Supakiad S

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.5. This is due to missing ownership validation on a user-controlled attachment ID, allowing the plugin to store and subsequently delete arbitrary media attachments without verifying that the referenced attachment belongs to the requesting user. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete arbitrary media attachments uploaded by any other user, including administrators.

The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'User-Agent' header in all versions up to, and including, 5.4.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The show complete user agent tooltip setting must be explicitly enabled by an administrator (disabled by default) for the stored payload to be rendered and executed.

**Name of the Vulnerable Software and Affected Versions** User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration versions prior to 4.3.3 **Description** The plugin is subject to unauthorized data modification because the `user subscription cancel()` function lacks a proper capability check. This allows authenticated attackers with Subscriber-level permissions or higher to cancel subscription packs for any user, including those with administrator privileges. **Recommendations** Update to a version later than 4.3.2. As a temporary workaround, restrict access to the `user subscription cancel()` function to prevent unauthorized subscription cancellations.

**Name of the Vulnerable Software and Affected Versions** Subscribe To Comments Reloaded versions prior to 240120 **Description** The Subscribe To Comments Reloaded plugin for WordPress allows unauthenticated attackers to modify data without authorization. This is caused by a leaked secret key and the use of a weak hash generation algorithm. Attackers can extract the global key from any public post page to forge authorization keys, enabling them to manage comment subscription preferences for arbitrary users. **Recommendations** Update the plugin to a version later than 240119.

**Name of the Vulnerable Software and Affected Versions** WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress versions prior to 6.7.26 **Description** An Insecure Direct Object Reference (IDOR) exists due to missing validation on the `customerid` user-controlled key within the 'wcfm delete wcfm customer' function. This allows authenticated attackers with Vendor-level access or higher to delete arbitrary users, including Administrators. IDOR is a type of access control flaw that occurs when an application provides direct access to objects based on user-supplied input. **Recommendations** Update the plugin to a version later than 6.7.25.

**Name of the Vulnerable Software and Affected Versions** ProfilePress versions prior to 4.16.13 **Description** The plugin is affected by missing authorization. The `process checkout()` function fails to properly enforce the active status check of a plan when the `change plan sub id` parameter is provided. This allows authenticated attackers with Subscriber-level access or higher to subscribe to inactive membership plans by submitting an arbitrary value for the `change plan sub id` variable during the checkout request. **Recommendations** Update to a version later than 4.16.12.

**Name of the Vulnerable Software and Affected Versions** LearnPress plugin for WordPress versions up to 4.3.2.8 **Description** The plugin allows unauthorized data deletion because the `delete question answer()` function lacks a capability check. It exposes a `wp rest` nonce in the public frontend HTML (`lpData`) to unauthenticated visitors, which serves as the sole security measure for the 'lp-load-ajax' AJAX dispatcher. This allows unauthenticated attackers to delete quiz answer options by sending a crafted POST request. **Recommendations** As a temporary workaround, consider disabling the `delete question answer()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) versions prior to 4.1.9 **Description** An improper capability check in the `get item permissions check()` function allows authenticated attackers with Subscriber-level access or higher to gain unauthorized access to data. By iterating order IDs, an attacker can read arbitrary order information, including customer personally identifiable information (PII) such as name, email, and phone number. **Recommendations** Update to a version newer than 4.1.8.

Name of the Vulnerable Software and Affected Versions Tutor LMS versions through 3.9.7 Description The Tutor LMS plugin for WordPress is susceptible to an Insecure Direct Object Reference issue. This is due to the absence of proper authentication and authorization checks within the `pay incomplete order()` function. The function utilizes an attacker-controlled `order id` parameter to retrieve order data and subsequently updates billing fields associated with the order owner (`$order data->user id`) without verifying the identity or ownership of the requester. The exposure of the Tutor nonce (` tutor nonce`) on public frontend pages enables unauthenticated attackers to modify the billing profile (name, email, phone, address) of any user with an incomplete manual order by submitting a crafted POST request with a guessed or enumerated `order id`. Recommendations Update Tutor LMS to a version later than 3.9.7.

Name of the Vulnerable Software and Affected Versions Visitor Traffic Real Time Statistics plugin for WordPress versions up to and including 8.4 Description The Visitor Traffic Real Time Statistics plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `page title` parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into pages. These scripts will execute when an administrator accesses the Traffic by Title section. Recommendations Update the Visitor Traffic Real Time Statistics plugin to a version later than 8.4.

Name of the Vulnerable Software and Affected Versions ProfilePress versions prior to 4.16.12 Description The ProfilePress plugin for WordPress is susceptible to unauthorized membership payment bypass due to a missing ownership verification on the `change plan sub id` parameter within the `process checkout()` function. Authenticated attackers with subscriber-level access or higher can manipulate proration calculations by referencing another user's active subscription during checkout via the `ppress process checkout` AJAX action, potentially obtaining paid lifetime membership plans without payment. Recommendations Update ProfilePress to version 4.16.12 or later.

