The blender-headless package on PyPI contains malicious code that leaks the installer's hostname and import events via DNS queries to an external domain. This occurs during both package installation and module import, bypassing typical HTTP egress controls. The package's module name and package name are unrelated, and its only behavior is this DNS beaconing.
The PyPI package 'infra-libs' version 99.99.99 performs unauthorized DNS exfiltration of the installer's hostname during installation and import. It constructs DNS queries embedding the hostname to a suspicious external domain unrelated to the publisher, with no legitimate functionality justifying this behavior. This package name is confusable with internal infrastructure libraries, increasing risk of dependency confusion attacks.
The PyPI package 'expect-tests' version 99.99.99 contains malicious code that exfiltrates the installer's hostname by encoding it into a subdomain and triggering DNS resolution to an unauthorized external server. This behavior occurs both during package installation and when the installed module is imported. The package exhibits suspicious characteristics such as a misleading version number and mismatched package and module names, consistent with a dependency confusion or name-squatting attack.
The rainbowcolors package on PyPI, version 0.1.0, masquerades as an ANSI-color helper but downloads and executes a malicious binary on Windows systems. Upon the first use of any color method, it fetches an executable from an anonymous file-sharing URL, saves it to a temporary folder, and runs it detached from the console. It also modifies Microsoft Defender settings to exclude the drop folder and executable from antivirus scanning, facilitating stealthy execution of the malicious payload.
The PyPI package 'chromacli' versions 0.1.0 through 0.1.4 contains malicious code that downloads and executes an unsigned Windows executable from an anonymous file-sharing site. This executable is saved to a temporary folder and launched in a detached process. The package also disables Microsoft Defender detection for the dropped binary by adding exclusions via PowerShell commands. The malicious behavior is unrelated to the package's stated purpose as a terminal color library and is characteristic of malware droppers delivering infostealers.
The FV Flowplayer Video Player WordPress plugin versions prior to 7.5.57.7212 have a vulnerability where an AJAX action that performs a site-wide content rewrite lacks authorization checks. This allows any authenticated user, including those with subscriber-level access, to trigger bulk modifications of posts they normally cannot edit.
The Pie Register WordPress plugin versions through 3.8.4.15 have a vulnerability where one of its request handlers lacks capability, nonce, or authentication checks. This allows unauthenticated attackers to reset the plugin's settings to defaults, disabling registration security controls like new-user email verification, and to destroy a plugin data table.
The Secure Custom Fields WordPress plugin versions before 6.9.8 lack a read-permission check when rendering and formatting relational field values. This flaw allows users with post-editing privileges (Contributor role and above) to view titles and non-public statuses of unpublished posts owned by other users.
The Event Tickets Manager for WooCommerce WordPress plugin versions before 1.6.0 contains a vulnerability in its ticket-transfer feature. This feature lacks proper authorization and nonce validation, allowing unauthenticated users to transfer guest-checkout tickets belonging to other attendees. This unauthorized transfer invalidates the legitimate ticket and causes the victim's ticket PDF, which includes personal attendee data, to be sent to the attacker.
The Secure Custom Fields WordPress plugin versions prior to 6.9.8 have a vulnerability where field-group location rules are not re-applied when saving values through the post editor. This flaw allows users with contributor-level access or higher to write custom fields that the site intended to restrict to administrators onto their own posts.
The Secure Custom Fields WordPress plugin versions before 6.9.8 contain a vulnerability where a persisted field definition is not sanitized before being emitted as an HTML attribute name. This allows a user with the ability to configure fields to store a payload that executes JavaScript in the browsers of users viewing the affected field. In multisite environments, this can enable a site administrator without the unfiltered_html capability to inject script into other users' sessions.
The Pie Register WordPress plugin up to version 3.8.4.15 contains a vulnerability where an AJAX action does not perform an authorization check. This flaw allows users with the contributor role or higher to modify invitation-code records created by administrators.
A vulnerability in the Secure Custom Fields WordPress plugin before version 6.9.8 allows users with contributor-level access and above to modify bidirectional relationship references on posts, users, or terms they normally cannot edit. This occurs because the plugin does not verify user permissions before writing to the target object during synchronization.
The Ecommerce Affiliate WordPress plugin up to version 1.0.0 contains a vulnerability that allows unauthenticated attackers to issue and verify one-time passwords without restriction. This flaw enables attackers to take over any user account, including administrator accounts, due to the lack of verification limits and ownership checks.
The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin up to version 2.0.1 has a vulnerability where it does not properly verify the authenticity of incoming bank-transfer payment notifications by default. This flaw allows unauthenticated attackers to mark arbitrary WooCommerce orders as paid without authorization.
The Razorpay for WooCommerce WordPress plugin versions before 4.8.9 contain a vulnerability where a value derived from an incoming webhook request is not properly sanitized or escaped before being used in a SQL query. This flaw allows users who can obtain the webhook secret, typically administrators, to perform SQL injection attacks.
The Contact Form 7 WordPress plugin versions before 6.2.4 contain a vulnerability where the plugin does not validate the type or extension of files uploaded through form file fields. Additionally, a flaw in the temporary-file cleanup process leaves uploaded files on disk. This allows unauthenticated users to upload arbitrary files to the site. On certain server configurations, such as stock Debian or Ubuntu Apache setups that list directory contents and map .phar files to the PHP handler, this can lead to remote code execution. On other configurations, including nginx and Apache with .htaccess overrides, the impact is limited to arbitrary files being written to the uploads directory, which may still be served as active content like HTML or SVG from the site's origin.
The Productive Commerce WordPress plugin versions before 1.1.54 contain a vulnerability where a parameter is not properly sanitized and escaped before being used in a SQL statement. This flaw allows unauthenticated attackers to perform SQL injection attacks against affected installations.
A vulnerability in the WP Recipe Maker WordPress plugin before version 10.9.2 allows unauthenticated users to access the full content of recipes embedded in password-protected posts. This occurs because the plugin does not verify whether the post containing the recipe is password protected before returning recipe data via its REST API and structured data output.
The Sync Post With Other Site WordPress plugin versions prior to 1.9.4 have an authorization flaw that allows users with Contributor-level access or higher to create and modify arbitrary custom post types, including changing content authorship. This issue affects post types other than pages and can lead to unauthorized content management actions.