Lucas Montes

**Name of the Vulnerable Software and Affected Versions** Ninja Forms - The Contact Form Builder That Grows With You versions prior to 3.14.2 **Description** The Ninja Forms plugin for WordPress is susceptible to sensitive information disclosure. Authenticated attackers with Contributor-level access or higher can potentially access an authorization token. This token allows viewing form submissions for any form, which may include sensitive data. The issue stems from a callback function within the `blocks/bootstrap.php` file, specifically related to the `admin enqueue scripts` action handler. **Recommendations** Update Ninja Forms to version 3.14.2 or later.

**Name of the Vulnerable Software and Affected Versions** Greenshift – animation and page builder blocks plugin for WordPress versions up to and including 12.8.3 **Description** The software is susceptible to an Insecure Direct Object Reference issue. This is a result of a lack of authorization and post status validation within the `gspb el reusable load()` AJAX handler. The handler accepts a `post id` parameter and renders the content of any `wp block` post without verifying user permissions to read the post or checking its status. The nonce is exposed to unauthenticated users on any public page utilizing the `[wp reusable render]` shortcode with `ajax="1"`, allowing unauthenticated attackers to retrieve rendered HTML content from private, draft, or password-protected reusable blocks. **Recommendations** Versions prior to 12.8.4 should be updated.

**Name of the Vulnerable Software and Affected Versions** Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress versions through 8.7.4 **Description** The Blog2Social plugin for WordPress is susceptible to unauthorized data modification. This is due to a missing capability check on the `b2s curation draft` AJAX action. The `curationDraft()` function only verifies `current user can('read')` instead of confirming if the user has `edit post` permission for the specific post. Because the plugin provides UI access and exposes nonces to all roles, authenticated attackers with Subscriber-level access or higher can overwrite the title and content of any post or page. This is achieved by providing a target post ID through the `b2s-draft-id` parameter. **Recommendations** Update to a version beyond 8.7.4.

**Name of the Vulnerable Software and Affected Versions** Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress versions prior to 6.5.2 **Description** The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress is susceptible to Server-Side Request Forgery in versions up to and including 6.5.1. This allows unauthenticated attackers to make web requests to arbitrary locations originating from the web application. Attackers can potentially query and modify information from internal services through the `PassthruLoader::load image source` function. **Recommendations** Update to version 6.5.2 or later.

**Name of the Vulnerable Software and Affected Versions** Migration, Backup, Staging – WPvivid Backup & Migration versions prior to 0.9.124 **Description** The plugin is subject to an unauthenticated arbitrary file upload that can lead to remote code execution and full site takeover. This issue affects approximately 800,000 to 900,000 devices worldwide. The flaw exists when the "receive a backup from another site" feature is enabled, which generates a key that expires within 24 hours. Technical details involve improper error handling during the RSA decryption process. When the `openssl private decrypt()` function fails, the plugin passes a boolean false value to the phpseclib library's AES cipher initialization. The library interprets this as a string of null bytes, allowing an attacker to encrypt a malicious payload using a predictable null-byte key. Furthermore, a lack of path sanitization allows directory traversal to escape the protected backup directory and write PHP files to public directories via the 'wpvivid action=send to site' endpoint. **Recommendations** Update to version 0.9.124 or later. Disable the "receive backup from another site" feature unless it is strictly necessary.

**Name of the Vulnerable Software and Affected Versions** libsoup (affected versions not specified) **Description** An unsigned to signed conversion error exists in the `soup body input stream read chunked()` function. A remote attacker can exploit this by sending a malicious HTTP request when libsoup is used behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. This can lead to HTTP request smuggling, allowing the attacker to bypass security controls, poison web caches, or gain unauthorized access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Simply Schedule Appointments Booking Plugin versions prior to 1.6.9.6 **Description** The Appointment Booking Calendar – Simply Schedule Appointments Booking Plugin for WordPress is susceptible to sensitive information exposure due to the use of a hardcoded fall-back salt within the `hash()` function. This allows unauthenticated attackers to generate a valid token on sites utilizing the plugin that haven’t manually configured a salt in the `wp-config.php` file. Successful exploitation enables access to booking information, potentially allowing attackers to make modifications. **Recommendations** Update the Simply Schedule Appointments Booking Plugin to version 1.6.9.6 or later. Manually set a salt in the `wp-config.php` file to prevent the use of the hardcoded fall-back salt.

