Chloe Chamberland

**Name of the Vulnerable Software and Affected Versions** Wholesale for WooCommerce versions prior to 2.0.6 **Description** Authenticated users with author-level access and above can escalate their privileges to administrator. The issue exists in the `save requests meta()` function, which fails to perform capability checks, such as `current user can('promote users')` or `current user can('manage options')`, and lacks allowlist validation for the `user role set` POST parameter. Because the `wwp requests` post type is registered with `capability type => 'post'`, authors who have created a request can access the `request user role nonce` nonce and submit a crafted request with the `user role set` variable set to `administrator` to gain full administrative control. **Recommendations** Update Wholesale for WooCommerce to version 2.0.6 or later.

**Name of the Vulnerable Software and Affected Versions** Premium Addons for Elementor – Powerful Elementor Templates & Widgets versions prior to 4.11.85 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts through the `premium tooltip text` parameter. The payload executes when an administrator or a higher-privileged user opens the affected post in the Elementor editor, as the raw unescaped output is processed via the `print template()` function registered on the `elementor/section/print template` hook. **Recommendations** Update to version 4.11.85 or later. As a temporary mitigation, restrict access to the `premium tooltip text` parameter for users with contributor-level permissions.

**Name of the Vulnerable Software and Affected Versions** Post Export Import with Media versions prior to 1.13.2 **Description** An arbitrary file upload issue exists due to insufficient file extension validation. The `ajax import media start()` function uses `pathinfo()` on raw ZIP entry names, which can be bypassed using a trailing-dot filename (e.g., 'shell.php.'). This bypass results in an empty string for the extension, skipping the allow-list check. Subsequently, the `import media file secure()` function copies the file into the WordPress uploads directory without further validation. Authenticated attackers with administrator-level access or higher can exploit this to upload executable files, potentially leading to remote code execution. **Recommendations** Update to a version newer than 1.13.1. As a temporary workaround, restrict access to the `import media file secure()` function and the ZIP media import feature.

**Name of the Vulnerable Software and Affected Versions** AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress versions prior to 10.10.3 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via the `alignment` attribute, enabling the injection of arbitrary web scripts into pages that execute when accessed by other users. **Recommendations** Update AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress to version 10.10.3 or later.

**Name of the Vulnerable Software and Affected Versions** JoomSport – for Sports: Team & League, Football, Hockey & more versions prior to 5.7.9 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can create arbitrary season groups or modify existing group names, participants, and round-type options. This exploitation requires the `joomsportajaxnonce`, which is exposed on frontend pages that render a JoomSport shortcode. **Recommendations** Update JoomSport – for Sports: Team & League, Football, Hockey & more to version 5.7.9 or later.

**Name of the Vulnerable Software and Affected Versions** RegistrationMagic – User Registration Forms Plugin versions prior to 6.0.9.2 **Description** This issue involves a Cross-Site Request Forgery (CSRF) flaw, which occurs when a web application fails to verify that a request was intentionally initiated by the user. The flaw exists in the `process request()` function due to missing or incorrect nonce validation. An unauthenticated attacker can exploit this by tricking a site administrator into clicking a malicious link, allowing the attacker to escalate the privileges of a form submitter to administrator by creating a malicious Chronos automation task executed via WordPress cron. **Recommendations** Update RegistrationMagic – User Registration Forms Plugin to version 6.0.9.2 or later. As a temporary mitigation, restrict access to the `process request()` function to prevent unauthorized requests.

**Name of the Vulnerable Software and Affected Versions** JoomSport – for Sports: Team & League, Football, Hockey & more versions prior to 5.7.9 **Description** An authorization flaw exists in the `joomsport season groupdel()` AJAX handler. The system fails to perform a capability check, verifying only a nonce before executing a DELETE query on group IDs provided by the user. This allows authenticated users with Subscriber-level access or higher to delete arbitrary JoomSport group records. **Recommendations** Update to a version newer than 5.7.8. As a temporary mitigation, restrict access to the `joomsport season groupdel()` AJAX handler for users with Subscriber-level permissions.

