Wesley

**Name of the Vulnerable Software and Affected Versions** Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme versions prior to 4.2.4 **Description** The plugin is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a logged-in user into performing actions they did not intend. This occurs because the `/install plugin` and `/activate plugin` REST API endpoints use ` return true` as the `permission callback`, which bypasses the standard nonce verification (a unique token used to prevent CSRF) in the WordPress REST API. While internal `current user can()` checks are present, the lack of nonce verification allows a forged request from an administrator's browser to pass these checks using the administrator's session cookies, enabling unauthenticated attackers to install arbitrary plugins. **Recommendations** Update to a version newer than 4.2.3. Restrict access to the `/install plugin` and `/activate plugin` REST API endpoints as a temporary mitigation measure.

**Name of the Vulnerable Software and Affected Versions** RTMKit versions prior to 2.0.8 **Description** The RTMKit (rometheme-for-elementor) plugin for WordPress contains a Local File Inclusion flaw. This occurs because the `render templates` AJAX endpoint does not properly validate the `template` parameter before using it in a require/include statement. Authenticated users with Contributor-level access or higher can exploit this to include and execute any server files ending in templates.php, leading to the execution of arbitrary PHP code. **Recommendations** Update the plugin to a version newer than 2.0.7. As a temporary mitigation, restrict access to the `render templates` AJAX endpoint or limit user permissions to prevent Contributor-level users from accessing the affected functionality.

**Name of the Vulnerable Software and Affected Versions** RTMKit versions prior to 2.0.8 **Description** The RTMKit plugin for WordPress contains an incorrect authorization flaw. The 'get submission content' AJAX endpoint does not perform a capability check to verify if a user is authorized to access specific form submission data. Consequently, authenticated attackers with Contributor-level access or higher can view arbitrary form submissions from other users by iterating the `entries id` parameter. **Recommendations** Update to a version newer than 2.0.7. As a temporary workaround, restrict access to the 'get submission content' AJAX endpoint or limit user permissions to prevent Contributor-level accounts from accessing form submission data.

**Name of the Vulnerable Software and Affected Versions** Newsletters plugin for WordPress versions prior to 4.14 **Description** The plugin is susceptible to time-based SQL Injection, a technique where an attacker sends queries that force the database to wait a specific amount of time before responding, allowing them to infer data. This occurs due to insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. Unauthenticated attackers can append additional SQL queries to existing ones to extract sensitive information from the database via the `wpmlsubscriber id` parameter. **Recommendations** Update the plugin to version 4.14 or later. As a temporary workaround, restrict access to the functionality utilizing the `wpmlsubscriber id` parameter.

Name of the Vulnerable Software and Affected Versions W3 Total Cache versions up to and including 2.9.3 Description The W3 Total Cache plugin for WordPress is susceptible to information disclosure. The plugin bypasses its output buffering and processing when the User-Agent header contains "W3 Total Cache", leading to the rendering of raw mfunc/mclude dynamic fragment HTML comments, including the `W3TC DYNAMIC SECURITY` security token, in the page source. This allows unauthenticated attackers to discover the value of the `W3TC DYNAMIC SECURITY` constant by sending a crafted User-Agent header to pages with enabled fragment caching. Recommendations Update W3 Total Cache to a version later than 2.9.3.

**Name of the Vulnerable Software and Affected Versions** WP-WebAuthn plugin for WordPress versions up to and including 1.3.4 **Description** The WP-WebAuthn plugin for WordPress is susceptible to Unauthenticated Stored Cross-Site Scripting through the `wwa auth` API endpoint. This is due to inadequate input sanitization and output escaping of user-supplied attributes when the plugin logs data. An unauthenticated attacker can inject arbitrary web scripts into pages, which will execute when a user accesses the plugin’s log page, provided logging is enabled in the plugin settings. **Recommendations** Update the WP-WebAuthn plugin to a version later than 1.3.4.

**Name of the Vulnerable Software and Affected Versions** WPCOM Member plugin for WordPress versions prior to 1.7.17 **Description** The software is susceptible to authentication bypass through brute-force attacks. This is caused by a weak One-Time Password (OTP) generation process, utilizing only six numeric digits with a ten-minute validity period and lacking rate limiting on verification attempts. An attacker knowing a target’s phone number can potentially bypass authentication as any user, including administrators, if the target does not promptly notice or disregard the SMS notification containing the OTP. **Recommendations** Update the WPCOM Member plugin to version 1.7.17 or later.

**Name of the Vulnerable Software and Affected Versions** GSheetConnector For Gravity Forms plugin for WordPress versions prior to 1.3.24 **Description** The software is susceptible to Cross-Site Request Forgery due to inadequate nonce validation in the `activate plugin` and `deactivate plugin` functions. This allows attackers to potentially trick authenticated administrators into activating or deactivating plugins through a forged request, such as a malicious link or compromised webpage. **Recommendations** Update to version 1.3.24 or later.

**Name of the Vulnerable Software and Affected Versions** GSheetConnector For Gravity Forms plugin for WordPress versions prior to 1.3.28 **Description** The GSheetConnector For Gravity Forms plugin for WordPress is susceptible to an authorization bypass. This occurs because of a missing capability check on the `install plugin` function. Attackers with subscriber-level access or higher can install plugins on the target site, potentially leading to arbitrary code execution on the server. **Recommendations** Update the GSheetConnector For Gravity Forms plugin to version 1.3.28 or later.

