Leonid Semenenko

**Name of the Vulnerable Software and Affected Versions** My Calendar – Accessible Event Manager versions prior to 3.7.9 **Description** An issue exists where unauthenticated attackers can perform time-based blind SQL Injection. This occurs due to insufficient escaping of user-supplied input and a lack of proper preparation of the SQL query. By manipulating the `mc auth` parameter, an attacker can append additional SQL queries to extract sensitive information from the database. **Recommendations** Update the plugin to version 3.7.9 or later. As a temporary mitigation, restrict access to the functionality utilizing the `mc auth` parameter.

**Name of the Vulnerable Software and Affected Versions** AMP for WP versions prior to 1.1.13 **Description** An Arbitrary File Write issue exists due to unsafe ZIP file extraction within the `ampforwp save local font()` function, coupled with inadequate cleanup that fails to remove nested directories and files. Authenticated attackers with Author-level access or higher, and permissions granted by an Administrator, can write arbitrary files to a web-accessible location on the server. This may lead to remote code execution on hosts that execute PHP files in the uploads directory. **Recommendations** Update the plugin to a version newer than 1.1.12.

**Name of the Vulnerable Software and Affected Versions** Contest Gallery versions prior to 28.1.7 **Description** The Contest Gallery plugin for WordPress contains a SQL Injection flaw. This occurs because the unauthenticated 'post cg gallery form upload' AJAX action fails to properly escape the `form input` parameter and lacks sufficient preparation of the SQL query within the 'cb' branch of the `users-upload-check.php` file, where the `$f input id` variable is concatenated unquoted into a SELECT statement. The endpoint is protected only by a public frontend nonce (`cg1l action` / `cg nonce`) visible in the page source of public gallery pages. This allows unauthenticated attackers to append malicious SQL queries to extract sensitive information from the database. **Recommendations** Update to a version later than 28.1.6. As a temporary workaround, restrict access to the 'post cg gallery form upload' AJAX action or avoid using the `form input` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** The Motors – Car Dealership & Classified Listings Plugin versions prior to 1.4.108 **Description** Insufficient file path validation in the become-dealer logo upload flow allows authenticated users with subscriber level access and above to delete arbitrary files on the server. This occurs because the profile update handler permits the setting of an arbitrary filesystem path. **Recommendations** Update the plugin to a version later than 1.4.107.

**Name of the Vulnerable Software and Affected Versions** Betheme versions prior to 28.5 **Description** The Betheme theme for WordPress allows authenticated attackers with author-level access or higher to upload arbitrary files, including PHP scripts. This occurs because the `upload icons()` function moves and unzips user-controlled ZIP files into a public uploads directory without validating the types of the extracted files. This flaw can lead to remote code execution via the Icons icon-pack upload flow. **Recommendations** Update to a version later than 28.4. As a temporary workaround, restrict access to the Icons icon-pack upload flow for users with author-level permissions.

**Name of the Vulnerable Software and Affected Versions** Betheme versions prior to 28.5 **Description** The Betheme theme for WordPress allows authenticated attackers with contributor-level access and above to move or delete arbitrary local files via path traversal. This occurs because the `upload icons()` function uses a user-controlled upload path `mfn-icon-upload` in a filesystem move operation without restricting it to the uploads directory. **Recommendations** Update to a version later than 28.4. As a temporary workaround, restrict access to the `upload icons()` function for users with contributor-level permissions.

**Name of the Vulnerable Software and Affected Versions** Geo Mashup versions prior to 1.13.20 **Description** The Geo Mashup plugin for WordPress contains a time-based blind SQL Injection, a technique that allows an attacker to infer data by observing the time the server takes to respond to specific queries. The issue exists due to insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. Authenticated attackers with subscriber-level access or higher can exploit the `geo mashup null fields` parameter to append additional SQL queries and extract sensitive information from the database. **Recommendations** Update the plugin to a version later than 1.13.19. As a temporary workaround, restrict access to the `geo mashup null fields` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Drag and Drop Multiple File Upload for Contact Form 7 versions prior to 1.3.9.7 **Description** Insufficient file type validation occurs when custom blacklist types are configured, as the system replaces the default dangerous extension denylist instead of merging with it. Additionally, the `wpcf7 antiscript file name()` function can be bypassed using filenames containing non-ASCII characters. This allows unauthenticated attackers to upload arbitrary files, such as PHP files, to the server, potentially leading to remote code execution. **Recommendations** Update to a version later than 1.3.9.6.

The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to SQL Injection via the 'packages' parameter in versions up to, and including, 3.6.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

The wpForo Forum plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 3.0.2. This is due to a two-step logic flaw: the topic add() and topic edit() action handlers accept arbitrary user-supplied data[*] arrays from $ REQUEST and store them as postmeta without restricting which fields may contain array values. Because 'body' is included in the allowed topic fields list, an attacker can supply data[body][fileurl] with an arbitrary file path (e.g., wp-config.php or an absolute server path). This poisoned fileurl is persisted to the plugin's custom postmeta database table. Subsequently, when the attacker submits wpftcf delete[]=body on a topic edit request, the add file() method retrieves the stored postmeta record, extracts the attacker-controlled fileurl, passes it through wpforo fix upload dir() which only rewrites legitimate wpforo upload paths and returns all other paths unchanged, and then calls wp delete file() on the unvalidated path. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files writable by the PHP process on the server, including critical files such as wp-config.

Name of the Vulnerable Software and Affected Versions wpForo Forum plugin for WordPress versions up to and including 2.4.16 Description The wpForo Forum plugin for WordPress is susceptible to arbitrary file deletion due to a missing file name/path validation against path traversal sequences. Authenticated attackers with subscriber level access or higher can delete arbitrary files on the server by embedding a crafted path traversal string within a forum post body and then deleting the post. Recommendations Update the wpForo Forum plugin to a version later than 2.4.16.

**Name of the Vulnerable Software and Affected Versions** WP Job Portal plugin for WordPress versions prior to 2.4.9 **Description** The WP Job Portal plugin for WordPress is susceptible to SQL Injection due to inadequate input sanitization and insufficient SQL query preparation. Specifically, the `radius` parameter is not properly escaped, allowing unauthenticated attackers to inject additional SQL queries into existing database queries. This could enable attackers to extract sensitive information from the database. **Recommendations** Update the WP Job Portal plugin to version 2.4.9 or later.