Sarawut Poolkhet

**Name of the Vulnerable Software and Affected Versions** Advanced Custom Fields versions prior to 6.8.2 **Description** The Advanced Custom Fields plugin for WordPress contains an authorization bypass issue because it fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can overwrite the `post title` and `post content` of any post linked to a publicly accessible `acf form()` instance. This is achieved by injecting values into the ` post title` and ` post content` parameters during a form submission request. **Recommendations** Update to version 6.8.2 or later. As a temporary mitigation, restrict public access to `acf form()` instances.

**Name of the Vulnerable Software and Affected Versions** MC4WP: Mailchimp for WordPress plugin versions prior to 4.11.2 **Description** The MC4WP: Mailchimp for WordPress plugin for WordPress is susceptible to unauthorized access. The plugin improperly validates the ` mc4wp action` POST parameter, allowing unauthenticated attackers to manipulate form processing. Specifically, attackers can force unsubscribe actions instead of subscribe actions. This allows arbitrary email addresses to be unsubscribed from the connected Mailchimp audience if the attacker can determine the form ID, which is exposed in the HTML source. The vulnerable parameter is ` mc4wp action`. **Recommendations** Update MC4WP: Mailchimp for WordPress plugin to version 4.11.2 or later.

**Name of the Vulnerable Software and Affected Versions** JAY Login & Register plugin for WordPress versions prior to 2.6.04 **Description** The JAY Login & Register plugin for WordPress is susceptible to a privilege escalation issue. The plugin permits a user to modify arbitrary user meta data via the `jay panel ajax update profile` function. This allows authenticated attackers with Subscriber-level access or higher to gain administrator privileges. **Recommendations** Update the JAY Login & Register plugin to version 2.6.04 or later.

**Name of the Vulnerable Software and Affected Versions** Sell BTC - Cryptocurrency Selling Calculator plugin for WordPress versions prior to 1.5. **Description** The Sell BTC - Cryptocurrency Selling Calculator plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `orderform data` AJAX action. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into order records. These scripts will execute when an administrator views the Orders page within the admin dashboard. **Recommendations** Update to a version newer than 1.5.

**Name of the Vulnerable Software and Affected Versions** Snow Monkey Forms versions up to and including 12.0.3 **Description** The Snow Monkey Forms plugin for WordPress is susceptible to arbitrary file deletion. Insufficient file path validation within the `generate user dirpath` function allows unauthenticated attackers to delete arbitrary files on the server. Successful deletion of specific files, such as wp-config.php, could lead to remote code execution. **Recommendations** Versions prior to and including 12.0.3 should be updated to a newer, fixed version when available. As a temporary workaround, consider restricting access to the `generate user dirpath` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** WP Directory Kit versions prior to 1.4.9 **Description** The WP Directory Kit plugin for WordPress has a flaw that allows unauthenticated attackers to obtain email addresses of users with specific Directory Kit user roles. This is possible through the `wdk public action` AJAX handler. **Recommendations** Update WP Directory Kit to a version later than 1.4.9.

**Name of the Vulnerable Software and Affected Versions** KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress versions through 3.6.15 **Description** The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is susceptible to unauthorized file uploads. This is due to a lack of proper authorization checks within the `uploadMedicalReport()` function. This allows unauthenticated attackers to upload text files and PDF documents to the server. Successful exploitation could lead to hosting malicious content or phishing pages through uploaded PDF files. **Recommendations** Update KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress to a version later than 3.6.15.

**Name of the Vulnerable Software and Affected Versions** Melapress Role Editor plugin for WordPress versions prior to 1.1.2 **Description** The Melapress Role Editor plugin for WordPress is subject to a privilege escalation issue. An attacker with Subscriber-level access or higher can assign themselves additional roles, including Administrator, due to a misconfigured capability check within the `save secondary roles field` function. **Recommendations** Update the Melapress Role Editor plugin to version 1.1.2 or later.

**Name of the Vulnerable Software and Affected Versions** Creator LMS – The LMS for Creators, Coaches, and Trainers plugin for WordPress versions up to and including 1.1.12 **Description** The Creator LMS plugin for WordPress is susceptible to unauthorized data modification, potentially leading to privilege escalation. An attacker with contributor-level access or higher can update arbitrary WordPress options due to a missing capability check within the `get items permissions check` function. **Recommendations** Update to version 1.1.13 or later.

**Name of the Vulnerable Software and Affected Versions** WP Duplicate Page plugin for WordPress versions prior to 1.9 **Description** The WP Duplicate Page plugin for WordPress has a flaw that allows unauthorized modification of data. This is due to missing capability checks within the `duplicateBulkHandle` and `duplicateBulkHandleHPOS` functions. Authenticated attackers with Contributor-level access or higher can duplicate posts, pages, and WooCommerce HPOS orders, even if their user role is not permitted in the plugin’s settings. This could lead to the exposure of sensitive information and the potential for duplicate fulfillment of WooCommerce orders. **Recommendations** Update the WP Duplicate Page plugin to version 1.9 or later.

**Name of the Vulnerable Software and Affected Versions** Eventin – Event Manager, Events Calendar, Event Tickets and Registrations plugin for WordPress versions up to and including 4.0.51 **Description** The Eventin plugin for WordPress is susceptible to unauthorized data modification because of a missing capability check on the `post settings` function. This allows unauthenticated attackers to alter plugin settings. Additionally, inadequate input sanitization and output escaping of the `etn primary color` setting allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses a page with Eventin styles loaded. The API endpoint is not specified. The vulnerable parameter is `etn primary color`. **Recommendations** Versions prior to 4.0.51 should be updated.

**Name of the Vulnerable Software and Affected Versions** BuddyPress Xprofile Custom Field Types plugin versions through 1.2.8 **Description** The BuddyPress Xprofile Custom Field Types plugin for WordPress has a flaw that allows authenticated attackers with Subscriber-level access or higher to delete arbitrary files on the server. This is due to inadequate file path validation within the `delete field` function. Deleting specific files, such as wp-config.php, could lead to remote code execution. **Recommendations** Update BuddyPress Xprofile Custom Field Types plugin to a version later than 1.2.8.

**Name of the Vulnerable Software and Affected Versions** LearnPress – WordPress LMS Plugin versions prior to 4.3.2 **Description** The LearnPress – WordPress LMS Plugin is susceptible to unauthorized data access because of a missing capability check within the statistic function. This allows unauthenticated attackers to view the plugin’s order statistics, which includes total revenue summaries and order status counts. **Recommendations** Update to version 4.3.2 or later.

**Name of the Vulnerable Software and Affected Versions** The Image Optimizer by wps.sk versions prior to 1.2.1 **Description** The Image Optimizer plugin for WordPress is susceptible to Cross-Site Request Forgery. This is caused by insufficient nonce validation within the `imagopby ajax optimize gallery()` function. An unauthenticated attacker could potentially trigger bulk optimization by deceiving a site administrator into performing an action. **Recommendations** Update The Image Optimizer plugin to version 1.2.1 or later.