The Tournamatch WordPress plugin versions prior to 4.7.1 contain a vulnerability where the plugin does not validate or restrict the path of a previously stored profile or team image before deleting it during a new image upload. This flaw allows users with minimal privileges, such as Subscribers, to delete arbitrary files on the server, including critical files like wp-config.php, potentially leading to a full site takeover.
The Directorist WordPress plugin versions before 8.11 have a vulnerability where the checkout payment-retry REST action does not verify that the order belongs to the requesting user. This flaw allows any authenticated user, including subscribers, to create payment-attempt records on orders owned by other users.
The Event Tickets with Ticket Scanner WordPress plugin versions before 3.2.9 contain a vulnerability where search values are not properly escaped before being used in SQL queries in several admin listings. This flaw allows users with admin area access to perform SQL injection attacks. By default, only administrators have this access, but other roles may be granted it through plugin settings.
The Advanced Custom Fields (ACF®) WordPress plugin versions prior to 6.8.11 lack a read-permission check when rendering and formatting relational field values. This flaw allows users with post-editing capabilities (Contributor role and above) to view titles and non-public statuses of unpublished posts owned by other users.
The Advanced Custom Fields (ACF®) WordPress plugin versions before 6.8.11 have a vulnerability where field-group location rules are not re-applied when saving values through the post editor. This allows users with contributor-level access and above to write custom fields that are normally restricted to administrators onto their own posts.
The Event Tickets with Ticket Scanner WordPress plugin versions before 3.1.14 have an authorization flaw that allows users with access to the plugin's admin area, including roles as low as Subscriber, to view and remove ticket data from WooCommerce orders without proper permission checks.
The Tournamatch WordPress plugin versions prior to 4.7.1 have a vulnerability where the team invitation listing is not properly access-restricted. This flaw allows unauthenticated users to access and retrieve email addresses of individuals invited to join teams.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability that could allow an authenticated privileged attacker to send unauthorized requests from the system. This vulnerability may enable the attacker to enumerate network resources or facilitate further attacks. The vulnerability has a low CVSS score of 3.8 and does not have known exploits in the wild.
The Soledad WordPress theme up to version 8.7.7 contains a stored cross-site scripting (XSS) vulnerability in its social profile fields. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when any user visits the attacker's author archive page. This vulnerability arises from insufficient input sanitization and output escaping, exposing the injected payload publicly regardless of post publication status.
The Directorist WordPress plugin before version 8.11 has a vulnerability where it does not verify ownership of a listing before processing a featured-listing checkout. This allows any authenticated user, including subscribers, to publish and feature another user's pending listing if the featured listing fee is zero.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authorization vulnerability that allows low-privileged users to query arbitrary indices and access sensitive data. This issue arises from missing authorization checks in the affected versions.
A vulnerability in The Directorist WordPress plugin before version 8.11 allows authenticated users with Subscriber-level access or higher to access private and unpublished draft listing details of other users via an AJAX action. This occurs because the plugin does not verify ownership of the listing before returning its metadata, potentially exposing sensitive contact information.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability that allows an authenticated attacker to send unauthorized requests from the system. This vulnerability could enable attackers to enumerate internal network resources or facilitate further attacks.
The Live Composer WordPress plugin versions before 2.1.23 contain a vulnerability where certain custom post type slug settings are not properly sanitized and escaped before being used in front-end links. This flaw allows high privilege users, such as administrators, to perform stored cross-site scripting (XSS) attacks even if the unfiltered_html capability is disabled, such as in multisite WordPress setups.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability that allows a remote attacker to bypass protections blocking requests to internal network addresses. This flaw enables the attacker to make the server contact internal services and retrieve partial responses, potentially exposing sensitive information.
The Tutor LMS WordPress plugin up to version 4.1.2 contains an Insecure Direct Object Reference (IDOR) vulnerability in the init_routes function. Authenticated users with subscriber-level access or higher who possess a valid Tutor LMS API key/secret can exploit this flaw to access paid course content without enrollment, retrieve quiz answer keys, and enumerate sensitive user information including email addresses, usernames, and registration data of instructors and administrators.
A vulnerability in The Directorist WordPress plugin before version 8.11 allows any authenticated user to access payment receipt information of other users' orders. This includes sensitive details such as payment amounts, methods, status, and transaction IDs.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 use weaker than expected cryptographic algorithms. This weakness could allow an attacker to decrypt highly sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.9.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 contain a vulnerability where a hard-coded cryptographic key is used to protect stored credentials. An attacker with access to the stored data could decrypt sensitive credentials by exploiting this hard-coded key.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where the backup server's identity is not properly verified during the establishment of secure connections for analytics backups. This flaw could allow a network-positioned attacker to intercept backup data and potentially credentials if used.