Andrea Bocchetti

The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and including, 2.0.0. This is due to the `ssoprocess ajax()` function — registered on `wp ajax nopriv ssoprocess ajax` and therefore reachable without authentication — accepting an attacker-supplied `email` parameter with the `setnewpassword` operation and calling `reset password()` on the resolved account without any ownership token, email confirmation link, or capability check. The sole guard is a call to `check ajax referer()`, which provides no authorization barrier because the `ssoajaxnonce` nonce is publicly broadcast on every front-end page via `wp localize script()` into the `SSOPWDREQUIREMENT` JavaScript object; since WordPress computes nonces for logged-out visitors against a shared anonymous session context, any unauthenticated visitor can scrape a valid nonce from the homepage and use it to authenticate the request. This makes it possible for unauthenticated attackers to change the password of any WordPress account, including administrator accounts, enabling complete site takeover.

**Name of the Vulnerable Software and Affected Versions** Super Forms – Drag & Drop Form Builder versions prior to 6.3.314 **Description** An arbitrary file upload issue exists due to missing file type validation and the absence of capability checks in the `submit form()` function within the nopriv AJAX handler. The security mechanism relies on a session nonce that can be easily obtained by unauthenticated visitors through the `super create nonce` nopriv AJAX action, which allows the generation of a valid `sf nonce` and session cookie. This flaw enables unauthenticated attackers to upload executable files, such as PHP web shells, leading to remote code execution. **Recommendations** Update Super Forms – Drag & Drop Form Builder to a version beyond 6.3.313.

The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 2.2.1. This is due to the plugin accepting the payment amount directly from user-controlled POST data in the 'create payment intent' and 'create subscription intent' functions without validating it against the form's configured price. This makes it possible for unauthenticated attackers to modify the payment amount to any arbitrary value when submitting a Stripe payment form, potentially purchasing products or services at significantly reduced prices.

**Name of the Vulnerable Software and Affected Versions** Cost Calculator Builder versions prior to 4.0.2 **Description** The plugin is susceptible to Unauthenticated Price Manipulation and Insecure Direct Object Reference (IDOR), which occurs when used in combination with Cost Calculator Builder PRO. The issue arises because the 'ccb woocommerce payment' AJAX action is registered via `wp ajax nopriv`, allowing unauthenticated access. Additionally, the `renderWooCommercePayment()` function passes user-controlled data to `CCBWooCheckout::init()` without performing authorization checks. This allows unauthenticated attackers to add WooCommerce products to their cart with prices they control. **Recommendations** Update to a version later than 4.0.1. As a temporary workaround, restrict access to the 'ccb woocommerce payment' AJAX action to authenticated users only.

**Name of the Vulnerable Software and Affected Versions** AAWP version 3.16 **Description** A reflected cross-site scripting issue exists where authenticated attackers can inject malicious scripts by manipulating the `tab` parameter. This occurs on the 'aawp-settings' admin page, allowing the execution of arbitrary JavaScript within the context of authenticated users. **Recommendations** As a temporary workaround, restrict access to the `tab` parameter on the 'aawp-settings' admin page to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Royal Elementor Addons versions prior to 1.7.1057 **Description** The Royal Elementor Addons plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping in the `wpr update form action meta` AJAX action via the `status` parameter. Additionally, a publicly leaked nonce allows unauthenticated access to the AJAX handler, enabling unauthenticated attackers to inject arbitrary web scripts into pages that execute when accessed by users. **Recommendations** Update the plugin to a version later than 1.7.1056.

The MetForm Pro plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 3.9.7 This is due to the payment integrations (Stripe/PayPal) trusting a user-submitted calculation field value without recomputing or validating it against the configured form price. This makes it possible for unauthenticated attackers to manipulate the payment amount via the 'mf-calculation' field in the form submission REST request granted there exists a specific form with this particular configuration.

Name of the Vulnerable Software and Affected Versions Elementor Website Builder – More Than Just a Page Builder plugin for WordPress versions through 3.35.5 Description The Elementor Website Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. Recommendations Update to a version later than 3.35.5

**Name of the Vulnerable Software and Affected Versions** MetForm Pro plugin for WordPress versions through 3.9.6 **Description** The MetForm Pro plugin for WordPress is susceptible to Stored Cross-Site Scripting through the Quiz feature. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into pages. These scripts will execute when a user accesses an injected page. **Recommendations** Update the MetForm Pro plugin to a version later than 3.9.6.

**Name of the Vulnerable Software and Affected Versions** wp.insider Simple Membership versions through 4.6.9 **Description** An authorization issue exists in wp.insider Simple Membership. The issue involves incorrectly configured access control security levels, potentially allowing unauthorized access. **Recommendations** Update to a version later than 4.6.9.

**Name of the Vulnerable Software and Affected Versions** Fluent Forms Pro Add On Pack versions prior to 6.1.13 **Description** The Fluent Forms Pro Add On Pack plugin for WordPress is susceptible to a Server-Side Request Forgery issue. This allows authenticated attackers with Subscriber-level access or higher to make web requests to arbitrary locations from the web application. Exploitation can enable querying and modification of information from internal services via the `saveDataSource` function. **Recommendations** Update Fluent Forms Pro Add On Pack to version 6.1.13 or later.

