Marcin Dudek

**Name of the Vulnerable Software and Affected Versions** The SEO Plugin by Squirrly SEO plugin for WordPress versions through 12.4.14 **Description** The SEO Plugin by Squirrly SEO plugin for WordPress is susceptible to unauthorized data modification. This is due to a missing capability check within the `sq ajax uninstall` function. Authenticated attackers with Subscriber-level access or higher can disconnect the site from Squirrly's cloud service. **Recommendations** Update to a version later than 12.4.14.

**Name of the Vulnerable Software and Affected Versions** Razorpay for WooCommerce plugin for WordPress versions through 4.7.8 **Description** The Razorpay for WooCommerce plugin for WordPress is susceptible to unauthorized data modification. A missing capability check within the `getCouponList()` function, stemming from the `checkAuthCredentials()` permission callback consistently returning true, bypasses authentication. This allows unauthenticated attackers to alter billing and shipping contact details (email and phone) of any WooCommerce order, given knowledge or a guess of the order ID. **Recommendations** Update the Razorpay for WooCommerce plugin to a version beyond 4.7.8.

**Name of the Vulnerable Software and Affected Versions** SlimStat Analytics plugin for WordPress versions prior to 5.3.2 **Description** The SlimStat Analytics plugin for WordPress is susceptible to a time-based SQL Injection issue. This is due to inadequate escaping of user-supplied input and insufficient preparation of existing SQL queries, specifically through the `args` parameter. Authenticated attackers with Subscriber-level access or higher can inject additional SQL queries into existing ones, potentially extracting sensitive information from the database. **Recommendations** Update to a version prior to 5.3.2.

**Name of the Vulnerable Software and Affected Versions** Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress versions through 6.1.7 **Description** The Fluent Forms plugin for WordPress is affected by a missing authorization issue. Capability checks are absent on the `fluentform ai create form` AJAX action, allowing authenticated attackers with Subscriber-level access or higher to create arbitrary forms through the AI builder. **Recommendations** Update to a version beyond 6.1.7.

**Name of the Vulnerable Software and Affected Versions** PixelYourSite versions up to and including 11.1.5 **Description** The PixelYourSite plugin for WordPress is susceptible to sensitive information disclosure through publicly exposed log files. An unauthenticated attacker may be able to view potentially sensitive information contained within these logs when the "Meta API logs" setting is enabled. The issue was addressed with a partial patch in version 11.1.5 and a full patch in version 11.1.5.1. **Recommendations** Update to version 11.1.5.1 or later. Disable the "Meta API logs" setting.

**Name of the Vulnerable Software and Affected Versions** Print Invoice & Delivery Notes for WooCommerce versions up to and including 5.8.0 **Description** The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is susceptible to Remote Code Execution due to a missing capability check within the `WooCommerce Delivery Notes::update` function, the presence of PHP enabled in Dompdf, and a lack of proper escaping in the `template.php` file. This combination allows unauthenticated attackers to potentially execute code on the server. The `WooCommerce Delivery Notes::update` function is a key component involved in the issue. **Recommendations** Versions up to and including 5.8.0 should be updated to a newer, fixed version when available. As a temporary workaround, consider disabling the `WooCommerce Delivery Notes::update` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** PostX plugin for WordPress versions up to and including 5.0.3 **Description** The PostX plugin for WordPress is affected by a flaw that allows unauthorized access to data. A missing capability check on the `/ultp/v2/get dynamic content/` REST API endpoint allows unauthenticated attackers to retrieve sensitive user metadata, including password hashes. **Recommendations** Update the PostX plugin to a version newer than 5.0.3.

**Name of the Vulnerable Software and Affected Versions** Simply Schedule Appointments Booking Plugin for WordPress versions prior to 1.6.9.16 **Description** The plugin exposes its admin embed endpoint at `/wp-json/ssa/v1/embed-inner-admin` without authentication. This exposure leaks plugin settings, including staff names, business names, and configuration data not publicly displayed on the booking form. Unauthenticated attackers can extract private business configuration. In premium versions with integrations configured, this may also expose sensitive data including API keys for external services. **Recommendations** Update to a version later than 1.6.9.16.

**Name of the Vulnerable Software and Affected Versions** The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress versions up to and including 6.3.2 **Description** The plugin is susceptible to unauthorized data modification because of a missing capability check on the `/webp-converter/v1/regenerate-attachment` REST endpoint. This allows authenticated attackers with Subscriber-level access or higher to delete optimized WebP/AVIF variants for any attachment. The affected API endpoint is `/webp-converter/v1/regenerate-attachment`. **Recommendations** Versions prior to and including 6.3.2 should be updated.

