Kai Aizen

**Name of the Vulnerable Software and Affected Versions** LWP::UserAgent versions prior to 6.83 **Description** LWP::UserAgent leaks Authorization and Proxy-Authorization headers during cross-origin redirects. When a 3xx response is received, the redirect handler only removes the Host and Cookie headers before the subsequent request. Consequently, caller-supplied Authorization and Proxy-Authorization headers are transmitted unchanged to the redirect target, even if the scheme, host, or port changes. This allows a redirect to an attacker-controlled host to disclose the caller's credentials. **Recommendations** Update to version 6.83 or later.

**Name of the Vulnerable Software and Affected Versions** HTTP Headers plugin for WordPress versions prior to 1.19.3 **Description** Insufficient sanitization of custom header name and value fields before they are written to the Apache .htaccess file via the `insert with markers()` function allows authenticated attackers with Administrator-level access or higher to perform CRLF Injection. This involves injecting arbitrary newline characters and additional Apache directives into the .htaccess configuration file through the 'Custom Headers' settings, which can result in Apache configuration parse errors and a potential site-wide denial of service. **Recommendations** Update the plugin to a version newer than 1.19.2. As a temporary workaround, restrict access to the 'Custom Headers' settings to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Riaxe Product Customizer versions prior to 2.1.3 **Description** An authorization bypass exists due to the registration of a REST API route ''/wp-json/InkXEProductDesignerLite/customer/delete customer'' without a permission callback. This configuration allows unauthenticated access to the `inkxe delete customer()` function, which processes an array of user IDs from the request body and passes them to `wp delete user()` without performing authentication or authorization checks. Consequently, unauthenticated attackers can delete arbitrary WordPress user accounts, including administrator accounts, resulting in complete site lockout and data loss. **Recommendations** Update to a version later than 2.1.2. As a temporary workaround, restrict access to the ''/wp-json/InkXEProductDesignerLite/customer/delete customer'' endpoint.

**Name of the Vulnerable Software and Affected Versions** Riaxe Product Customizer versions prior to 2.1.3 **Description** An issue exists in the Riaxe Product Customizer plugin for WordPress where unauthenticated attackers can append additional SQL queries to existing ones to extract sensitive information from the database. This occurs due to insufficient escaping of user-supplied parameters and inadequate preparation of the SQL query. The flaw is located in the 'options' parameter keys within `product data` of the '/wp-json/InkXEProductDesignerLite/add-item-to-cart' REST API endpoint. **Recommendations** Update the plugin to a version later than 2.1.2. As a temporary workaround, restrict access to the '/wp-json/InkXEProductDesignerLite/add-item-to-cart' REST API endpoint or avoid using the `product data` parameter until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Riaxe Product Customizer versions prior to 2.1.3 **Description** The plugin contains a privilege escalation flaw due to an unauthenticated AJAX action ''wp ajax nopriv install-imprint'' that maps to the `ink pd add option()` function. This function processes the `option` and `opt value` variables from $ POST and executes `delete option()` and `add option()` using these values without nonce verification, capability checks, or an option name allowlist. Unauthenticated attackers can update arbitrary WordPress options, which may be used to enable user registration and set the default user role to administrator, leading to full site takeover. **Recommendations** Update to a version later than 2.1.2.

**Name of the Vulnerable Software and Affected Versions** 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery versions prior to 1.16.18 **Description** This plugin for WordPress allows unauthenticated attackers to retrieve flipbook page metadata for draft, private, and password-protected flipbooks. This occurs due to a missing capability check in the `send post pages json()` function. **Recommendations** Update to a version later than 1.16.17. As a temporary workaround, consider disabling the `send post pages json()` function until the update is applied.

Name of the Vulnerable Software and Affected Versions Riaxe Product Customizer plugin for WordPress versions up to and including 2.4 Description The Riaxe Product Customizer plugin for WordPress is susceptible to exposure of sensitive information. The '/wp-json/InkXEProductDesignerLite/orders' API endpoint lacks authentication or authorization checks due to its 'permission callback' being set to ' return true'. This allows unauthenticated attackers to retrieve customer first and last names, customer IDs, order IDs, order totals, order dates, currencies, and order statuses directly from the database. Recommendations Update the Riaxe Product Customizer plugin to a version later than 2.4.

