Mike Gozdiskowski

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account, including an administrator, resulting in full account takeover.

**Name of the Vulnerable Software and Affected Versions** LA-Studio Element Kit for Elementor versions prior to 1.6.1 **Description** The plugin fails to verify if user registration is enabled on the site before creating an account via an unauthenticated AJAX action. This allows unauthenticated attackers to register new accounts even when site-wide registration is disabled. **Recommendations** Update LA-Studio Element Kit for Elementor to version 1.6.1 or later.

**Name of the Vulnerable Software and Affected Versions** EscortWP versions prior to 3.6.3 **Description** The EscortWP WordPress theme contains a vendor-authored, obfuscated backdoor. This allows an unauthenticated attacker using a hard-coded, per-build key to permanently delete all site content. Additionally, the backdoor covertly transmits the site URL, administrator email address, and license key to a third-party server. **Recommendations** Update EscortWP to a version newer than 3.6.2.

**Name of the Vulnerable Software and Affected Versions** uncanny-automator-pro WordPress plugin versions prior to 7.3.0.6 **Description** The software was distributed with malicious code following a compromise of the vendor's update and distribution infrastructure. This supply chain compromise introduced a backdoor that allows unauthenticated attackers to obtain an administrator session on affected sites. Additionally, the malicious code beacons the site's secret keys and administrator details to servers controlled by the attacker. **Recommendations** Update uncanny-automator-pro WordPress plugin to version 7.3.0.6 or later.

**Name of the Vulnerable Software and Affected Versions** Real Testimonials Pro (affected versions not specified) Product Slider Pro for WooCommerce (affected versions not specified) Smart Post Show Pro (affected versions not specified) **Description** A supply chain compromise occurred where attackers infiltrated the build and distribution pipeline of ShapedPlugin. This allowed the injection of a multi-stage backdoor into Pro plugin releases distributed through official licensed update channels. Unauthenticated attackers can achieve full backdoor access to affected sites. The malware facilitates credential theft, database leaks, and the exfiltration of 2FA secrets (TOTP seeds) from plugins such as WP 2FA, Wordfence Login Security, Really Simple SSL, and Two-Factor, effectively bypassing multi-factor authentication. Technical details include a stage 1 loader in `src/Includes/LicenseLoader.php` that executes on `admin init` and beacons to a command-and-control server. A stage 2 payload is dropped into `wp-content/plugins/woocommerce-subscription/`, which hides itself using the `all plugins` filter. This payload includes a REST API backdoor at the endpoint '/wp-json/wc/v3/settings/apply', a URL parameter webshell, and a login bypass utilizing a hardcoded MD5 hash `e268c35a06d85f672e70c9beecb4e5d1`. **Recommendations** Update the affected plugins immediately to the latest patched versions. As a temporary mitigation, restrict access to the '/wp-json/wc/v3/settings/apply' endpoint and monitor the `src/Includes/LicenseLoader.php` file for unauthorized activity.

**Name of the Vulnerable Software and Affected Versions** Guest posting / Frontend Posting / Front Editor WordPress plugin versions prior to 5.0.6 **Description** The plugin allows passing a URL parameter to regenerate a .json file based on demo data. If an administrator modifies the demo form and enables admin notifications, an unauthenticated attacker can export and download all form data and settings, including the administrator's email address. The vulnerable functionality involves the regeneration of a `.json` file based on demo data using a URL parameter. **Recommendations** Update the Guest posting / Frontend Posting / Front Editor WordPress plugin to version 5.0.6 or later.

Name of the Vulnerable Software and Affected Versions: Disable-right-click-powered-by-pixterme versions through 1.2 pixter-image-digital-license versions through 1.0 Description: The Disable-Right-Click and Pixter Image Digital License WordPress plugins load a compromised JavaScript file from an abandoned S3 bucket. This allows unauthorized access and potential control of the plugin by the entity controlling the compromised bucket. Currently, the compromised file displays an alert marketing security services, with users who pay being added to allowedDomains to suppress the popup. Recommendations: Disable-right-click-powered-by-pixterme versions prior to 1.2 should be updated. pixter-image-digital-license versions prior to 1.0 should be updated.

**Name of the Vulnerable Software and Affected Versions** Order Delivery Date WordPress plugin versions prior to 12.3.1 **Description** The issue concerns a lack of authorization and CSRF checks when importing settings in the Order Delivery Date WordPress plugin. This allows attackers to modify sensitive options, such as `default user role` to administrator and `users can register`, enabling them to register as an administrator of the site and gain complete control. **Recommendations** For versions prior to 12.3.1, update to version 12.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the settings import functionality until a patch is applied. Additionally, monitor user registrations and role assignments closely to detect any potential malicious activity.