Jakub Lipiński

**Name of the Vulnerable Software and Affected Versions** MailerPress versions prior to 1.5.1 **Description** The MailerPress – Newsletter, email marketing & AI automation plugin for WordPress allows unauthorized access because it fails to perform a capability check on the 'mailerpress/v1/contact' endpoint. This flaw enables unauthenticated attackers to update contact details. **Recommendations** Update the plugin to a version later than 1.5.0. Restrict access to the 'mailerpress/v1/contact' endpoint as a temporary mitigation measure.

**Name of the Vulnerable Software and Affected Versions** MailPress versions prior to 1.5.1 **Description** The MailPress plugin for WordPress allows unauthorized access through the campaign revision-restore REST endpoint 'POST /wp-json/mailpress/v1/campaign/<id>/restore-revision/<revision id>'. The issue occurs because the route was registered without a `permissionCallback`, which enables the `restoreRevision()` function to process unauthenticated requests. This allows an attacker to overwrite the `content html` variable of a campaign by restoring any previous revision, effectively modifying the campaign content. **Recommendations** Update the plugin to a version later than 1.5.0. As a temporary workaround, restrict access to the 'POST /wp-json/mailpress/v1/campaign/<id>/restore-revision/<revision id>' endpoint to prevent unauthorized modification of campaign content.

A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user into multiple fields in administration panel allows for Blind SQL Injection attacks. The vendor states that this administration panel already allows for significant modification capabilities. The SQL injection vulnerability primarily enables bypassing front-end validation controls and potential database destruction. Given the trust model in which this application is designed to be administered, remediation of this issue was not deemed necessary by the vendor. This vulnerability has been found in version 6.8, but other versions might also be vulnerable.

**Name of the Vulnerable Software and Affected Versions** Windu CMS version 4.1 **Description** An authenticated attacker can upload arbitrary files, including PHP scripts, because the system does not validate the types of uploaded files. This flaw can lead to Remote Code Execution (RCE), which allows an attacker to execute arbitrary commands on the server. There have been reports of elevated activities targeting this software. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP header resulting in Blind SQL Injection. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.

Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtain password hash to decode user credentials. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.

**Name of the Vulnerable Software and Affected Versions** QuickCMS versions prior to 6.8 patch 15.05.2026 **Description** QuickCMS allows a user session identifier to be established before authentication, and this value remains unchanged after the user authenticates. This behavior enables session fixation, where an attacker can predetermine a session ID for a victim and subsequently hijack the session once the victim has authenticated. **Recommendations** Apply the patch published on 15.05.2026 for version 6.8.

**Name of the Vulnerable Software and Affected Versions** QuickCMS versions prior to 6.8 patch published on 15.05.2026 **Description** An issue exists due to an insecure HTTP-based plugin-fetching mechanism. A remote attacker can execute a Man-in-the-Middle (MITM) attack—a technique where an attacker intercepts communication between two parties—by impersonating the opensolution.org server. By serving arbitrary HTML or JavaScript at the plugin list endpoint, the malicious content is automatically fetched, rendered, and executed when a user accesses the plugin page, leading to Cross-Site Scripting (XSS). **Recommendations** Apply the patch for version 6.8 published on 15.05.2026.