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.9. This is due to missing or incorrect nonce validation on the 'vsz cf7 save setting callback' function. This makes it possible for unauthenticated attackers to delete form entry via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Name of the Vulnerable Software and Affected Versions Advanced Contact form 7 DB plugin for WordPress versions up to and including 2.0.9 Description The Advanced Contact form 7 DB plugin for WordPress has a flaw that allows unauthorized data access. This is due to a missing capability check on the `vsz cf7 export to excel` function. Attackers with Subscriber-level access or higher can export form submissions to an excel file. Recommendations Update to a version later than 2.0.9.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow Provider for Databricks versions 1.10.0 through 1.11.9 **Description** The software does not properly validate certificates when connecting to Databricks, potentially allowing a man-in-the-middle attack where traffic is intercepted, manipulated, or credentials are stolen without the user being notified. **Recommendations** Upgrade to version 1.12.0 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** MimeTypes Link Icons plugin for WordPress versions up to and including 3.2.20 **Description** The MimeTypes Link Icons plugin for WordPress is susceptible to Server-Side Request Forgery. This occurs because the plugin makes outbound HTTP requests to user-controlled URLs without sufficient validation when the "Show file size" option is enabled. Authenticated attackers with Contributor-level access or higher can leverage this to make web requests to arbitrary locations from the web application. This could allow querying and modification of information from internal services through crafted links within post content. **Recommendations** Update the MimeTypes Link Icons plugin to a version later than 3.2.20.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions 3.1.0 through 3.1.7 **Description** Apache Airflow versions 3.1.0 through 3.1.7 contain a missing authorization issue within the Human-in-the-Loop (HITL) endpoints of the Execution API. This allows any authenticated task instance to perform actions—reading, approving, or rejecting—on HITL workflows belonging to other task instances. The HITL endpoints are part of the Execution API, which manages the execution of tasks within Airflow workflows. The issue stems from a lack of proper access controls, enabling unauthorized access and manipulation of HITL workflows. **Recommendations** Upgrade to Apache Airflow version 3.1.8 or later.

**Name of the Vulnerable Software and Affected Versions** ingress-nginx versions prior to 1.13.7 and 1.14.3 **Description** A security issue exists in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite-target` Ingress annotation can be exploited to inject configuration into nginx. This can result in arbitrary code execution within the context of the ingress-nginx controller and potential disclosure of Secrets accessible to the controller. In a default installation, the controller has access to all Secrets cluster-wide. The issue involves insufficient filtering of annotation values before they are incorporated into the NGINX configuration template, allowing an attacker to inject arbitrary directives into the `nginx.conf` file, such as `include` or `lua`. Exploitation can lead to access to secrets and other Kubernetes resources accessible to the controller, and in some scenarios, complete cluster compromise. The vulnerable annotation is `nginx.ingress.kubernetes.io/rewrite-target`. **Recommendations** Update to ingress-nginx version 1.13.7 or 1.14.3.

**Name of the Vulnerable Software and Affected Versions** Friendly Functions for Welcart plugin for WordPress versions through 1.2.5 **Description** The Friendly Functions for Welcart plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF). This is caused by a lack of, or incorrect, nonce validation on the settings page. An unauthenticated attacker could potentially update plugin settings by forging a request, provided they can trick a site administrator into performing an action, such as clicking a malicious link. **Recommendations** Update the Friendly Functions for Welcart plugin to a version later than 1.2.5.

**Name of the Vulnerable Software and Affected Versions** ACF to REST API plugin for WordPress versions through 3.3.4 **Description** The ACF to REST API plugin for WordPress is affected by an Insecure Direct Object Reference issue. Insufficient capability checks in the `update item permissions check()` method allow authenticated attackers with Contributor-level access or higher to modify ACF fields. Attackers can modify posts they do not own, user accounts, comments, taxonomy terms, and global options. This is possible through the `/wp-json/acf/v3/{type}/{id}` API endpoints, where `{type}` and `{id}` represent the object type and identifier, respectively. The issue stems from a lack of object-specific permission checks, only verifying the `edit posts` capability. **Recommendations** Update the ACF to REST API plugin to a version later than 3.3.4.

**Name of the Vulnerable Software and Affected Versions** Omnipress plugin for WordPress versions prior to 1.6.4 **Description** The Omnipress plugin for WordPress is susceptible to Stored Cross-Site Scripting through SVG File uploads. Insufficient input sanitization and output escaping allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts. These scripts will execute when a user accesses the SVG file. **Recommendations** Update the Omnipress plugin to version 1.6.4 or later.

**Name of the Vulnerable Software and Affected Versions** Document Library Lite versions prior to 1.1.7 **Description** The Document Library Lite plugin for WordPress has an issue with authorization. An unauthenticated AJAX action, `dll load posts`, exposes a JSON table of document data without proper checks. The `args` array accepted by this handler allows attackers to retrieve unpublished document titles and content, including those with draft, pending, or future status. The vulnerable API endpoint is `/wp-admin/admin-ajax.php`. The `status` parameter within the `args` array is attacker-controlled. **Recommendations** Update Document Library Lite to version 1.1.7 or later.

**Name of the Vulnerable Software and Affected Versions** Chartify – WordPress Chart Plugin versions prior to 3.5.9 **Description** The software contains a missing authentication check for a critical function. An unauthenticated AJAX action is registered, dispatching to admin-class methods based on a request parameter without proper security checks. This allows attackers to potentially execute administrative functions via the `wp-admin/admin-ajax.php` endpoint if they can determine callable method names. **Recommendations** Update Chartify – WordPress Chart Plugin to version 3.5.9 or later.

Name of the Vulnerable Software and Affected Versions: CatFolders – Tame Your WordPress Media Library by Category plugin versions prior to 2.5.3 Description: The CatFolders – Tame Your WordPress Media Library by Category plugin for WordPress contains a time-based SQL Injection issue via the CSV Import contents. Insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query allows authenticated attackers with Author-level access and above to append additional SQL queries into existing queries to extract sensitive information from the database. Recommendations: Update to CatFolders – Tame Your WordPress Media Library by Category plugin version 2.5.3 or later.