Joy Gilbert

**Name of the Vulnerable Software and Affected Versions** 24liveblog versions prior to 2.3 **Description** The 24liveblog plugin for WordPress allows unauthorized data modification because the `update lb24 token()` AJAX function lacks a proper capability check. The handler verifies the 'lb24' nonce but fails to confirm the user's permissions or ensure the `user id` belongs to the current user. Consequently, authenticated attackers with author-level access or higher can overwrite the `lb24 token`, `lb24 uid`, `lb24 refresh token`, and `lb24 uname` user meta values for any user, including administrators, and modify site-wide options to hijack the integration with the 24liveblog service. **Recommendations** Update the plugin to a version newer than 2.2. As a temporary workaround, restrict access to the `update lb24 token()` function for users with author-level permissions.

**Name of the Vulnerable Software and Affected Versions** 24liveblog versions prior to 2.3 **Description** The 24liveblog plugin for WordPress allows authenticated users with contributor-level access or higher to extract sensitive third-party account credentials. The issue occurs because the `lb24 block enqueue scripts()` function is hooked to `enqueue block editor assets`. For non-administrator users, the system loads site-wide integration secrets from the options table using `get option()` and exposes them via `wp localize script()` within the `lb24BlockData` JavaScript object. An attacker can retrieve the `lb24 token`, `lb24 refresh token`, `lb24 uid`, and `lb24 uname` variables by opening the block editor and inspecting the page source. **Recommendations** Update the plugin to a version newer than 2.2. As a temporary workaround, restrict user roles to prevent non-administrator users from accessing the block editor.

**Name of the Vulnerable Software and Affected Versions** Equalize Digital Accessibility Checker versions prior to 1.42.2 **Description** The plugin fails to properly verify user authorization when performing actions on accessibility audit issue records. Authenticated users with author-level access or higher can dismiss, ignore, or restore records belonging to posts they are not permitted to edit. This is achieved by providing an issue from their own post as an authorization token to affect matching issues across the entire site. Specifically, an attacker can use the `largeBatch=true` parameter in a 'dismiss-issue' request to bulk-modify all site-wide accessibility issues that share the same `object` value, including those associated with administrator-owned posts. **Recommendations** Update the plugin to a version later than 1.42.1.

**Name of the Vulnerable Software and Affected Versions** Abandoned Contact Form 7 versions prior to 2.3 **Description** The plugin allows unauthenticated attackers to permanently delete arbitrary posts, pages, or other content on a site. This occurs because the `action remove abandoned()` function, registered to the 'wp ajax remove abandoned' and 'wp ajax nopriv remove abandoned' hooks, lacks capability checks and nonce validation. The handler processes a user-supplied `recover id` parameter from `$ POST` and passes it to `wp delete post()` with the force-delete flag enabled, without verifying if the ID corresponds to the plugin's specific `cf7af data` post type. **Recommendations** Update to a version later than 2.2. As a temporary workaround, restrict access to the 'admin-ajax' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** 6Storage Rentals versions prior to 2.22.1 **Description** An authorization bypass exists in the 6Storage Rentals plugin for WordPress. Unauthenticated attackers can read and modify arbitrary tenant profile data, including names, email addresses, phone numbers, physical addresses, and Social Security Numbers (SSN). This occurs because the `six storage getUserInfo()` and `six storage updateProfile()` functions are registered on `wp ajax nopriv *` hooks and accept a tenant identifier via the `userId` parameter in the 'six storage get user info' and 'six storage update profile' AJAX actions without performing ownership verification, session binding, or nonce validation. This allows the use of an enumerated `userId` value in crafted requests to access or alter data. **Recommendations** Update the plugin to a version later than 2.22.0. As a temporary mitigation, restrict access to the 'six storage get user info' and 'six storage update profile' AJAX actions or avoid using the `userId` parameter in these endpoints until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Login with NEAR plugin for WordPress versions prior to 0.3.4 **Description** The plugin contains an authentication bypass flaw within the `ajaxLoginWithNear()` function. This function is registered as a `wp ajax nopriv` action, making it accessible to unauthenticated users. It accepts an attacker-supplied `account` POST parameter and issues a valid WordPress authentication cookie based only on a substring check for `.near`. The process lacks nonce verification, cryptographic signature validation, challenge-response exchanges, or proof of wallet ownership. Consequently, unauthenticated attackers can log in as any existing user, including administrators, whose email matches the `<account>@near.org` pattern. If no matching user is found, the system automatically creates and authenticates a new account for the identifier provided. **Recommendations** Update the plugin to a version later than 0.3.3. As a temporary workaround, restrict access to the `ajaxLoginWithNear()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** A flaw in the OpenID Connect (OIDC) Introspection feature occurs when both realm-level and client-level `notBefore` revocation policies are configured. In this scenario, the system fails to properly honor the realm-level policy, allowing tokens that should have been revoked to remain active. This can lead to unauthorized access or continued session validity. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** A security bypass exists in Keycloak where a remote attacker can circumvent security measures by submitting a valid Security Assertion Markup Language (SAML) response from an external Identity Provider (IdP) to the Keycloak SAML endpoint. This occurs during IdP-initiated broker logins, allowing attackers to complete logins even when the SAML Identity Provider is disabled, resulting in unauthorized authentication. The affected API endpoint is the Keycloak SAML endpoint. The vulnerability involves manipulating the SAML response to bypass authentication checks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** An authorization bypass issue exists in the Keycloak Admin API. This allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim’s unique identifier (UUID) and the Organizations feature is enabled. The API endpoint involved is the Keycloak Admin API. The vulnerable parameter is the victim’s unique identifier (`UUID`). **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** A flaw exists in Keycloak’s invitation token registration mechanism. The server does not verify the cryptographic signature of the JSON Web Token (JWT). An attacker can modify the organization ID (`org id`) and target email within a legitimate invitation token’s JWT payload to register an account in an unauthorized organization. This can lead to unauthorized access, bypassing invite-only onboarding, access to resources through Single Sign-On (SSO), and potential privilege escalation through Role-Based Access Control (RBAC). **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.