**Name of the Vulnerable Software and Affected Versions** Ninja Forms – The Contact Form Builder That Grows With You versions up to and including 3.13.2 **Description** The Ninja Forms plugin for WordPress is susceptible to an Insecure Direct Object Reference issue. The plugin does not adequately verify user authorization before the `ninja-forms-views` REST endpoints return form metadata and submission content. This allows unauthenticated attackers to read arbitrary form definitions and submission records if they can obtain a leaked bearer token and load a page containing the Submissions Table block. A patch released in version 3.13.1 was found to be ineffective as it introduced a REST API endpoint that allowed the creation of valid bearer tokens for arbitrary form IDs. **Recommendations** Versions prior to 3.13.1 are vulnerable. Versions 3.13.1 and 3.13.2 are vulnerable. Restrict access to the `ninja-forms-views` REST API endpoints. Monitor bearer tokens for suspicious activity.

**Name of the Vulnerable Software and Affected Versions** Feedzy RSS Aggregator plugin for WordPress versions up to and including 5.1.1 **Description** The Feedzy RSS Aggregator plugin for WordPress is susceptible to a Blind Server-Side Request Forgery (SSRF) issue. This allows unauthenticated attackers to initiate web requests to arbitrary locations from the web application. Exploitation can lead to querying and modification of information from internal services. **Recommendations** Update to version 5.1.2.

**Name of the Vulnerable Software and Affected Versions** LearnPress – WordPress LMS Plugin versions prior to 4.2.9.5 **Description** The LearnPress – WordPress LMS Plugin for WordPress is affected by a sensitive information disclosure issue. Missing capability checks in the REST endpoint `/wp-json/lp/v1/load content via ajax` allow arbitrary callback execution of admin-only template methods. This enables unauthenticated attackers to retrieve sensitive educational content, including admin curriculum HTML, quiz questions with correct answers, and course materials, by supplying valid numeric IDs to the REST API endpoint. The vulnerable parameter is the numeric ID supplied to the `/wp-json/lp/v1/load content via ajax` endpoint. **Recommendations** Versions prior to 4.2.9.5 should be updated.

**Name of the Vulnerable Software and Affected Versions** Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links plugin for WordPress versions through 1.2.5 **Description** The plugin is susceptible to unauthorized post modification because of insufficient authorization checks. The plugin registers a REST API endpoint that verifies a broad capability (`aioseo blc broken links page`) granted to contributor-level users, without validating the user’s permission to act on the specific post. This allows authenticated attackers with contributor access or higher to delete arbitrary posts using the **API endpoint** `/wp-json/aioseoBrokenLinkChecker/v1/post`. The **vulnerable parameter** is the post identifier used in the DELETE request. **Recommendations** Update the Broken Link Checker by AIOSEO plugin to a version beyond 1.2.5.

**Name of the Vulnerable Software and Affected Versions** Envira Photo Gallery versions up to and including 1.11.0 **Description** The Envira Photo Gallery plugin for WordPress is susceptible to unauthorized data modification. This is due to a missing capability check on the `/envira-convert/v1/bulk-convert` API endpoint. Authenticated attackers with contributor-level access or higher can convert galleries to Envira galleries. The vulnerable parameter is not specified. **Recommendations** Update Envira Photo Gallery to a version newer than 1.11.0.

