Hunter Jensen

**Nome do Software Vulnerável e Versões Afetadas** Open User Map PRO versões anteriores a 1.4.32 **Description** O plugin Open User Map PRO para WordPress contém um problema de Cross-Site Scripting Armazenado. Isso ocorre devido à sanitização de entrada e escape de saída insuficientes envolvendo o parâmetro `oum location notification`. Atacantes não autenticados podem explorar isso para injetar scripts web arbitrários em páginas, que são executados quando um usuário acessa a página afetada. **Recommendations** Atualize para uma versão posterior a 1.4.31. Como medida paliativa temporária, restrinja ou desabilite o uso do parâmetro `oum location notification` para minimizar o risco de exploração.

The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.4.2.6. The plugin protects its entire /wp-json/pos-bridge/* REST API namespace through the oliver pos rest authentication() permission callback, which uses a loose PHP comparison (==) to compare the attacker-supplied 'OliverAuth' header value against the 'oliver pos authorization token' option. On fresh installations where the admin has not yet completed the connection flow, this option is unset (get option returns false). Due to PHP's type juggling, the loose comparison '0' == false evaluates to true, allowing an unauthenticated attacker to bypass authentication by sending 'OliverAuth: 0'. This grants full access to all POS API endpoints, enabling attackers to read user data (including administrator details), update user profiles (including email addresses), and delete non-admin users. An admin account email reset can lead to site takeover.

**Nome do Software Vulnerável e Versões Afetadas** AWP Classifieds versões anteriores a 4.4.6 **Descrição** A sanitização insuficiente de parâmetros fornecidos pelo usuário e a falta de preparação adequada em consultas SQL permitem que atacantes não autenticados anexem consultas SQL adicionais. Este problema ocorre por meio das chaves do array do parâmetro `regions`, permitindo a extração de informações sensíveis do banco de dados. **Recomendações** Atualize para uma versão posterior à 4.4.5. Evite usar o parâmetro `regions` até que a atualização seja aplicada.

**Nome do Software Vulnerável e Versões Afetadas** User Registration & Membership plugin for WordPress versões anteriores a 5.1.5 **Descrição** A ausência de uma verificação de capacidade na função `embed form action()` permite que atacantes autenticados com nível de acesso de Colaborador (Contributor) ou superior realizem a modificação não autorizada de dados. Esta falha permite que esses usuários anexem conteúdo de shortcode a páginas arbitrárias que eles não possuem ou não têm permissão para editar. **Recomendações** Atualize o plugin para a versão 5.1.5 ou posterior. Como medida paliativa temporária, restrinja o acesso à função `embed form action()` para usuários com permissões de nível de Colaborador.

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authorization checks in the `save course content order()` private method, which is called unconditionally by the `tutor update course content order` AJAX handler. While the handler's `content parent` branch includes a `can user manage()` check, the `save course content order()` call processes attacker-supplied `tutor topics lessons sorting` JSON without any ownership or capability verification. This makes it possible for authenticated attackers with Subscriber-level access or above to detach lessons from topics, reorder course content, and reassign lessons between topics in any course, including admin-owned courses, by sending a crafted AJAX request with manipulated topic and lesson IDs.

Name of the Vulnerable Software and Affected Versions MainWP Child Reports versões até e incluindo 2.2.6 Description O plugin MainWP Child Reports para WordPress possui uma verificação de autorização ausente na função `heartbeat received()` dentro da classe Live Update. Isso permite que invasores autenticados com acesso de nível de Assinante ou superior recuperem entradas de log de atividade do MainWP Child Reports, incluindo resumos de ações, informações do usuário, endereços IP e dados contextuais, por meio da API Heartbeat do WordPress, enviando uma solicitação heartbeat criada com a chave de dados `wp-mainwp-stream-heartbeat`. Recommendations Atualize o MainWP Child Reports para uma versão posterior à 2.2.6.

**Name of the Vulnerable Software and Affected Versions** Amelia Booking plugin for WordPress versions up to 9.1.2 **Description** The Amelia Booking plugin for WordPress is susceptible to Insecure Direct Object References. The plugin allows user-controlled access to objects, potentially enabling a user to bypass authorization and access system resources. Authenticated attackers with customer-level permissions or above may be able to change user passwords and potentially gain control of administrator accounts. The issue exists in the pro plugin. **Recommendations** Update the Amelia Booking plugin to a version later than 9.1.2.

**Name of the Vulnerable Software and Affected Versions** Masteriyo LMS plugin for WordPress versions prior to 2.1.7 **Description** The Masteriyo LMS plugin for WordPress is susceptible to a privilege escalation issue. An authenticated attacker with Student-level access or higher can elevate their privileges to that of an administrator. This is possible due to the plugin allowing a user to update their user role through the `InstructorsController::prepare object for database` function. The vulnerable API endpoint is not explicitly mentioned. The vulnerable parameter is not explicitly mentioned. **Recommendations** Update the Masteriyo LMS plugin to version 2.1.7 or later.

**Name of the Vulnerable Software and Affected Versions** Expire Users plugin for WordPress versions through 1.2.2 **Description** The Expire Users plugin for WordPress is susceptible to a privilege escalation issue. This occurs because the plugin permits a user to modify the `on expire default to role` meta data through the `save extra user profile fields` function. Authenticated attackers possessing Subscriber-level access or higher can exploit this to elevate their privileges to administrator level. **Recommendations** Versions prior to and including 1.2.2 should be updated to a newer, fixed version when available.

**Name of the Vulnerable Software and Affected Versions** Calculated Fields Form plugin for WordPress versions up to and including 5.4.5.0 **Description** The Calculated Fields Form plugin for WordPress is susceptible to Stored Cross-Site Scripting through the form settings. This is caused by inadequate capability checks during the form settings save process and insufficient sanitization of the `fcontent` field within `fhtml` field types. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which will execute when a user accesses the affected page. The vulnerable component is the form settings save handler. The vulnerable parameter is `fcontent`. **Recommendations** Update the Calculated Fields Form plugin to a version later than 5.4.5.0.