '/wp/v2/users/{id}'.

The StoreEngine plugin for WordPress contains a directory traversal flaw within the `parse file path()` function. This issue allows authenticated users with vendor-level permissions or higher to read arbitrary files on the server, potentially exposing sensitive information.

Authenticated users with subscriber-level access or higher can escalate their privileges to Administrator. The issue stems from missing authorization checks and nonce verification (a unique token used to prevent cross-site request forgery) in the `get user()` function of the `Module Password Hint` class. This function calls `WP User::set role()` using the `role` parameter provided by the attacker for any account identified via `$ POST['user login']`, without verifying if the requester has the authority to assign roles. An attacker can exploit this by sending a crafted POST request to the password-reset form endpoint with the `action` parameter set to `createuser` and the `role` parameter set to `administrator`, provided they possess a valid password-reset cookie.