Louis Deschanel

**Name of the Vulnerable Software and Affected Versions** CubeWP Framework versions prior to 1.1.31 **Description** Authenticated users with subscriber-level access and above can perform SQL Injection. The issue exists in the `cubewp remove relation()` AJAX function due to insufficient input sanitization of the `relation id` parameter. The function uses `wp unslash()`, which removes backslash escaping from POST data, and then interpolates the value directly into a raw SQL query without using `$wpdb->prepare()`. While `sanitize text field()` is applied, it does not provide protection against SQL injection, allowing attackers to append additional SQL queries to the existing one. **Recommendations** Update CubeWP Framework to a version newer than 1.1.30. As a temporary workaround, restrict access to the `cubewp remove relation()` function for users with subscriber-level permissions.

**Name of the Vulnerable Software and Affected Versions** Frontend Admin by DynamiApps versions prior to 3.28.29 **Description** The plugin is subject to generic SQL Injection, which occurs when an application fails to properly sanitize or escape user-supplied data before including it in a database query. Authenticated attackers with administrator-level access or higher can append additional SQL queries to extract sensitive information from the database. This is possible via the `order` parameter, provided that a valid `orderby` parameter is also supplied in the same request to reach the vulnerable code path. **Recommendations** Update the plugin to a version later than 3.28.28. As a temporary mitigation, restrict access to the `order` parameter in the affected functionality.

The WP Contact Form 7 DB Handler plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Deletion via SQL Injection and PHP Object Injection in versions up to and including 3.0. This is due to a missing nonce verification in the process bulk action() function, the nonce check is only executed when wpnonce is present in the POST body, allowing it to be trivially bypassed by omitting the field, combined with the use of an unsanitized, unparameterized user-supplied value in a numeric SQL context (WHERE ID = $ID) and the unsafe deserialization of the query result's post content field. An attacker can craft a CSRF page that tricks a logged-in administrator into triggering a UNION-based SQL injection payload (using CHAR() to avoid esc sql quote-escaping) that returns a malicious serialized PHP array as post content; upon deserialization, array values associated with keys containing 'ys cfdbh file' are used as file paths appended to the uploads directory path without any path traversal validation, and then passed to wp delete file(), allowing the attacker to delete arbitrary files on the server (e.g., wp-config.php, system files).

**Name of the Vulnerable Software and Affected Versions** Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress versions prior to 5.0.7 **Description** An issue exists where authenticated attackers with Subscriber-level access and above can perform time-based blind SQL Injection. This occurs due to insufficient escaping of the user-supplied `project search` parameter and a lack of proper preparation of the SQL query. This allows attackers to append additional SQL queries to extract sensitive information from the database. **Recommendations** Update the plugin to a version later than 5.0.6. As a temporary workaround, restrict access to the `project search` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** User Registration & Membership versions prior to 5.1.5 **Description** The User Registration & Membership plugin for WordPress contains an open redirect issue. This occurs because user-supplied URLs provided through the 'redirect to on logout' GET parameter are not sufficiently validated before being processed by the `wp redirect()` function. Although `esc url raw()` is used to sanitize malformed URLs, it fails to restrict the destination to the local domain. This allows an attacker to create a link that redirects users to external malicious websites after they log out, which can be used to facilitate phishing attacks. **Recommendations** Update the plugin to a version later than 5.1.4. As a temporary workaround, restrict access to the 'redirect to on logout' parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Apocalypse Meow plugin for WordPress versions prior to 22.1.0 **Description** The software is susceptible to SQL injection through the `type` parameter. A flawed logical operator in the type validation check allows attacker-controlled single quotes to pass unescaped into SQL queries. This enables authenticated attackers with Administrator-level access or higher to append additional SQL queries, potentially extracting sensitive information from the database. The issue stems from an incorrect use of the '&&' (AND) operator instead of '||' (OR) in the validation process, causing the `in array()` validation to be bypassed. The `stripslashes deep()` function further contributes to the issue by removing `wp magic quotes()` protection. **Recommendations** Update the Apocalypse Meow plugin to version 22.1.0 or later.