Zickzick2

**Name of the Vulnerable Software and Affected Versions** Security Hardener versions prior to 2.4.5 **Description** The Security Hardener plugin for WordPress contains a missing authorization flaw. The issue occurs because the user-enumeration protection, enabled by default, uses the `secure user endpoints()` function to hook the `rest endpoints` filter. This process overwrites the `permission callback` for all handlers on the '/wp/v2/users' and '/wp/v2/users/{id}' endpoints—including POST, PUT, PATCH, and DELETE methods—with a closure that only checks if a user is logged in via `is user logged in()`. Consequently, original WordPress Core capability checks such as `create users`, `promote user`, `edit users`, and `delete users` are removed. This allows authenticated users with Subscriber-level access or higher to create new Administrator accounts via POST requests to '/wp/v2/users' or reset Administrator passwords via PUT/POST requests to '/wp/v2/users/{id}'. **Recommendations** Update the Security Hardener plugin to a version newer than 2.4.4. As a temporary mitigation, disable the `block user enum` option to prevent the overwrite of the permission callbacks.

**Name of the Vulnerable Software and Affected Versions** StoreEngine versions prior to 2.1.2 **Description** The StoreEngine plugin for WordPress contains a directory traversal flaw within the `parse file path()` function. This issue allows authenticated users with vendor-level permissions or higher to read arbitrary files on the server, potentially exposing sensitive information. **Recommendations** Update the plugin to a version newer than 2.1.1. As a temporary mitigation, restrict access to the `parse file path()` function for users with vendor-level permissions.

**Name of the Vulnerable Software and Affected Versions** WP Password Policy versions prior to 3.7.2 **Description** Authenticated users with subscriber-level access or higher can escalate their privileges to Administrator. The issue stems from missing authorization checks and nonce verification (a unique token used to prevent cross-site request forgery) in the `get user()` function of the `Module Password Hint` class. This function calls `WP User::set role()` using the `role` parameter provided by the attacker for any account identified via `$ POST['user login']`, without verifying if the requester has the authority to assign roles. An attacker can exploit this by sending a crafted POST request to the password-reset form endpoint with the `action` parameter set to `createuser` and the `role` parameter set to `administrator`, provided they possess a valid password-reset cookie. **Recommendations** Update to a version newer than 3.7.1. As a temporary mitigation, restrict access to the password-reset form endpoint to prevent unauthorized role assignments.