**Name of the Vulnerable Software and Affected Versions** SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery versions prior to 3.9.6 **Description** An issue exists that allows unauthenticated attackers to perform privilege escalation via account takeover. The plugin fails to properly validate a user's identity before updating account details, such as resetting passwords. This allows an attacker to change the email addresses of arbitrary users, including administrators, to reset their passwords and gain full account access. This issue specifically affects sites where OTP (One-Time Password) verification for password resets is enabled and the target user has a phone number configured for OTP verification. **Recommendations** Update the plugin to version 3.9.6 or later.

**Name of the Vulnerable Software and Affected Versions** Groundhogg versions prior to 4.5.6 **Description** The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress contains a SQL Injection flaw. Authenticated attackers with Sales Representative-level access or higher can append malicious SQL queries to existing ones to extract sensitive database information. This occurs because of insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. The issue can be triggered via the `query[select]` parameter. Furthermore, the sanitized `Contact Query` code path can be bypassed by providing an invalid filter type in the `query[filters][0][0][type]` parameter, which triggers a `FilterException` and forces the application to use the unsanitized `Legacy Contact Query` path. **Recommendations** Update the plugin to a version newer than 4.5.5. Avoid using the `query[select]` parameter in the affected plugin until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Groundhogg versions prior to 4.5.6 **Description** The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress contains a generic SQL Injection flaw. This occurs because the software fails to properly escape user-supplied input and lacks sufficient preparation of the SQL query. Authenticated attackers with marketer-level access or higher can exploit this by appending malicious SQL queries via the `search` parameter to extract sensitive information from the database. **Recommendations** Update the plugin to a version newer than 4.5.5. Avoid using the `search` parameter if the plugin cannot be updated immediately.

**Name of the Vulnerable Software and Affected Versions** CodePeople Post Map for Google Maps versions prior to 1.2.7 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts via the `cpm point` Post Meta, which execute when a user accesses the affected page. **Recommendations** Update CodePeople Post Map for Google Maps to version 1.2.7 or later.

**Name of the Vulnerable Software and Affected Versions** Simple File List versions prior to 6.3.8 **Description** The Simple File List plugin for WordPress contains a flaw where a missing authorization check on the `frontmanage` shortcode attribute allows authenticated attackers with contributor-level access or higher to perform unauthorized file operations. These operations include deleting, moving, creating folders, and downloading files. An attacker can exploit this by creating a draft post with the `eeSFL` shortcode and using the post preview endpoint to obtain a nonce, which is a unique token used to prevent cross-site request forgery, to authorize requests that bypass checks in the `includes/ee-list-ops-bar-process.php` file. **Recommendations** Update to a version later than 6.3.7.

**Name of the Vulnerable Software and Affected Versions** Simple File List versions prior to 6.3.8 **Description** The Simple File List plugin for WordPress contains insufficient authorization checks that allow unauthenticated attackers to delete and modify files on the server. This issue occurs within the `simplefilelist edit job` AJAX action. The flaw persists even if the `AllowFrontManage` setting is disabled because the `is admin()` function unconditionally bypasses the security guard before the setting is evaluated. **Recommendations** Update the plugin to a version later than 6.3.7.

**Name of the Vulnerable Software and Affected Versions** Simple File List versions prior to 6.3.8 **Description** The Simple File List plugin for WordPress contains a flaw allowing unauthenticated attackers to delete arbitrary files on the server. This occurs due to insufficient file path validation within the `eeSFL DeleteFile()` function, specifically involving the `eeSubFolder` parameter. The issue is accessible via the 'simplefilelist edit job' AJAX action, which is registered for non-privileged users. The `is admin()` security guard is bypassed because it returns true for all requests sent to the 'admin-ajax.php' endpoint. Deleting critical files, such as 'wp-config.php', can lead to remote code execution (the ability to execute arbitrary commands on the target machine). **Recommendations** Update to a version later than 6.3.7. As a temporary workaround, restrict access to the 'admin-ajax.php' endpoint or the 'simplefilelist edit job' action to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Appointment Booking Calendar versions prior to 1.4.02 **Description** The plugin is subject to sensitive information exposure due to insufficient authorization and a lack of per-calendar ownership verification within the `cpabc appointments calendar load2()` function. This function is accessible via the `cpabc calendar load2=1` query parameter in 'wp-admin'. The system only verifies if the user is an administrator or has the `edit posts` capability, which is granted to users with Contributor-level access and above. Consequently, authenticated attackers with these privileges can provide an arbitrary calendar ID through the `id` parameter to extract customer booking data, such as names, email addresses, phone numbers, booking times, and comments, from any calendar managed by the plugin. **Recommendations** Update the plugin to a version later than 1.4.01. As a temporary workaround, restrict access to the `cpabc appointments calendar load2()` function or the `id` parameter in the 'wp-admin' area for users with Contributor-level privileges.

