Giovanbattista Ianni

**Name of the Vulnerable Software and Affected Versions** Download Manager WordPress plugin versions prior to 3.3.62 **Description** The plugin fails to bind temporary download tokens to the requesting session and does not expire them promptly. This results in the token becoming a long-lived, multi-use, portable bearer token. An attacker who obtains a leaked download key can use it to repeatedly download package files that are protected by passwords or user roles without proper authorization. **Recommendations** Update Download Manager WordPress plugin to version 3.3.62 or later.

**Name of the Vulnerable Software and Affected Versions** User Registration & Membership WordPress plugin versions prior to 5.2.2 **Description** The plugin fails to verify the authenticity of incoming payment-provider webhook notifications. This allows unauthenticated attackers to forge a payment-approved event, enabling the activation of a paid membership subscription without completing an actual payment. **Recommendations** Update the User Registration & Membership WordPress plugin to version 5.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** Envo's Templates & Widgets for Elementor and WooCommerce versions prior to 1.4.27 **Description** This issue involves unauthorized data access caused by a missing authorization check during template rendering in the Envo Tabs and Off Canvas widgets. The `render()` method of the Tabs widget passes a user-controlled template or post ID to the `get builder content for display()` function without verifying the post status (such as private or draft) or the visitor's permissions. Consequently, authenticated attackers with Author-level access or higher can disclose the contents of private Elementor-driven pages and templates to anonymous visitors. This is achieved by configuring an Envo Tabs widget on a public post to reference a private content ID, which can be modified via the Elementor editor REST API. **Recommendations** Update to a version newer than 1.4.26. As a temporary mitigation, restrict Author-level users from editing Elementor widgets or accessing the Elementor editor REST API.