Aril Aprilio

**Name of the Vulnerable Software and Affected Versions** Tiny Bootstrap Elements Light versions through 4.3.34 **Description** The Tiny Bootstrap Elements Light plugin for WordPress is susceptible to a Local File Inclusion issue via the `language` parameter. This allows unauthenticated attackers to include and execute arbitrary .php files on the server, potentially enabling the execution of PHP code within those files. Successful exploitation could lead to bypassing access controls and obtaining sensitive data. **Recommendations** Update Tiny Bootstrap Elements Light to a version later than 4.3.34.

**Name of the Vulnerable Software and Affected Versions** Bei Fen – WordPress Backup Plugin versions through 1.4.2 **Description** The Bei Fen – WordPress Backup Plugin for WordPress is susceptible to Local File Inclusion through the `task` parameter. Attackers with Subscriber-level access or higher can include and execute arbitrary .php files on the server. This could allow bypassing access controls, obtaining sensitive data, or achieving code execution if .php file uploads and inclusion are permitted. This issue affects systems running PHP 7.1 or older. **Recommendations** Update Bei Fen – WordPress Backup Plugin to a version later than 1.4.2. For systems running PHP 7.1 or older, consider upgrading to a newer PHP version.

**Name of the Vulnerable Software and Affected Versions** WordPress Helpdesk Integration versions up to and including 5.8.10 **Description** The WordPress Helpdesk Integration plugin for WordPress is susceptible to Local File Inclusion via the `portal type` parameter. This allows unauthenticated attackers to include and execute arbitrary .php files on the server, potentially enabling them to bypass access controls, obtain sensitive data, or achieve code execution if .php file uploads are permitted. **Recommendations** Update WordPress Helpdesk Integration to a version later than 5.8.10.

Name of the Vulnerable Software and Affected Versions: Wptobe-memberships plugin for WordPress versions through 3.4.2 Description: The Wptobe-memberships plugin for WordPress is susceptible to arbitrary file deletion due to inadequate file path validation within the `del img ajax call()` function. Authenticated attackers possessing Subscriber-level access or higher can exploit this flaw to delete arbitrary files on the server. Deletion of critical files, such as `wp-config.php`, could lead to remote code execution. Recommendations: Update the Wptobe-memberships plugin to a version later than 3.4.2.

**Name of the Vulnerable Software and Affected Versions** Bootstrap Ultimate theme for WordPress versions up to and including 1.4.9 **Description** The issue allows unauthenticated attackers to include PHP files on the server via the `path` parameter, enabling the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution, especially if PHP files can be uploaded and included. If `php://filter` is enabled on the server, this issue may directly lead to Remote Code Execution. **Recommendations** For versions up to and including 1.4.9, consider disabling the `path` parameter to prevent exploitation until a patch is available. Restrict access to sensitive PHP files to minimize the risk of code execution. Avoid using the `path` parameter in API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.