Pedro Pinho

The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is satisfiable with client-supplied request headers, allowing unauthenticated attackers to redirect outgoing emails, including the WordPress administrator password-reset email, to an address they control and take over the administrator account.

The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the site owner's configured email service mailing lists, allowing unauthenticated attackers to enrol arbitrary email addresses into those lists using the owner's stored API credentials.

The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid, allowing unauthenticated attackers to complete WooCommerce orders without paying.

The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects, which can lead to remote code execution when a suitable gadget chain is present through another installed Remote API WordPress plugin through 0.2.

The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata (a like counter and an associated identifier list) on arbitrary posts, including inflating the counter and growing the stored metadata without bound.

**Name of the Vulnerable Software and Affected Versions** TrueBooker versions prior to 1.2.4 **Description** An issue exists in the TrueBooker WordPress plugin where account ownership is not validated during the password reset process via a front-end account handler. This allows unauthenticated attackers to set an arbitrary password for any account, including those with administrator privileges, leading to full site takeover. **Recommendations** Update TrueBooker to version 1.2.4 or later.

**Name of the Vulnerable Software and Affected Versions** FacturaONE para WooCommerce con VeriFactu WordPress plugin versions prior to 5.37 **Description** An authentication failure in a request handler allows unauthenticated attackers to write arbitrary files into a web-accessible directory. This occurs because the handler relies on a cryptographic key that remains empty by default in an unconfigured state, leading to remote code execution. **Recommendations** Update the plugin to version 5.37 or later.

**Name of the Vulnerable Software and Affected Versions** Clover Payment Gateway by Zaytech for WooCommerce WordPress versions prior to 1.3.6 **Description** The plugin fails to verify if an approved external payment record is associated with the specific WooCommerce order being completed and does not check if the paid amount matches the order total. This allows unauthenticated users to mark arbitrary orders as paid by replaying a single genuinely-approved payment reference, such as one obtained from a small personal purchase. **Recommendations** Update Clover Payment Gateway by Zaytech for WooCommerce WordPress to version 1.3.6 or later.

**Name of the Vulnerable Software and Affected Versions** WowOptin: Next-Gen Popup Maker versions prior to 1.4.38 **Description** Insufficient authorization on a REST endpoint allows unauthenticated users to disable all opt-in forms on the site and insert new template-based opt-in rows into the database. **Recommendations** Update WowOptin: Next-Gen Popup Maker to version 1.4.38 or later.

**Name of the Vulnerable Software and Affected Versions** Social Login, Passkeys, Magic Link & Email OTP versions prior to 1.4.1 **Description** An issue exists in the passwordless email one-time-password verification process where rate limiting and attempt lockouts are not enforced. Additionally, the short numeric codes are stored in plaintext. This allows an unauthenticated attacker with knowledge of a registered email address to brute-force the verification code and gain unauthorized access to any user account, including those with administrator privileges, resulting in a full site takeover. **Recommendations** Update to version 1.4.1 or later.

**Name of the Vulnerable Software and Affected Versions** PayPlus Payment Gateway WordPress plugin versions prior to 8.2.2 **Description** An issue exists where the plugin fails to perform authorization or order-ownership validation in an AJAX action accessible to unauthenticated users. This allows an attacker to tamper with payment-related metadata of arbitrary WooCommerce orders. **Recommendations** Update the PayPlus Payment Gateway WordPress plugin to version 8.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** Everest Forms WordPress plugin versions prior to 3.5.0 **Description** Insufficient access restrictions in the onboarding assistant's REST API endpoints allow unauthenticated attackers to bypass capability checks. This bypass occurs because the check is only triggered when a specific value is present in a request header; omitting or modifying this header allows unauthorized access. Consequently, attackers can read onboarding status information, modify plugin options, and trigger emails from the site to arbitrary addresses. **Recommendations** Update Everest Forms WordPress plugin to version 3.5.0 or later.

**Name of the Vulnerable Software and Affected Versions** AllCoach versions prior to 1.0.2 **Description** The plugin fails to verify if an email address submitted to a public account-registration endpoint is already associated with an existing user before overwriting that user's password. This allows unauthenticated attackers to reset the password of arbitrary accounts, including administrators, and take over the website. **Recommendations** Update to version 1.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** InPost PL versions prior to 1.9.1 **Description** The InPost PL WordPress plugin fails to verify if a request originates from the legitimate buyer when updating the WooCommerce order parcel-locker destination. This allows unauthenticated attackers to silently redirect the shipping destination of any order currently in pending or processing status. **Recommendations** Update to version 1.9.1 or later.

**Name of the Vulnerable Software and Affected Versions** Eupago Gateway For Woocommerce WordPress plugin versions prior to 4.7.2 **Description** The plugin fails to properly restrict access to its refund request handler. This allows unauthenticated attackers to initiate refunds for any WooCommerce order using the merchant's payment gateway credentials. For certain payment methods, this can be used to redirect the refunded funds to a bank account controlled by the attacker. **Recommendations** Update to version 4.7.2 or later.

**Name of the Vulnerable Software and Affected Versions** Fluent Forms WordPress plugin versions prior to 6.2.1 PAN-OS versions prior to 10.2.9-h1 PAN-OS versions prior to 11.0.4-h2 PAN-OS versions prior to 11.1.2-h3 **Description** Fluent Forms contains an issue where ownership is not properly verified before processing subscription cancellation requests, allowing authenticated users with low-privilege accounts to cancel subscriptions belonging to other users. PAN-OS is affected by an unauthenticated remote root code execution flaw in the `mgmtsrvr` and `authd` processes. The issue occurs during the parsing of Security Assertion Markup Language (SAML) authentication requests, where a flaw in the sanitization routine allows shell metacharacters to be passed to a backend system command used for certificate verification. An attacker can embed a command string within the `Issuer` tag of a specially crafted XML request sent to the GlobalProtect portal or the management web interface. This results in the execution of the malicious string via a `system()` call with root privileges, potentially allowing the installation of a kernel-level rootkit and the decryption of SSL/TLS traffic. **Recommendations** Update Fluent Forms to version 6.2.1 or later. Update PAN-OS 10.2 to version 10.2.9-h1 or later. Update PAN-OS 11.0 to version 11.0.4-h2 or later. Update PAN-OS 11.1 to version 11.1.2-h3 or later. Disable web management to ensure the Management Interface is not accessible from the public internet. Switch from SAML to alternative authentication methods, such as LDAP or local accounts with MFA. Restrict access to the GlobalProtect Portal/Gateway to known-good IP ranges only.

**Name of the Vulnerable Software and Affected Versions** Portal for ArcGIS versions <=11.1 **Description** The issue is related to a Cross-site Scripting vulnerability that may allow a remote, authenticated attacker to create a crafted link. When an authenticated user opens their bio page, it will render an image in the victim's browser. The privileges required to execute this attack are low. **Recommendations** For Portal for ArcGIS versions <=11.1, update to a version greater than 11.1 to resolve the issue. As a temporary workaround, consider restricting access to bio pages for authenticated users until a patch is available.