Nabil Irawan

**Name of the Vulnerable Software and Affected Versions** Premmerce Dev Tools versions prior to 2.1 **Description** The Premmerce Dev Tools plugin for WordPress allows authenticated attackers with Subscriber-level access and above to achieve remote code execution. The issue occurs because the `generatePluginHandler()` function does not perform authorization checks before processing user-supplied POST data. Additionally, the `createFromStub()` function performs unsanitized string substitution of the `premmerce plugin namespace` parameter into PHP stub files saved in the wp-content/plugins/ directory. An attacker can inject a semicolon and arbitrary PHP code into the `premmerce plugin namespace` parameter, resulting in the creation and execution of a malicious PHP file when accessed via HTTP. **Recommendations** Update the plugin to a version later than 2.0. As a temporary workaround, restrict access to the `generatePluginHandler()` function to prevent unauthorized users from processing POST data.

The FPW Category Thumbnails plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'fpw fs get file' AJAX action in all versions up to, and including, 1.9.5. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the plugin's settings page.

**Name of the Vulnerable Software and Affected Versions** BirdSeed versions prior to 2.2.1 **Description** The BirdSeed plugin for WordPress is subject to Cross-Site Request Forgery. This occurs because the `birdseed plugin settings page()` function fails to perform nonce validation—a security mechanism used to ensure that a request was intentionally sent by the user. The function processes the `birdseed token` GET parameter and saves it to the database using `update option()` without verification. Consequently, unauthenticated attackers can modify the plugin's BirdSeed token setting by tricking a site administrator into clicking a malicious link. **Recommendations** Update to a version later than 2.2.0. As a temporary workaround, restrict administrative access to the plugin settings page to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** bPlugins Tiktok Feed versions prior to 1.0.25 **Description** A missing authorization issue exists due to incorrectly configured access control security levels, which allows for broken access control. **Recommendations** Update to a version later than 1.0.24.

Cross-Site Request Forgery (CSRF) vulnerability in Recorp Export WP Page to Static HTML/CSS allows Cross Site Request Forgery. This issue affects Export WP Page to Static HTML/CSS: from n/a through 6.0.0.

Missing Authorization vulnerability in Lucian Apostol Auto Affiliate Links allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Auto Affiliate Links: from n/a through 6.8.8.3.

Missing Authorization vulnerability in WPPOOL FlexTable allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects FlexTable: from n/a through 3.24.0.

**Name of the Vulnerable Software and Affected Versions** VillaTheme HAPPY versions prior to 1.0.11 **Description** A missing authorization issue in VillaTheme HAPPY allows for the exploitation of incorrectly configured access control security levels. **Recommendations** Update to version 1.0.11 or later.

The 診断ジェネレータ作成プラグイン (Diagnosis Generator) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'js' parameter in versions up to and including 1.4.16. This is due to missing authorization checks and insufficient input sanitization in the themeFunc() function. The function is hooked to 'admin init' and processes theme update requests without verifying user capabilities, allowing any authenticated user (including subscribers) to save malicious JavaScript to theme files. Additionally, the save() function uses stripslashes() which removes WordPress's magic quotes protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in theme files that will execute whenever a user accesses a page containing the diagnosis form shortcode.

**Name of the Vulnerable Software and Affected Versions** Form Notify versions prior to 1.1.11 **Description** The Form Notify plugin for WordPress allows authentication bypass because it trusts user-controlled cookie data to determine the WordPress account to authenticate following a LINE OAuth login. If LINE does not provide an email address, the plugin uses the value of the `form notify line email` cookie without verifying the association between the LINE account and that email. This allows unauthenticated attackers to gain access to any user account, including administrator accounts, by completing a LINE OAuth flow with their own account while injecting a cookie containing the target victim's email address. **Recommendations** Update the plugin to a version later than 1.1.10.

**Name of the Vulnerable Software and Affected Versions** WP Mail Gateway versions prior to 1.9 **Description** The plugin is subject to unauthorized access because of a missing capability check on the 'wmg save provider config' AJAX action. Authenticated attackers with Subscriber-level access or higher can update SMTP settings and redirect mail. This can lead to privilege escalation by triggering a password reset email to gain access to an administrator account. **Recommendations** Update the plugin to a version later than 1.8. As a temporary workaround, restrict access to the 'wmg save provider config' AJAX action to authorized users only.

**Name of the Vulnerable Software and Affected Versions** Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid versions prior to 1.17.2 **Description** The plugin is susceptible to unauthorized data modification because the `wp ajax cli cancel()` function lacks a proper capability check. This allows unauthenticated attackers to cancel a pending rollback, which may prevent a WordPress installation from automatically reverting a failed update. **Recommendations** Update to a version later than 1.17.1. As a temporary workaround, restrict access to the `wp ajax cli cancel()` function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** The Ultimate Dashboard versions prior to 3.8.15 **Description** Cross-Site Request Forgery occurs due to a flawed nonce validation conditional in the `handle module actions()` function. This allows unauthenticated attackers to toggle plugin modules on or off by tricking a site administrator into clicking a forged link. **Recommendations** Update to a version later than 3.8.14.