**Name of the Vulnerable Software and Affected Versions** Ninja Forms – The Contact Form Builder That Grows With You versions up to and including 3.13.2 **Description** The Ninja Forms plugin for WordPress is susceptible to an Insecure Direct Object Reference issue. The plugin does not adequately verify user authorization before the `ninja-forms-views` REST endpoints return form metadata and submission content. This allows unauthenticated attackers to read arbitrary form definitions and submission records if they can obtain a leaked bearer token and load a page containing the Submissions Table block. A patch released in version 3.13.1 was found to be ineffective as it introduced a REST API endpoint that allowed the creation of valid bearer tokens for arbitrary form IDs. **Recommendations** Versions prior to 3.13.1 are vulnerable. Versions 3.13.1 and 3.13.2 are vulnerable. Restrict access to the `ninja-forms-views` REST API endpoints. Monitor bearer tokens for suspicious activity.

**Name of the Vulnerable Software and Affected Versions** Booking Calendar plugin for WordPress versions prior to 10.14.9 **Description** The Booking Calendar plugin for WordPress is susceptible to a time-based blind SQL injection. This occurs due to insufficient escaping of the `dates to check` parameter and inadequate preparation of existing SQL queries. This allows unauthenticated attackers to append additional SQL queries, potentially extracting sensitive information from the database. The vulnerable parameter is `dates to check`. **Recommendations** Update the Booking Calendar plugin to version 10.14.9 or later.

**Name of the Vulnerable Software and Affected Versions** OneSignal – Web Push Notifications plugin for WordPress versions through 3.6.1 **Description** The OneSignal – Web Push Notifications plugin for WordPress is susceptible to unauthorized modification of data. This occurs because of a missing capability check when handling settings, allowing attackers to directly modify the OneSignal App ID, REST API key, and notification behavior through POST requests without authentication. The plugin processes POST requests without verifying user capabilities or nonces. **Recommendations** Update to version 3.6.2 or later.

**Name of the Vulnerable Software and Affected Versions** FunnelKit - Funnel Builder for WooCommerce Checkout plugin for WordPress versions through 3.13.1.5 **Description** The software is susceptible to a time-based blind SQL Injection issue via the `opid` parameter. This is due to inadequate input sanitization and insufficient query preparation. An unauthenticated attacker can inject additional SQL queries into existing database queries, potentially extracting sensitive information. **Recommendations** Versions prior to 3.13.1.5 should be updated.

**Advanced Custom Fields: Extended and Affected Versions** Advanced Custom Fields: Extended versions 0.9.0.5 through 0.9.1.1 **Description** The Advanced Custom Fields: Extended plugin for WordPress has a flaw that allows for Remote Code Execution (RCE). This is due to the `prepare form()` function accepting user input and passing it through `call user func array()`. This allows unauthenticated attackers to execute arbitrary code on the server, potentially enabling them to inject backdoors or create new administrative user accounts. Approximately 100,000 WordPress sites are estimated to be affected. Attackers can exploit this by sending a specially crafted request to the server. The `prepare form()` function is the point of entry for this issue. **Recommendations** Update to Advanced Custom Fields: Extended version 0.9.2 or later.

**Name of the Vulnerable Software and Affected Versions** Welcart e-Commerce plugin for WordPress versions prior to 2.11.25 **Description** The Welcart e-Commerce plugin for WordPress has a flaw that allows unauthorized access to data. This is due to a missing capability check on the `usces export` action. An unauthenticated attacker can access configured payment credentials (such as PayPal API secrets), business contact details, mail templates, and other operational settings tied to the store. **Recommendations** Update to version 2.11.25 or later.

**Name of the Vulnerable Software and Affected Versions** TEL-STER TelWin SCADA WebInterface (affected versions not specified) **Description** The issue is related to the TEL-STER TelWin SCADA WebInterface, where external input could be used to construct paths to files and directories without properly neutralizing special elements within the pathname. This could allow an unauthenticated attacker to read files on the system. The vulnerability is associated with incorrect restriction of the directory path name with limited access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Weintek cMT (affected versions not specified) **Description** The issue concerns a cross-site scripting vulnerability that could allow an unauthenticated remote attacker to inject malicious JavaScript code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Weintek cMT (affected versions not specified) **Description** The issue allows an unauthenticated remote attacker to execute commands with root privileges on the operation system due to code injection. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Weintek cMT (affected versions not specified) **Description** The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate administrator. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WebHMI (affected versions not specified) **Description** The issue allows an attacker to upload or transfer files of dangerous types to the WebHMI portal. These files may be automatically processed within the product's environment, potentially leading to arbitrary code execution. The vulnerability is related to the lack of restrictions on file uploads. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.