Supakiad S

The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is possible because when attachment url to postid() returns 0 for a traversal path, the plugin falls back to the global post set by a valid ?attachment id parameter supplied by the attacker, causing the access check to pass against a legitimate public attachment while the file streamed is the attacker-chosen path.

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mo saml validate signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error — bypassing verification entirely and resulting in wp set auth cookie() being called for the targeted account.

**Name of the Vulnerable Software and Affected Versions** Tutor LMS Elementor Addons versions prior to 4.0.1 **Description** The plugin contains a missing authorization flaw where capability checks are absent in the `activate tutor free()` and `activate elementor free()` functions used as `admin action *` handlers. This allows authenticated users with Subscriber-level permissions or higher to activate the Tutor LMS and Elementor plugins without the required authorization. **Recommendations** Update Tutor LMS Elementor Addons to a version newer than 4.0.0. As a temporary mitigation, restrict access to the `activate tutor free()` and `activate elementor free()` functions.

**Name of the Vulnerable Software and Affected Versions** Tutor LMS – eLearning and online course solution plugin for WordPress versions prior to 4.0.1 **Description** An issue exists where authenticated attackers with custom-level access or higher can perform a second-order SQL Injection. This occurs because of insufficient escaping of user-supplied parameters and a lack of preparation in the SQL query. The malicious payload is stored during a quiz attempt via the `wp ajax tutor quiz abandon` handler. The injection is subsequently executed when a privileged user or a Tutor REST API key holder requests the '/wp-json/tutor/v1/quiz-attempt-details/{id}' endpoint, allowing for the extraction of sensitive information from the database. **Recommendations** Update the plugin to a version later than 4.0.0.

**Name of the Vulnerable Software and Affected Versions** SureCart versions prior to 4.2.4 **Description** An issue exists that allows privilege escalation via account takeover. The software fails to properly validate a user's identity when updating details, such as the email address, during customer profile synchronization from webhook events. An unauthenticated attacker who knows the customer ID can change the linked user's email address, including that of an administrator if the account is linked to a SureCart customer record, and subsequently reset the password to gain unauthorized account access. **Recommendations** Update SureCart to version 4.2.4 or later.

**Name of the Vulnerable Software and Affected Versions** miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) versions prior to 7.7.1 **Description** An authentication bypass exists in the Profile Completion flow that allows for account takeover. The issue occurs because the plugin accepts an arbitrary email address via the `email field` POST parameter without verifying if the email belongs to the identity provided by the OAuth provider. Additionally, the `send otp token()` function returns a transaction hash to the client generated by SHA-512 of the `customer key` and the One-Time Password (OTP). Since the OTP space is limited to 99,000 values and the `customer key` is a static option, an unauthenticated attacker can trigger an OTP email to an administrator's address, crack the OTP offline using the leaked hash, and submit it to the `mo openid social login validate otp()` function to gain full administrator access. **Recommendations** Update the plugin to a version newer than 7.7.0.

**Name of the Vulnerable Software and Affected Versions** User Registration & Membership versions prior to 5.2.1 **Description** Missing validation checks in the `confirm payment()` function allow unauthenticated attackers to perform unauthorized modification of data. This flaw enables the bypass of payment processing to activate paid memberships. **Recommendations** Update the plugin to a version later than 5.2.0. As a temporary workaround, consider restricting access to the `confirm payment()` function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** SlimStat Analytics versions prior to 5.4.12 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS) via the `User-Agent` header. This enables the injection of arbitrary web scripts into pages that execute when a user accesses them. This issue requires the `show complete user agent tooltip` setting to be explicitly enabled by an administrator to render and execute the stored payload. **Recommendations** Update SlimStat Analytics to version 5.4.12 or later. Disable the `show complete user agent tooltip` setting to prevent the execution of stored payloads.

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.5. This is due to missing ownership validation on a user-controlled attachment ID, allowing the plugin to store and subsequently delete arbitrary media attachments without verifying that the referenced attachment belongs to the requesting user. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete arbitrary media attachments uploaded by any other user, including administrators.

**Name of the Vulnerable Software and Affected Versions** User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration versions prior to 4.3.3 **Description** The plugin is subject to unauthorized data modification because the `user subscription cancel()` function lacks a proper capability check. This allows authenticated attackers with Subscriber-level permissions or higher to cancel subscription packs for any user, including those with administrator privileges. **Recommendations** Update to a version later than 4.3.2. As a temporary workaround, restrict access to the `user subscription cancel()` function to prevent unauthorized subscription cancellations.

**Name of the Vulnerable Software and Affected Versions** Subscribe To Comments Reloaded versions prior to 240120 **Description** The Subscribe To Comments Reloaded plugin for WordPress allows unauthenticated attackers to modify data without authorization. This is caused by a leaked secret key and the use of a weak hash generation algorithm. Attackers can extract the global key from any public post page to forge authorization keys, enabling them to manage comment subscription preferences for arbitrary users. **Recommendations** Update the plugin to a version later than 240119.

