Muhammad Sharief

Author Broken Access Control in W3 Total Cache <= 2.9.1 versions.

**Nome do Software Vulnerável e Versões Afetadas** Mercado Pago payments for WooCommerce versões anteriores a 8.7.12 **Descrição** O plugin Mercado Pago payments for WooCommerce para WordPress permite o acesso não autorizado a dados devido à ausência de uma verificação de capacidade no endpoint de API 'mp pix image'. Isso permite que atacantes não autenticados recuperem imagens de códigos QR de pagamento PIX de pedidos arbitrários. Essas imagens contêm informações confidenciais do comerciante, incluindo chaves PIX (que podem ser identificadores pessoais CPF/CNPJ), valores de transação, nome e cidade do comerciante e referências de transação do MercadoPago. **Recomendações** Atualize o plugin para uma versão posterior à 8.7.11. Como medida paliativa temporária, restrinja o acesso ao endpoint de API 'mp pix image' para minimizar o risco de exploração.

The OneSignal – Web Push Notifications plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete OneSignal metadata for arbitrary posts.

**Name of the Vulnerable Software and Affected Versions** Appointment Booking Calendar — Simply Schedule Appointments versions through 1.6.9.29 **Description** The Appointment Booking Calendar — Simply Schedule Appointments plugin for WordPress is susceptible to unauthorized access of sensitive data. This occurs because a `public nonce` not tied to a specific user is exposed to unauthenticated users through the `/wp-json/ssa/v1/embed-inner` REST endpoint. Additionally, the `get item()` method within `SSA Settings Api` utilizes `nonce permissions check()` for authorization, which accepts this public nonce, but fails to call `remove unauthorized settings for current user()` to filter restricted fields. This allows unauthenticated attackers to access administrator-only plugin settings, including the administrator's email address, phone number, internal access tokens, notification configurations, and developer settings via the `/wp-json/ssa/v1/settings/{section}` endpoint. Exposure of appointment tokens also enables attackers to modify or cancel appointments. **Recommendations** Versions through 1.6.9.29 should be updated to a newer, fixed version. As a temporary workaround, consider restricting access to the `/wp-json/ssa/v1/embed-inner` endpoint. Additionally, temporarily disable the `SSA Settings Api` module if possible.

**Name of the Vulnerable Software and Affected Versions** weForms versions up to and including 1.6.27 **Description** The weForms plugin for WordPress is susceptible to Stored Cross-Site Scripting through the REST API entry submission endpoint. This occurs because of inconsistent input sanitization between the frontend AJAX handler and the REST API endpoint. When entries are submitted via the REST API, the `prepare entry()` method in `class-abstract-fields.php` receives the WP REST Request object as `$args`, bypassing the sanitization process applied to `$ POST` data for frontend submissions. The base field handler only applies `trim()` to the value. This allows authenticated attackers with Subscriber-level access or higher to inject malicious web scripts into form entry hidden field values via the REST API endpoint: `/wp-json/weforms/v1/forms/{id}/entries/`. These scripts execute when an administrator views the form entries page, where data is rendered using a Vue.js `v-html` directive without proper escaping. **Recommendations** Update weForms to a version later than 1.6.27.

**Name of the Vulnerable Software and Affected Versions** Media Library Assistant plugin for WordPress versions prior to 3.34 **Description** The software is susceptible to unauthorized data modification because of a missing capability check within the `mla update compat fields action()` function. Authenticated attackers possessing Subscriber-level access or higher can alter taxonomy terms associated with arbitrary attachments. **Recommendations** Update the Media Library Assistant plugin to version 3.34 or later.