Jamaal

**Name of the Vulnerable Software and Affected Versions** Devs Accounting – Simple Accounting and Invoicing Solution versions prior to 1.2.1 **Description** A missing capability check in the `delete single account()` function allows unauthorized modification or deletion of data. The REST route '/devs-accounting/v1/delete-account/(?P<id>d+)' is registered without a `permission callback`, exposing the endpoint to public, unauthenticated access. This enables unauthenticated attackers to soft-delete arbitrary accounting account records within `wp dac accounts` by sending a GET request to the endpoint using the `id` variable. **Recommendations** Update the plugin to a version later than 1.2.0. As a temporary workaround, restrict public access to the '/devs-accounting/v1/delete-account/(?P<id>d+)' endpoint.

**Name of the Vulnerable Software and Affected Versions** Devs Accounting – Simple Accounting and Invoicing Solution versions prior to 1.2.1 **Description** The Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress contains a missing authorization flaw. The `get single account()` function is registered with a permission callback that unconditionally returns true, which bypasses authentication and authorization checks on the '/devs-accounting/v1/get-account/<id>' endpoint. This allows unauthenticated attackers to disclose sensitive private financial account records, such as account name, bank name, and opening balance, by enumerating the `id` variable. **Recommendations** Update the plugin to a version later than 1.2.0. As a temporary workaround, restrict access to the '/devs-accounting/v1/get-account/<id>' endpoint to minimize the risk of information disclosure.

**Name of the Vulnerable Software and Affected Versions** WP Forms Connector versions prior to 1.9 **Description** The plugin contains an information exposure flaw via the REST route 'wp/v3/user/list/<id>' which uses the `userDetail()` function. The authentication mechanism only checks if the `Username` HTTP header corresponds to an administrator account and if the `Password` HTTP header is not empty, failing to validate the password using `wp check password()`. This allows unauthenticated attackers to retrieve sensitive data for any registered user ID, such as the email address and the WordPress password hash (`user pass`), by providing a valid administrator username and any arbitrary password. **Recommendations** Disable the plugin or restrict access to the 'wp/v3/user/list/<id>' endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WP Forms Connector versions prior to 1.9 **Description** An issue exists where unauthenticated attackers can execute additional SQL queries to extract sensitive information from the database. This occurs via the `/wp-json/wp/v3/post/list` REST endpoint through the `order` parameter. The flaw is caused by insufficient escaping of the `order` parameter and a lack of proper preparation in the `listPost()` function, where the value is concatenated unquoted into the ORDER BY clause and executed via `$wpdb->get results()` without using `$wpdb->prepare()`. Additionally, the endpoint uses a broken header-based check that validates if a provided 'Username' belongs to an administrator but fails to verify the 'Password'. **Recommendations** Update WP Forms Connector to version 1.9 or later. As a temporary mitigation, restrict access to the `/wp-json/wp/v3/post/list` REST endpoint.

**Name of the Vulnerable Software and Affected Versions** CM Ad Changer versions prior to 2.0.8 **Description** The CM Ad Changer plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into executing unwanted actions. This occurs due to missing or incorrect nonce validation within the `cmac campaigns action()` function. Unauthenticated attackers can exploit this to permanently delete arbitrary advertising campaigns, including associated banner records and uploaded files, by inducing a site administrator to click a malicious link. **Recommendations** Update the plugin to version 2.0.8 or later. As a temporary workaround, restrict administrative access to the plugin settings to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Custom 404 Pro plugin for WordPress versions prior to 3.13.0 **Description** The Custom 404 Pro plugin for WordPress is susceptible to time-based SQL Injection through the `path` parameter. This is due to inadequate input sanitization and insufficient query preparation. An authenticated attacker with Administrator-level access or higher can append SQL queries to existing ones, potentially extracting sensitive information from the database. **Recommendations** Update the Custom 404 Pro plugin to version 3.13.0 or later.