**Name of the Vulnerable Software and Affected Versions** WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress versions prior to 6.7.26 **Description** An Insecure Direct Object Reference (IDOR) exists due to missing validation on the `customerid` user-controlled key within the 'wcfm delete wcfm customer' function. This allows authenticated attackers with Vendor-level access or higher to delete arbitrary users, including Administrators. IDOR is a type of access control flaw that occurs when an application provides direct access to objects based on user-supplied input. **Recommendations** Update the plugin to a version later than 6.7.25.

**Name of the Vulnerable Software and Affected Versions** ProfilePress versions prior to 4.16.13 **Description** The plugin is affected by missing authorization. The `process checkout()` function fails to properly enforce the active status check of a plan when the `change plan sub id` parameter is provided. This allows authenticated attackers with Subscriber-level access or higher to subscribe to inactive membership plans by submitting an arbitrary value for the `change plan sub id` variable during the checkout request. **Recommendations** Update to a version later than 4.16.12.

**Name of the Vulnerable Software and Affected Versions** LearnPress plugin for WordPress versions up to 4.3.2.8 **Description** The plugin allows unauthorized data deletion because the `delete question answer()` function lacks a capability check. It exposes a `wp rest` nonce in the public frontend HTML (`lpData`) to unauthenticated visitors, which serves as the sole security measure for the 'lp-load-ajax' AJAX dispatcher. This allows unauthenticated attackers to delete quiz answer options by sending a crafted POST request. **Recommendations** As a temporary workaround, consider disabling the `delete question answer()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) versions prior to 4.1.9 **Description** An improper capability check in the `get item permissions check()` function allows authenticated attackers with Subscriber-level access or higher to gain unauthorized access to data. By iterating order IDs, an attacker can read arbitrary order information, including customer personally identifiable information (PII) such as name, email, and phone number. **Recommendations** Update to a version newer than 4.1.8.

Name of the Vulnerable Software and Affected Versions Tutor LMS versions through 3.9.7 Description The Tutor LMS plugin for WordPress is susceptible to an Insecure Direct Object Reference issue. This is due to the absence of proper authentication and authorization checks within the `pay incomplete order()` function. The function utilizes an attacker-controlled `order id` parameter to retrieve order data and subsequently updates billing fields associated with the order owner (`$order data->user id`) without verifying the identity or ownership of the requester. The exposure of the Tutor nonce (` tutor nonce`) on public frontend pages enables unauthenticated attackers to modify the billing profile (name, email, phone, address) of any user with an incomplete manual order by submitting a crafted POST request with a guessed or enumerated `order id`. Recommendations Update Tutor LMS to a version later than 3.9.7.

Name of the Vulnerable Software and Affected Versions Visitor Traffic Real Time Statistics plugin for WordPress versions up to and including 8.4 Description The Visitor Traffic Real Time Statistics plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `page title` parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into pages. These scripts will execute when an administrator accesses the Traffic by Title section. Recommendations Update the Visitor Traffic Real Time Statistics plugin to a version later than 8.4.

Name of the Vulnerable Software and Affected Versions ProfilePress versions prior to 4.16.12 Description The ProfilePress plugin for WordPress is susceptible to unauthorized membership payment bypass due to a missing ownership verification on the `change plan sub id` parameter within the `process checkout()` function. Authenticated attackers with subscriber-level access or higher can manipulate proration calculations by referencing another user's active subscription during checkout via the `ppress process checkout` AJAX action, potentially obtaining paid lifetime membership plans without payment. Recommendations Update ProfilePress to version 4.16.12 or later.

**Name of the Vulnerable Software and Affected Versions** Fluent Booking versions up to and including 2.0.01 **Description** The Fluent Booking plugin for WordPress is susceptible to Stored Cross-Site Scripting through multiple parameters. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. **Recommendations** Update Fluent Booking to a version newer than 2.0.01.

**Name of the Vulnerable Software and Affected Versions** Contest Gallery plugin for WordPress versions through 28.1.5 **Description** The Contest Gallery plugin for WordPress is susceptible to an authentication bypass, potentially allowing unauthorized takeover of administrator accounts. This occurs because the email confirmation handler in `users-registry-check-after-email-or-pin-confirmation.php` incorrectly uses the user's email string in a SQL query (`WHERE ID = %s`) instead of the numeric user ID. This, combined with an unauthenticated key-based login endpoint in `ajax-functions-frontend.php`, allows an attacker to exploit the system when the `RegMailOptional` setting is enabled. An attacker can register with a crafted email address starting with the target user ID (e.g., `1poc@example.test`), triggering the confirmation process to overwrite the administrator's `user activation key` through MySQL integer coercion. Subsequently, the attacker can utilize the `post cg1l login user by key` AJAX action to authenticate as the administrator without any credentials, gaining full control of the site. **Recommendations** Versions prior to 28.1.5 should be updated to a newer version. As a temporary workaround, consider disabling the `RegMailOptional` setting to prevent the exploitation of this issue. Restrict access to the `ajax-functions-frontend.php` file to minimize the risk of exploitation.