Sanjorn Keeratirungsan

The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details.

The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is available to unauthenticated users, and does not verify that the requester owns the account being changed, allowing unauthenticated attackers to arbitrarily modify or corrupt (including driving it negative) the stored wallet balance and loyalty points of any user. Modifying the wallet balance additionally requires the companion Wallet System for WooCommerce Points and Rewards for WooCommerce WordPress plugin before 2.10.1 to be active.

The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account (Subscriber and above) to read the personal data, including name, email, phone, and address, of any customer.

**Name of the Vulnerable Software and Affected Versions** FluentCart A New Era of eCommerce WordPress plugin versions prior to 1.4.0 **Description** An Insecure Direct Object Reference (IDOR) exists in several payment-method endpoints. The plugin fails to verify if a subscription belongs to the requesting customer, allowing an authenticated user to modify another customer's subscription—including changing the payment method or cancelling and re-binding it—provided they know the target subscription identifier. **Recommendations** Update the plugin to version 1.4.0 or later.

**Name of the Vulnerable Software and Affected Versions** WPS Bookings for WooCommerce WordPress plugin versions prior to 3.11.7 **Description** The plugin fails to verify if a booking order belongs to the user making the request before processing a cancellation. This allows any authenticated user, including those with Subscriber or Customer roles, to cancel and void booking orders belonging to other customers. **Recommendations** Update WPS Bookings for WooCommerce WordPress plugin to version 3.11.7 or later.

**Name of the Vulnerable Software and Affected Versions** WP Hotel Booking versions prior to 2.3.1 **Description** Several AJAX handlers do not enforce capability checks, which allows authenticated users with Subscriber-level access to read booking line items of other users, enumerate active coupons, and access pricing data. **Recommendations** Update to version 2.3.1 or later.

**Name of the Vulnerable Software and Affected Versions** Concrete CMS versions prior to 9.5.2 **Description** PHP Object Injection occurs due to the use of `unserialize()` calls within the Workflow, Form block, and File/Set components that do not implement the `allowed classes` restriction. This allows an unauthenticated attacker to trigger arbitrary PHP object instantiation if a malicious serialized payload is present in the database. **Recommendations** Update to version 9.5.2 or later.