**Name of the Vulnerable Software and Affected Versions** Customize My Account For Woocommerce versions prior to 4.3.7 **Description** The Customize My Account For Woocommerce plugin for WordPress contains a Stored Cross-Site Scripting issue via the 'sysbasics user avatar' shortcode. The problem arises from insufficient input sanitization and output escaping within the `wcmamtx get avatar default()` function. Specifically, user-supplied attributes `min height`, `min width`, `max height`, and `max width` are concatenated unescaped into the `extra attr` style attribute of the `get avatar()` function. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update to a version later than 4.3.6. As a temporary workaround, restrict the use of the 'sysbasics user avatar' shortcode or limit the permissions of users who can edit pages to prevent the injection of malicious attributes.

**Name of the Vulnerable Software and Affected Versions** SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager versions prior to 4.3.7 **Description** Reflected Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute when a user is tricked into clicking a link. The issue exists within the `plugin options page()` function and is triggered via the `tab` parameter. Since this function is only rendered within the WordPress admin dashboard, successful exploitation requires the victim to be logged in with Shop Manager-level access or higher. **Recommendations** Update to a version later than 4.3.6. As a temporary workaround, restrict access to the `tab` parameter within the admin dashboard to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe versions prior to 30.0.3 **Description** The plugin is subject to privilege escalation via the `RegistryUserRole` parameter. The admin menu is registered at the `edit posts` capability level, allowing Contributor-level users to access admin pages and obtain a valid `cg admin` nonce. The option-saving handler in `change-options-and-sizes.php` fails to perform a `current user can()` capability check, relying only on `check admin referer('cg admin')`. Furthermore, the `RegistryUserRole` value is processed using `sanitize text field()` and `htmlentities()` without being restricted to an allowlist of permitted role names. This allows authenticated attackers with author-level access or higher to overwrite the stored `RegistryUserRole` option with `administrator`. The `cg create wp user from google user()` function then reads this value from the `contest gal1ery registry and login options` table and passes it to `wp update user()`, promoting newly registered Google sign-in accounts to Administrator status. **Recommendations** Update the plugin to a version later than 30.0.2. As a temporary workaround, restrict access to the `change-options-and-sizes.php` file or the `RegistryUserRole` parameter to prevent unauthorized role modifications.

**Name of the Vulnerable Software and Affected Versions** Burst Statistics versions 3.4.0 through 3.4.1.1 **Description** The Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin for WordPress contains an authentication bypass flaw. The issue stems from incorrect return-value handling in the `is mainwp authenticated()` function when validating application passwords from the Authorization header. This allows an unauthenticated attacker who knows an administrator username to impersonate that administrator for the duration of a request by providing any random Basic Authentication password, leading to privilege escalation and full site takeover. Over 200,000 sites are estimated to be affected worldwide, with more than 7,400 attacks recorded within 24 hours of disclosure. **Recommendations** Update Burst Statistics to version 3.4.2. Audit administrator accounts for any unrecognized users created during the period of exposure. Enable automatic updates for plugins to reduce the window of exposure for future issues.

Name of the Vulnerable Software and Affected Versions: Motors – Car Dealership & Classified Listings Plugin versions up to, and including, 1.4.66 Description: The issue allows authenticated attackers with Subscriber-level access and above to execute several initial set-up actions due to a missing capability check on several functions in the ajax actions.php file. This enables unauthorized modification of data. Recommendations: For Motors – Car Dealership & Classified Listings Plugin versions up to, and including, 1.4.66, update to a version that includes a fix for the missing capability check in the ajax actions.php file to prevent unauthorized data modification.