**Name of the Vulnerable Software and Affected Versions** WP Travel Engine – Tour Booking Plugin – Tour Operator Software versions prior to 6.6.8 **Description** The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is susceptible to a Local File Inclusion issue in versions up to and including 6.6.7. This allows unauthenticated attackers to include and execute arbitrary .php files on the server through the `mode` parameter. Successful exploitation could allow attackers to bypass access controls, obtain sensitive data, or execute PHP code if .php file uploads are permitted. **Recommendations** Update WP Travel Engine – Tour Booking Plugin – Tour Operator Software to version 6.6.8 or later.

**Name of the Vulnerable Software and Affected Versions** WP Travel Engine – Tour Booking Plugin – Tour Operator Software versions prior to 6.6.7 **Description** The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress has a flaw that allows arbitrary file deletion through renaming due to inadequate file path validation within the `set user profile image` function. This enables unauthenticated attackers to delete files on the server, potentially leading to remote code execution if critical files, such as wp-config.php, are removed. **Recommendations** Update WP Travel Engine – Tour Booking Plugin – Tour Operator Software to a version later than 6.6.7.

**Name of the Vulnerable Software and Affected Versions** LatePoint plugin for WordPress versions through 5.1.94 **Description** The software is susceptible to Cross-Site Request Forgery due to the absence of nonce validation. This occurs on the `change password()` function within the `customer cabinet change password` AJAX route. The plugin utilizes `wp ajax` and `wp ajax nopriv` hooks for this endpoint without verifying a nonce or user capability before allowing password resets. This allows unauthenticated attackers to potentially take over accounts by tricking logged-in customers, or administrators with “WP users as customers” enabled, into visiting a malicious link. **Recommendations** Update the LatePoint plugin to a version newer than 5.1.94.

**Name of the Vulnerable Software and Affected Versions** LatePoint plugin for WordPress versions through 5.1.94 **Description** The LatePoint plugin for WordPress has a flaw that allows bypassing authentication. This is due to inadequate identity verification within the `steps load step` route of the `latepoint route call` API endpoint. The endpoint processes client-supplied customer email and related fields before invoking the internal login handler without verifying login status, capability checks, or a valid AJAX nonce. This allows unauthenticated attackers to log into any customer’s account. The vulnerable API endpoint is `/latepoint route call`. The vulnerable parameter is `customer email`. **Recommendations** Update the LatePoint plugin to a version later than 5.1.94.

**Name of the Vulnerable Software and Affected Versions** Kubio AI Page Builder plugin for WordPress versions up to and including 2.6.3 **Description** The Kubio AI Page Builder plugin for WordPress is susceptible to unauthorized plugin installation due to a missing capability check on the `kubio-image-hub-install-plugin` AJAX action. This allows authenticated attackers with Subscriber-level access or higher to install the Image Hub plugin. **Recommendations** Update Kubio AI Page Builder plugin to a version later than 2.6.3.

**Name of the Vulnerable Software and Affected Versions** WP Legal Pages plugin for WordPress versions up to and including 3.4.3 **Description** The WP Legal Pages plugin for WordPress is susceptible to unauthorized access of functionality due to a missing capability check on the `wplp gdpr install plugin ajax handler()` function. This allows authenticated attackers with Contributor-level access or higher to install arbitrary repository plugins. **Recommendations** Update WP Legal Pages plugin to a version later than 3.4.3. As a temporary workaround, restrict access for users with Contributor-level access and above.

**Name of the Vulnerable Software and Affected Versions** Blaze Demo Importer plugin for WordPress versions through 1.0.12 **Description** The Blaze Demo Importer plugin for WordPress is susceptible to unauthorized limited plugin installation due to a missing capability check within the `blaze demo importer install plugin` function. This allows authenticated attackers with Subscriber-level access or higher to install and activate a limited set of specific plugins. The News Kit Elementor Addons plugin and a BlazeThemes theme must be installed and activated for exploitation. **Recommendations** Update the Blaze Demo Importer plugin to a version later than 1.0.12.

The Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.1.7. This is due to missing or incorrect nonce validation on the bdfe install activate rswpbs only function. This makes it possible for unauthenticated attackers to install the 'rs-wp-books-showcase' plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The Zoho Flow plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.14.1. This is due to missing or incorrect nonce validation on the zoho flow deactivate plugin function. This makes it possible for unauthenticated attackers to modify typography settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

**Name of the Vulnerable Software and Affected Versions** LWSCache plugin for WordPress versions up to and including 2.8.5 **Description** The LWSCache plugin for WordPress is susceptible to unauthorized data modification because of insufficient authorization within the `lwscache activatePlugin()` function. This allows authenticated attackers with Subscriber-level access or higher to activate any whitelisted LWS plugins. **Recommendations** Update the LWSCache plugin to a version later than 2.8.5.

Name of the Vulnerable Software and Affected Versions: WP ULike Pro versions prior to 1.9.4 Description: The WP ULike Pro plugin for WordPress is susceptible to arbitrary file uploads due to inadequate file type validation within the `WP Ulike Pro File Uploader` class. This allows unauthenticated attackers to upload arbitrary files, including `.php2`, `.php6`, `.php7`, `.phps`, `.pht`, `.phtm`, `.pgif`, `.shtml`, `.phar`, `.inc`, `.hphp`, `.ctp`, `.module`, `.html`, and `.svg`, to the server. Successful exploitation may enable further attacks, such as Cross-Site Scripting. Recommendations: Update WP ULike Pro to version 1.9.4 or later.