Michael Iden

**Name of the Vulnerable Software and Affected Versions** LatePoint versions prior to 5.5.1 **Description** A weak password recovery mechanism in the unauthenticated guest booking flow allows for account takeover. The `save connected wordpress user()` function uses `wp update user()` to propagate a customer's email address to a linked WordPress user account without ownership verification. This, combined with the ability to overwrite a customer's email through phone-based merge without authentication, allows unauthenticated attackers to change the email address of a non-super-admin WordPress user account not yet linked to a LatePoint customer. Attackers can then trigger the standard WordPress password-reset flow to an address they control. This occurs when the plugin has WordPress user integration enabled, phone-based contact merging active, and customer authentication disabled. **Recommendations** Update to a version later than 5.5.0. As a temporary mitigation, disable WordPress user integration, phone-based contact merging, or enable customer authentication.

Name of the Vulnerable Software and Affected Versions The Awesome Support – WordPress HelpDesk & Support Plugin versions up to and including 6.3.7 Description The Awesome Support – WordPress HelpDesk & Support Plugin is susceptible to an Insecure Direct Object Reference issue. The `wpas get ticket replies ajax()` function does not properly validate user permissions when accessing support tickets. This allows authenticated attackers with subscriber-level access or higher to access sensitive information from all support tickets by manipulating the `ticket id` parameter. Recommendations For versions up to and including 6.3.7, ensure the `wpas get ticket replies ajax()` function properly verifies user permissions before granting access to support ticket data.

Name of the Vulnerable Software and Affected Versions WP Shortcodes Plugin — Shortcodes Ultimate versions through 7.4.10 Description The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `max width` attribute of the `su box` shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. Recommendations Update WP Shortcodes Plugin — Shortcodes Ultimate to a version later than 7.4.10.

**Name of the Vulnerable Software and Affected Versions** Post SMTP plugin for WordPress versions up to and including 3.8.0 **Description** The Post SMTP plugin for WordPress is susceptible to unauthorized data modification because of a missing capability check within the `handle office365 oauth redirect()` function. This function, connected to the `admin init` action without proper authorization or nonce verification, allows authenticated attackers with Subscriber-level access or higher to alter the Office 365 OAuth mail configuration—specifically, the access token, refresh token, and user email—through a specially crafted URL. This configuration is utilized during the Microsoft365 SMTP wizard setup, available in the Pro version of the plugin. An attacker could potentially deceive an Administrator into connecting the plugin to a malicious Azure application, leading to account compromise after upgrading to the Pro version. **Recommendations** Update Post SMTP plugin to a version later than 3.8.0.

**Name of the Vulnerable Software and Affected Versions** Formidable Forms plugin for WordPress versions up to and including 6.28 **Description** The Formidable Forms plugin for WordPress is susceptible to an authorization bypass due to a user-controlled key. This occurs because the `frm strp amount` AJAX handler, also known as `update intent ajax`, overwrites global `$ POST` data with attacker-controlled JSON input. This input is then used to recalculate payment amounts through field shortcode resolution in the `generate false entry()` function. The handler uses a nonce, exposed in the page’s JavaScript (`frm stripe vars.nonce`), which provides CSRF protection but does not enforce authorization. This allows unauthenticated attackers to manipulate PaymentIntent amounts before payment completion on forms utilizing dynamic pricing with field shortcodes, potentially resulting in reduced payment amounts for goods or services. **Recommendations** Versions up to and including 6.28 should be updated to a newer, fixed version when available. As a temporary workaround, consider disabling the `frm strp amount` AJAX handler (`update intent ajax`) until a patch is available. Restrict access to the `generate false entry()` function to authorized users only.