D.V4N_S3C

**Name of the Vulnerable Software and Affected Versions** Taskbuilder – Project Management & Task Management Tool With Kanban Board versions prior to 5.0.9 **Description** An issue exists where authenticated attackers with subscriber-level access and above can perform SQL Injection. This occurs because the `task search` parameter is not sufficiently escaped and the SQL query is not properly prepared. Additionally, the `wppm get task list()` AJAX handler lacks capability checks and nonce verification, allowing any authenticated user to invoke it directly and append malicious SQL queries to extract sensitive information from the database. **Recommendations** Update Taskbuilder – Project Management & Task Management Tool With Kanban Board to version 5.0.9 or later.

**Name of the Vulnerable Software and Affected Versions** LatePoint – Calendar Booking Plugin for Appointments and Events versions prior to 5.6.4 **Description** An Insecure Direct Object Reference (IDOR) exists in the `create or update()` function of OsOrdersController. This allows an authenticated Agent to provide an arbitrary `order[customer id]` and overwrite the email field of any customer, including those linked to WordPress Administrator accounts, via the public-scope `set data()` call. Due to a missing role verification in `OsAuthHelper::authorize customer()`, the linked WordPress user is logged in without a role check, enabling attackers with Agent-level access or higher to elevate their privileges to Administrator. **Recommendations** Update the plugin to version 5.6.4 or later.

**Name of the Vulnerable Software and Affected Versions** User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration versions prior to 4.3.2 **Description** Insufficient input validation and type checking on the `wpuf files` parameter during form submission, combined with unconditional deserialization via the `maybe unserialize()` function when displaying post content, allows authenticated attackers with Subscriber-level access or higher to inject arbitrary PHP objects. This can lead to arbitrary code execution, deletion of arbitrary files, or other malicious actions if a POP (Property-Oriented Programming) chain—a sequence of gadgets used to execute code during deserialization—is present on the target system. **Recommendations** Update to a version newer than 4.3.1. As a temporary workaround, restrict access to the `wpuf files` parameter during form submissions to minimize the risk of exploitation.