0Xd4Rk5Id3

**Name of the Vulnerable Software and Affected Versions** Checkout Field Editor for WooCommerce (Pro) versions prior to 3.7.8 **Description** The plugin is subject to Directory Traversal, a flaw that allows an attacker to access files and directories that are stored outside the web root folder. Authenticated users with subscriber-level access or higher can exploit this by manipulating the `thwcfe legacy file` parameter to read arbitrary files on the server, potentially exposing sensitive information. **Recommendations** Update Checkout Field Editor for WooCommerce (Pro) to version 3.7.8 or later. As a temporary mitigation, restrict access to the `thwcfe legacy file` parameter.

**Name of the Vulnerable Software and Affected Versions** Bricksforge versions prior to 3.1.8.7 **Description** The Bricksforge plugin for WordPress contains a privilege escalation flaw. The issue stems from improper validation of the `fieldIds` parameter within the Pro Forms registration action. This allows unauthenticated attackers to add attacker-supplied field IDs to the trusted form-field whitelist. By submitting a crafted request to a publicly accessible Bricksforge Pro Forms registration form, an attacker can register a new administrator account. This exploitation is possible if the site has a public Bricksforge Pro Forms element configured with the User Registration action. **Recommendations** Update to version 3.1.8.7 or later. Restrict public registration forms to minimize the risk of exploitation. Audit administrator accounts for unauthorized entries.

**Name of the Vulnerable Software and Affected Versions** Divi Form Builder versions prior to 5.1.9 **Description** Missing authorization allows authenticated attackers with subscriber-level access or higher to perform a complete account takeover. The issue occurs because the `update user()` function accepts a user ID parameter from form submissions without verifying if the authenticated user has permission to edit that specific account. Additionally, the `handle register submission()` function only checks if a user is logged in rather than validating permissions for the target user. This enables the modification of email addresses and passwords for any account, including administrators. **Recommendations** Update Divi Form Builder to version 5.1.9 or later.

**Name of the Vulnerable Software and Affected Versions** Themify Popup versions prior to 1.4.4 **Description** Deserialization of untrusted data in the plugin allows for Object Injection. This occurs when the application deserializes data from an untrusted source without sufficient validation, potentially allowing an attacker to inject malicious PHP objects into the application state. **Recommendations** Update to a version newer than 1.4.3.

**Name of the Vulnerable Software and Affected Versions** Divi Form Builder versions prior to 5.1.9 **Description** Insufficient file extension validation in the `do image upload()` function allows unauthenticated attackers to perform arbitrary file uploads, leading to Remote Code Execution. The issue occurs because user-supplied input from the `acceptFileTypes` POST parameter is directly interpolated into a regular expression used for validation. Attackers can bypass `.htaccess` protections by using PHP-executable extensions such as `.phtml`, `.phar`, `.php5`, or `.php7`. On Nginx-based servers, the `.htaccess` protection is entirely ineffective. An attacker can obtain a nonce from any public page containing a form to upload executable PHP files to the `/wp-content/uploads/de fb uploads/` directory and execute them via HTTP. **Recommendations** Update Divi Form Builder to version 5.1.9 or later. As a temporary mitigation, restrict access to the `/wp-content/uploads/de fb uploads/` directory to prevent the execution of uploaded files.

**Name of the Vulnerable Software and Affected Versions** PrivateContent versions prior to 9.9.2 **Description** An incorrect privilege assignment in LCweb PrivateContent enables privilege escalation, allowing a user to gain higher levels of access than intended. **Recommendations** Update PrivateContent to version 9.9.2 or later.

**Name of the Vulnerable Software and Affected Versions** Dokan Pro versions prior to 5.0.5 **Description** The plugin contains a privilege escalation flaw within the 'update capabilities' REST endpoint. The `update capabilities()` REST handler fails to implement allowlist validation when processing capability strings from the request body, passing them directly to the `WP User::add cap()` function. This allows authenticated attackers with Vendor-level access or higher, on sites where the Vendor Staff module is active, to assign arbitrary WordPress capabilities, such as administrator privileges, to any `vendor staff` account, potentially resulting in a complete site takeover. **Recommendations** Update to version 5.0.5 or later. Restrict access to the 'update capabilities' REST endpoint to minimize the risk of exploitation.

Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate < 6.7.7 versions.

Unauthenticated Cross Site Scripting (XSS) in WPJobster <= 6.3.5 versions.

Unauthenticated SQL Injection in WPJobster <= 6.3.5 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in WordPress Dating Theme <= 11.2.0 versions.

Unauthenticated Broken Access Control in WordPress Dating Theme <= 11.2.0 versions.

Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions.

Subscriber Arbitrary File Download in Woocommerce Book Price <= 1.3 versions.

Subscriber Broken Access Control in WishList Member X <= 3.29.0 versions.

Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions.

**Name of the Vulnerable Software and Affected Versions** WP Media folder Addon versions 4.0.1 and earlier **Description** An unauthenticated arbitrary file download issue exists, allowing an attacker to download files from the server without providing credentials. **Recommendations** Update WP Media folder Addon to a version later than 4.0.1.

**Name of the Vulnerable Software and Affected Versions** User Registration Stripe versions prior to 1.3.13 **Description** Unauthenticated broken access control allows unauthorized users to bypass security restrictions within the plugin. **Recommendations** Update to a version later than 1.3.12.

**Name of the Vulnerable Software and Affected Versions** Directorist Social Login versions prior to 2.1.4 **Description** Incorrect Privilege Assignment in Directorist Social Login allows for Privilege Escalation, a condition where a user can gain higher levels of access or permissions than intended. **Recommendations** Update to version 2.1.4.

**Name of the Vulnerable Software and Affected Versions** Directorist Booking versions prior to 3.0.2 **Description** Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) allows an attacker to interfere with the queries that an application makes to its database. This can lead to unauthorized access to sensitive data or modification of database records. **Recommendations** Update to version 3.0.2 or later.