Tobias Weißhaar

Name of the Vulnerable Software and Affected Versions: Fluent Forms versions up to, and including, 5.1.18 Description: The issue is related to an insufficient capability check on the `verifyRequest` function, allowing Form Managers with a Subscriber-level access and above to modify the Mailchimp API key used for integration. Additionally, missing Mailchimp API key validation enables the redirect of integration requests to an attacker-controlled server. Recommendations: For versions up to, and including, 5.1.18, update to the latest version of Fluent Forms to mitigate the risk of exploitation. As a temporary workaround, consider restricting access to the Mailchimp API key integration to prevent unauthorized modifications.

**Name of the Vulnerable Software and Affected Versions** The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress versions up to, and including, 1.8.23 **Description** The issue allows authenticated attackers to perform Path Traversal via the `esc dir` function, enabling them to copy the contents of arbitrary files on the server, which may contain sensitive information, and delete arbitrary directories, including the root WordPress directory. By default, this can be exploited by administrators only. However, in the premium version of the plugin, administrators can grant gallery edit permissions to lower-level users, potentially making this exploitable by users as low as contributors. **Recommendations** For versions up to, and including, 1.8.23, update to a version higher than 1.8.23 to resolve the issue. As a temporary workaround, consider restricting gallery edit permissions to prevent lower-level users from exploiting the vulnerability. Additionally, restrict access to sensitive files and directories on the server to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress versions up to, and including, 1.8.23 Description: The issue is related to Stored Cross-Site Scripting via the `svg` parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, exploitation is limited to administrators, but contributors on pro versions of the plugin may also be able to exploit this issue if they have been granted the ability to use and configure Photo Gallery. Recommendations: For versions up to, and including, 1.8.23, update to a version later than 1.8.23 to resolve the issue. As a temporary workaround, consider restricting access to the `svg` parameter to minimize the risk of exploitation. Additionally, limiting the ability to use and configure Photo Gallery to only trusted administrators can help reduce the attack surface.

**Name of the Vulnerable Software and Affected Versions** TablePress – Tables in WordPress made easy plugin for WordPress versions prior to 2.3 **Description** The issue allows authenticated attackers with author-level access and above to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services. This is possible due to a Server-Side Request Forgery vulnerability in the `get files to import()` function. The vulnerability poses a minimal risk to most site owners, and ideally, WordPress core would correct this issue in `wp safe remote get()` and other functions. **Recommendations** For versions prior to 2.3, restrict the usage of the URL import functionality to just administrators as a temporary workaround until a patch is available.

**Name of the Vulnerable Software and Affected Versions** The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress versions up to, and including, 5.1.15 **Description** The issue is related to PHP Object Injection via deserialization of untrusted input in the `extractDynamicValues` function. This allows authenticated attackers with contributor-level access and above to inject a PHP Object. If a POP chain is present via an additional plugin or theme, it could enable the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Successful exploitation requires the attacker to have "View Form" and "Manage Form" permissions. **Recommendations** For versions up to, and including, 5.1.15, consider disabling the `extractDynamicValues` function as a temporary workaround until a patch is available. Restrict access to the plugin to minimize the risk of exploitation, ensuring that only trusted users have "View Form" and "Manage Form" permissions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress versions up to, and including, 5.1.16 **Description** The issue is related to a missing capability check on the "/wp-json/fluentform/v1/global-settings" REST API endpoint. This allows unauthenticated attackers to modify all of the plugin's settings. **Recommendations** For versions up to, and including, 5.1.16, update to a version higher than 5.1.16 to resolve the issue. As a temporary workaround, consider restricting access to the "/wp-json/fluentform/v1/global-settings" API endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress versions up to, and including, 5.1.16 **Description** The issue is related to a missing capability check on the "/wp-json/fluentform/v1/managers" REST API endpoint. This allows unauthenticated attackers to grant users with Fluent Form management permissions, giving them access to all of the plugin's settings and features. Additionally, it enables unauthenticated attackers to delete manager accounts. **Recommendations** For versions up to, and including, 5.1.16, update to a version higher than 5.1.16 to resolve the issue. As a temporary workaround, consider restricting access to the "/wp-json/fluentform/v1/managers" API endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress versions up to, and including, 5.1.13 **Description** The issue is related to Stored Cross-Site Scripting via form settings due to insufficient input sanitization and output escaping. This allows authenticated attackers with access to the Fluent Forms settings to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 5.1.13, update to a version higher than 5.1.13 to resolve the issue. As a temporary workaround, consider restricting access to the form settings to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress versions up to, and including, 5.1.16 **Description** The issue is related to Stored Cross-Site Scripting via the `subject` parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 5.1.16, update to a version higher than 5.1.16 to resolve the issue. As a temporary workaround, consider restricting access to the `subject` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress versions up to, and including, 3.8.0 **Description** The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `nf download all subs` AJAX action. This allows unauthenticated attackers to trigger an export of a form's submission to a publicly accessible location by tricking a site administrator into performing an action, such as clicking on a link. **Recommendations** For versions up to, and including, 3.8.0, update to a version that includes the fix for the nonce validation issue in the `nf download all subs` AJAX action. As a temporary workaround, consider restricting access to the `nf download all subs` AJAX action to prevent unauthorized exports until a patch is available.