**Name of the Vulnerable Software and Affected Versions** Fluent Booking versions up to and including 2.0.01 **Description** The Fluent Booking plugin for WordPress is susceptible to Stored Cross-Site Scripting through multiple parameters. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. **Recommendations** Update Fluent Booking to a version newer than 2.0.01.

**Name of the Vulnerable Software and Affected Versions** Contest Gallery plugin for WordPress versions through 28.1.5 **Description** The Contest Gallery plugin for WordPress is susceptible to an authentication bypass, potentially allowing unauthorized takeover of administrator accounts. This occurs because the email confirmation handler in `users-registry-check-after-email-or-pin-confirmation.php` incorrectly uses the user's email string in a SQL query (`WHERE ID = %s`) instead of the numeric user ID. This, combined with an unauthenticated key-based login endpoint in `ajax-functions-frontend.php`, allows an attacker to exploit the system when the `RegMailOptional` setting is enabled. An attacker can register with a crafted email address starting with the target user ID (e.g., `1poc@example.test`), triggering the confirmation process to overwrite the administrator's `user activation key` through MySQL integer coercion. Subsequently, the attacker can utilize the `post cg1l login user by key` AJAX action to authenticate as the administrator without any credentials, gaining full control of the site. **Recommendations** Versions prior to 28.1.5 should be updated to a newer version. As a temporary workaround, consider disabling the `RegMailOptional` setting to prevent the exploitation of this issue. Restrict access to the `ajax-functions-frontend.php` file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Membership Plugin – Restrict Content versions prior to 3.2.24 **Description** The Membership Plugin – Restrict Content plugin for WordPress is susceptible to an unvalidated redirect issue in all versions up to and including 3.2.24. This occurs because of inadequate validation of the redirect URL provided through the `rcp redirect` parameter. An unauthenticated attacker can potentially redirect users who have requested a password reset email to malicious websites if they can trick the user into performing an action. **Recommendations** Versions prior to 3.2.24 should be updated to version 3.2.24 or later.

**Name of the Vulnerable Software and Affected Versions** SlimStat Analytics versions prior to 5.3.6 **Description** The SlimStat Analytics plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to insufficient input sanitization and output escaping related to the `fh` (fingerprint) parameter. An unauthenticated attacker can inject arbitrary web scripts into pages, which will execute when a user accesses the injected page. **Recommendations** Update SlimStat Analytics to version 5.3.6 or later.

**Name of the Vulnerable Software and Affected Versions** User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration versions prior to 4.2.9 **Description** The User Frontend plugin for WordPress is susceptible to unauthorized data modification. A missing capability check within the `draft post()` function allows unauthenticated attackers to modify arbitrary posts. This can include actions like unpublishing published posts and overwriting content. The modification is achieved through manipulation of the `post id` parameter. **Recommendations** Update User Frontend to version 4.2.9 or later.

**Name of the Vulnerable Software and Affected Versions** RegistrationMagic versions n/a through 6.0.7.6 **Description** A missing authorization flaw exists in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager. This issue allows exploitation of incorrectly configured access control security levels. **Recommendations** Versions prior to 6.0.7.6 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Themeum Tutor LMS versions through 3.9.5 **Description** A missing authorization flaw exists in Themeum Tutor LMS, allowing exploitation of incorrectly configured access control security levels. The issue allows unauthorized access. **Recommendations** Update Themeum Tutor LMS to a version later than 3.9.5.

**Name of the Vulnerable Software and Affected Versions** Tutor LMS versions prior to 3.9.7 **Description** The Tutor LMS plugin for WordPress is susceptible to SQL Injection due to inadequate input validation and query preparation. Specifically, the `coupon code` parameter is not properly sanitized, allowing unauthenticated attackers to inject malicious SQL queries. This could enable unauthorized access to sensitive database information. **Recommendations** Update Tutor LMS to version 3.9.7 or later.

**Name of the Vulnerable Software and Affected Versions** Advanced Ads – Ad Manager & AdSense plugin for WordPress versions through 2.0.14 **Description** The Advanced Ads – Ad Manager & AdSense plugin for WordPress has an authorization issue in versions up to and including 2.0.14. The plugin does not properly validate user authorization when performing actions within the `placement update item()` function. This allows authenticated attackers with subscriber-level access or higher to modify ad placements, potentially changing the served ads or ad groups. **Recommendations** Update to a version of Advanced Ads – Ad Manager & AdSense plugin for WordPress later than 2.0.14.