**Name of the Vulnerable Software and Affected Versions** ElementInvader Addons for Elementor versions prior to 1.4.1 **Description** The ElementInvader Addons for Elementor WordPress plugin is affected by a missing authorization check. An unauthenticated user can send arbitrary emails to arbitrary addresses through the `elementinvader addons for elementor forms send form` action. **Recommendations** Update ElementInvader Addons for Elementor to version 1.4.1 or later.

**Name of the Vulnerable Software and Affected Versions** GenerateBlocks plugin for WordPress versions through 2.1.1 **Description** The GenerateBlocks plugin for WordPress has a flaw that allows unauthorized access to data. This is due to a missing capability check within the `get option rest` function. Authenticated attackers with contributor-level access or higher can read arbitrary WordPress options. This includes sensitive information such as SMTP credentials and API keys stored by other plugins. **Recommendations** Update the GenerateBlocks plugin to a version later than 2.1.1.

**Name of the Vulnerable Software and Affected Versions** Product Filter by WBW versions up to and including 3.0.0 **Description** The Product Filter by WBW plugin for WordPress has a flaw where data can be modified without authorization. This is due to a missing capability check on the 'approveNotice' action. Unauthenticated attackers can potentially update the plugin’s settings. **Recommendations** Update the Product Filter by WBW plugin to a version later than 3.0.0.

**Name of the Vulnerable Software and Affected Versions** Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress versions up to and including 5.1.0 **Description** The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is susceptible to Server-Side Request Forgery. This allows authenticated attackers with Subscriber-level access or higher to make web requests to arbitrary locations from the web application. This can be used to query information from internal services via the `feedzy sanitize feeds` function. **Recommendations** Update Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress to a version later than 5.1.0.

**Name of the Vulnerable Software and Affected Versions** LearnPress – WordPress LMS Plugin versions up to and including 4.2.9.2 **Description** The LearnPress – WordPress LMS Plugin is susceptible to data modification due to absent capability checks on Admin Tools REST endpoints. These endpoints are registered with ` return true` as the permission callback, allowing unauthenticated attackers to perform destructive database operations. Specifically, attackers can drop indexes on any table, including WordPress core tables like `wp options`, create duplicate configuration entries, and degrade site performance. This is achievable through the `/wp-json/lp/v1/admin/tools/create-indexs` endpoint by providing table names. **Recommendations** Update to version 4.2.9.4 or later.

**Name of the Vulnerable Software and Affected Versions** WPC Smart Quick View for WooCommerce plugin versions through 4.2.5 **Description** The WPC Smart Quick View for WooCommerce plugin for WordPress has an information exposure issue. Insufficient restrictions on posts included via the `woosq quickview` API endpoint allows unauthenticated attackers to extract data from password-protected, private, or draft products that they should not have access to. **Recommendations** Update the WPC Smart Quick View for WooCommerce plugin to a version later than 4.2.5.

**Name of the Vulnerable Software and Affected Versions** Media Library Assistant plugin for WordPress versions prior to 3.30 **Description** The Media Library Assistant plugin for WordPress is susceptible to limited file reading through the `mla-stream-image.php` file. This allows unauthenticated attackers to read the contents of arbitrary ai, eps, pdf, and ps files on the server, potentially exposing sensitive information. **Recommendations** Update to version 3.30 or later.

**Name of the Vulnerable Software and Affected Versions** Quick Featured Images plugin for WordPress versions prior to 13.7.3 **Description** The Quick Featured Images plugin for WordPress is susceptible to an Insecure Direct Object Reference issue in versions up to and including 13.7.2. This flaw is present in the `qfi set thumbnail` and `qfi delete thumbnail` AJAX actions due to a lack of validation on a user-controlled key. Authenticated attackers with Author-level access or higher can exploit this to modify or remove featured images from posts belonging to other users. The vulnerable key allows direct access to objects without proper authorization checks. **Recommendations** Update the Quick Featured Images plugin to version 13.7.3 or later.