**Name of the Vulnerable Software and Affected Versions** File Manager Pro plugin for WordPress versions up to, and including, 8.3.4 **Description** The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The `tb` parameter is specifically vulnerable to this issue. **Recommendations** For versions up to, and including, 8.3.4, update to a version higher than 8.3.4 to resolve the issue. As a temporary workaround, consider restricting access to the `tb` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** File Manager versions up to 7.2.1 File Manager Pro versions up to 8.3.4 **Description** The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal via the `target` parameter in the `mk file folder manager action callback shortcode` function. This allows attackers to read the contents of arbitrary files on the server, which can contain sensitive information, and to upload files into directories other than the intended directory for file uploads. The free version requires Administrator access for this vulnerability to be exploitable, while the Pro version allows a file manager to be embedded via a shortcode and also allows admins to grant file handling privileges to other user levels, potentially leading to exploitation by lower-level users. Over a million WordPress sites are potentially exposed to this flaw. **Recommendations** For File Manager versions up to 7.2.1, update to a version later than 7.2.1 to resolve the issue. For File Manager Pro versions up to 8.3.4, update to a version later than 8.3.4 to resolve the issue. As a temporary workaround, consider restricting access to the `mk file folder manager action callback shortcode` function and limiting file handling privileges to only necessary user levels.

**Name of the Vulnerable Software and Affected Versions** Nextend Social Login and Register plugin for WordPress versions up to, and including, 3.1.12 **Description** The Nextend Social Login and Register plugin for WordPress is vulnerable to a self-based Reflected Cross-Site Scripting via the `error description` parameter due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers, with access to a subscriber-level account, to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation requires "Debug mode" to be enabled in the plugin's "Global Settings". The vulnerability can be exploited against an OAuth pre-authenticated higher-level user, such as an administrator, by leveraging a cross-site request forgery in conjunction with a certain social engineering technique to achieve a critical impact scenario, including cross-site scripting to administrator-level account creation. **Recommendations** For versions up to, and including, 3.1.12, update the plugin to a version that fixes the vulnerability. As a temporary workaround, consider disabling the "Debug mode" in the plugin's "Global Settings" until a patch is available. Restrict access to the `error description` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** File Manager Pro plugin for WordPress versions up to, and including, 8.3.4 **Description** The issue allows authenticated attackers, with subscriber access and above, to execute code on the server via the `mk check filemanager php syntax` AJAX function. This enables arbitrary file upload. The vulnerability is exploited by authenticated users with sufficient access levels, making it possible to execute server-side code. **Recommendations** For versions up to, and including, 8.3.4, update to version 8.3.5 or later, which introduces a capability check that prevents users lower than admin from executing the vulnerable function. As a temporary workaround, consider restricting access to the `mk check filemanager php syntax` AJAX function until a patch is available.