**Name of the Vulnerable Software and Affected Versions** JAY Login & Register plugin for WordPress versions prior to 2.6.04 **Description** The JAY Login & Register plugin for WordPress is susceptible to a privilege escalation issue. The plugin allows updating arbitrary user meta through the `jay login register ajax create final user` function, potentially enabling unauthenticated attackers to gain administrator privileges. **Recommendations** Update the JAY Login & Register plugin to version 2.6.04 or later.

**Name of the Vulnerable Software and Affected Versions** Infility Global plugin for WordPress versions prior to 2.14.46 **Description** The Infility Global plugin for WordPress is susceptible to unauthenticated SQL Injection through the '`infility get data`' API action. This is a result of inadequate escaping of user-supplied input and insufficient preparation of the SQL query. This allows unauthenticated attackers to potentially append additional SQL queries, and extract sensitive information from the database. **Recommendations** Update the Infility Global plugin to a version later than 2.14.46.

**Name of the Vulnerable Software and Affected Versions** All-in-One Video Gallery plugin for WordPress versions through 4.6.4 **Description** The All-in-One Video Gallery plugin for WordPress is susceptible to unauthorized data modification because of a missing capability check on the `ajax callback create bunny stream video`, `ajax callback get bunny stream video`, and `ajax callback delete bunny stream video` functions. This allows unauthenticated attackers to create and delete videos on the Bunny Stream CDN linked to the victim’s account, if they can acquire a valid nonce, which is present in public player templates. **Recommendations** Update to a version beyond 4.6.4.

**Name of the Vulnerable Software and Affected Versions** LearnPress – WordPress LMS Plugin versions prior to 4.3.2.5 **Description** The LearnPress WordPress LMS Plugin is affected by a sensitive information disclosure issue. Unauthenticated attackers can extract sensitive data, including user first names, last names, social profile links, and enrollment information, through the `get item permissions check` function. **Recommendations** Update LearnPress – WordPress LMS Plugin to version 4.3.2.5 or later.

**Advanced Custom Fields: Extended Plugin** Advanced Custom Fields: Extended versions up to and including 0.9.2.1 **Description** The Advanced Custom Fields: Extended plugin for WordPress has a flaw that allows unauthenticated attackers to gain administrator access. This is due to insufficient restrictions within the `insert user` function, which allows attackers to assign themselves the 'administrator' role during user registration, provided the 'role' parameter is mapped to a custom field. Approximately 100,000 websites are potentially affected. The issue can be exploited by submitting a crafted registration request. The `wp insert user()` function is abused to escalate privileges. The vulnerability allows for full site takeover, including the ability to upload malicious plugins and backdoors. A scanning campaign targeting WordPress plugins has been detected, potentially seeking to identify vulnerable sites. **Recommendations** Update to version 0.9.2.2 or later. Disable user registration until a patch is applied. Strip the role parameter from registration requests as a temporary mitigation. Review recent user registrations for unauthorized administrator accounts.

**Name of the Vulnerable Software and Affected Versions** Cost Calculator Builder plugin for WordPress versions prior to 3.7.0 **Description** The Cost Calculator Builder plugin for WordPress is susceptible to an unauthenticated payment status bypass. This occurs because the `complete payment` AJAX action is registered via `wp ajax nopriv`, allowing access to unauthenticated users. The `complete()` function only verifies a nonce, without checking user capabilities or order ownership. Nonces are exposed to all visitors via `window.ccb nonces` in the page source, enabling an attacker to mark any order's payment status as "completed" without actual payment. The issue requires the use of both Cost Calculator Builder and Cost Calculator Builder PRO. **Recommendations** Update the Cost Calculator Builder plugin to version 3.7.0 or later.

**Name of the Vulnerable Software and Affected Versions** Restrict Content plugin for WordPress versions prior to 3.2.17 **Description** The Restrict Content plugin for WordPress is affected by a missing authentication issue. This occurs due to a missing capability check within the `rcp stripe create setup intent for saved card` function. The plugin also fails to validate a user-controlled key, potentially allowing unauthenticated attackers to obtain Stripe SetupIntent client secret values for any membership. **Recommendations** Update to version 3.2.17 or later.

**Name of the Vulnerable Software and Affected Versions** Frontend Admin by DynamiApps versions through 3.28.25 **Description** The Frontend Admin by DynamiApps plugin for WordPress is affected by a missing authorization check, allowing unauthorized data modification and deletion. Specifically, a missing capability check on the `delete object` function enables unauthenticated attackers to delete arbitrary posts, pages, products, taxonomy terms, and user accounts. **Recommendations** Versions prior to and including 3.28.25 should be updated to a newer, fixed version.

**Name of the Vulnerable Software and Affected Versions** AMP for WP plugin for WordPress versions prior to 1.1.11 **Description** The AMP for WP plugin for WordPress is susceptible to Stored Cross-Site Scripting through SVG file uploads. Insufficient sanitization of SVG file content allows for the injection of malicious web scripts. Specifically, the sanitization process only removes `<script>` tags, while other XSS vectors, such as event handlers (onload, onerror, onmouseover), foreignObject elements, and SVG animation attributes, remain exploitable. Authenticated attackers with Author-level access or higher can upload malicious SVG files. These scripts execute whenever a user views the uploaded file. **Recommendations** Update the AMP for WP plugin to version 1.1.11 or later.