**Name of the Vulnerable Software and Affected Versions** CalJ versions prior to 1.6 **Description** The CalJ plugin for WordPress contains a missing authorization flaw. The `CalJSettingsPage` class constructor processes the 'save-obtained-key' operation from POST data without verifying if the user possesses the `manage options` capability and without performing nonce verification. Because the `calj.php` bootstrap file instantiates `CalJSettingsPage` for any authenticated user accessing wp-admin URLs, such as 'admin-ajax.php', users with Subscriber-level access or higher can modify the API key setting and clear the Shabbat cache, allowing them to control the API integration. **Recommendations** Update to a version later than 1.5.

**Name of the Vulnerable Software and Affected Versions** TP Restore Categories And Taxonomies versions prior to 1.0.2 **Description** The plugin is affected by missing authorization. The `delete term()` function, which processes the 'tpmcattt delete term' AJAX action, fails to perform capability checks to verify if a user has the necessary permissions. Although a nonce is verified via `check ajax referer()`, this nonce is available to all authenticated users on any wp-admin page. Consequently, authenticated attackers with Subscriber-level access or higher can permanently delete taxonomy term records from the trash or backup tables by sending a crafted AJAX request containing a valid nonce and a specific `term id`. **Recommendations** Update to a version later than 1.0.1. As a temporary workaround, restrict access to the `delete term()` function or the 'tpmcattt delete term' AJAX action to users with higher administrative privileges.

**Name of the Vulnerable Software and Affected Versions** Sendmachine for WordPress versions prior to 1.0.21 **Description** An authorization bypass exists via the `manage admin requests()` function because the plugin fails to properly verify if a user is authorized to perform an action. This allows unauthenticated attackers to overwrite the SMTP configuration, enabling the interception of all outbound emails from the site, including password reset emails. **Recommendations** Update to a version later than 1.0.20. As a temporary workaround, consider restricting access to the `manage admin requests()` function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** WP Docs versions prior to 2.3.0 **Description** The WP Docs plugin for WordPress contains a Stored Cross-Site Scripting issue. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts into pages via the `wpdocs options[icon size]` parameter. This occurs because the application fails to properly sanitize input and escape output, allowing the scripts to execute when a user visits the affected page. **Recommendations** Update to a version later than 2.2.9. As a temporary workaround, restrict access to the `wpdocs options[icon size]` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** BuddyPress Groupblog plugin for WordPress versions up to and including 1.9.3 **Description** The BuddyPress Groupblog plugin for WordPress is susceptible to Privilege Escalation. The group blog settings handler accepts the `groupblog-blogid`, `default-member`, and `groupblog-silent-add` parameters from user input without proper authorization checks. The `groupblog-blogid` parameter allows group admins to associate their group with any blog on the Multisite network, including the main site. The `default-member` parameter accepts any WordPress role, including `administrator`, without validation. When combined with `groupblog-silent-add`, any user who joins the attacker's group is automatically added to the targeted blog with the injected role. This allows attackers with Subscriber-level access and above to escalate users to Administrator on the main site of the Multisite network. **Recommendations** Update BuddyPress Groupblog plugin to a version later than 1.9.3.

Name of the Vulnerable Software and Affected Versions Ziggeo plugin for WordPress versions through 3.1.1 Description The Ziggeo plugin for WordPress is susceptible to missing authorization checks. The `wp ajax ziggeo ajax` handler verifies a nonce but does not confirm user capabilities using `current user can()`. The nonce (`ziggeo ajax nonce`) is publicly exposed to all logged-in users through the `wp head` and `admin head` hooks. This allows authenticated attackers with Subscriber-level access or higher to perform administrative actions, including saving arbitrary translation strings via the `update option('ziggeo translations')` function, creating, updating, and deleting event templates via `update option('ziggeo events')`, modifying SDK application settings, and managing notifications via `update option('ziggeo notifications')`. Recommendations Versions prior to 3.1.2 should be updated. As a temporary workaround, consider disabling the `wp ajax ziggeo ajax` handler until a patch is available.

Name of the Vulnerable Software and Affected Versions DSGVO Google Web Fonts GDPR plugin for WordPress versions up to and including 1.1 Description The DSGVO Google Web Fonts GDPR plugin for WordPress is susceptible to arbitrary file upload due to the absence of file type validation in the `DSGVOGWPdownloadGoogleFonts()` function. This function is accessible through a `wp ajax nopriv ` hook, meaning no authentication is required. The function retrieves a URL provided by the user as a CSS file, extracts URLs from its content, and downloads these files to a publicly accessible directory without validating the file type. This allows unauthenticated attackers to upload arbitrary files, including PHP webshells, potentially leading to remote code execution. The exploit requires the use of one of the following themes: twentyfifteen, twentyseventeen, twentysixteen, storefront, salient, or shapely. Recommendations Versions up to and including 1.1: Update to a version that addresses the file type validation issue.