Prickly Cactus

**Nome do Software Vulnerável e Versões Afetadas** Slider Revolution versões 7.0.0 a 7.0.14 **Description** Existe um problema onde atacantes autenticados com nível de acesso de Colaborador ou superior podem extrair dados sensíveis. Isso é realizado por meio da Ação AJAX 'slider.get.full', permitindo a recuperação de credenciais de API de redes sociais armazenadas nas configurações do slider, especificamente o `Instagram OAuth token`, `Flickr API key`, `YouTube Data API key` e `Facebook App ID`. **Recommendations** Atualize o Slider Revolution para uma versão posterior à 7.0.14. Como medida paliativa temporária, restrinja o acesso à Ação AJAX 'slider.get.full' para usuários com permissões de Colaborador.

**Name of the Vulnerable Software and Affected Versions** Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder versões anteriores a 6.1.22 **Description** Uma Referência Direta a Objeto Insegura (IDOR) existe devido à falta de validação de autorização e propriedade em uma chave controlada pelo usuário no endpoint AJAX de confirmação do Stripe SCA. Isso permite que atacantes não autenticados modifiquem o status de pagamento de envios pendentes específicos, como alterar o status para "failed", manipulando o parâmetro `submission id`. **Recommendations** Atualize o plugin para uma versão posterior a 6.1.21. Evite usar o parâmetro `submission id` no endpoint AJAX de confirmação do Stripe SCA até que a atualização seja aplicada.

**Name of the Vulnerable Software and Affected Versions** Fluent Forms Pro versions up to and including 6.1.17 **Description** The Fluent Forms Pro plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `fluentform step form save data` AJAX action. The draft form submission endpoint is publicly accessible without authentication or nonce verification. Insufficient input sanitization and output escaping of form field data allows unauthenticated attackers to inject arbitrary web scripts. These scripts execute when an administrator views a partial form entry. **Recommendations** Fluent Forms Pro versions prior to 6.1.17 should be updated.

**Name of the Vulnerable Software and Affected Versions** Fluent Forms Pro Add On Pack versions up to and including 6.1.17 **Description** The Fluent Forms Pro Add On Pack plugin for WordPress has a missing authorization issue. The `deleteFile()` method within the `Uploader` class does not properly verify nonces or check user capabilities. An AJAX action is publicly registered, creating both `wp ajax ` and `wp ajax nopriv ` hooks. This allows unauthenticated attackers to delete arbitrary WordPress media attachments by manipulating the `attachment id` parameter. The vulnerability is exploitable through the `attachment id` parameter, not the `path` parameter as initially reported. **Recommendations** Update Fluent Forms Pro Add On Pack to a version later than 6.1.17.

**Name of the Vulnerable Software and Affected Versions** Fluent Forms Pro Add On Pack for WordPress versions through 6.1.17 **Description** The software contains a flaw related to insufficient verification of data authenticity. Specifically, PayPal IPN (Instant Payment Notification) verification is disabled by default, with the `disable ipn verification` setting defaulting to `'yes'` in the `PayPalSettings.php` file. This allows unauthenticated attackers to send fraudulent PayPal IPN notifications to the publicly accessible IPN endpoint. Successful exploitation can mark unpaid form submissions as "paid," triggering subsequent post-payment automation, such as emails, access grants, and digital product delivery. The API endpoint involved is the publicly accessible IPN endpoint. The vulnerable parameter is the forged PayPal IPN notification data. **Recommendations** Versions prior to 6.1.17 should be updated to address this issue.