Threat Intelligence Database

Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin versions up to 4.9.3 contain a path traversal vulnerability that allows authenticated users with Sales Representative-level access or higher to delete arbitrary files on the server. This vulnerability arises from insufficient validation of file paths in the copy_file function. Exploitation can lead to remote code execution if critical files such as wp-config.php are deleted.

The Modula Image Gallery – Photo Grid & Video Gallery WordPress plugin versions up to 3.0.11 suffer from a missing authorization vulnerability. This flaw allows unauthenticated attackers to access sensitive information, specifically the plaintext password and username used for password-protected galleries, via the REST API endpoint /wp-json/wp/v2/modula-gallery/{id}. Although the plugin has a separate endpoint that redacts this information for unauthenticated users, the core REST endpoint does not apply this protection, exposing credentials.

The My Calendar – Accessible Event Manager WordPress plugin contains a critical privilege escalation vulnerability in all versions up to 3.8.7. An unauthenticated attacker can exploit improper privilege management by injecting a crafted shortcode via a public GET parameter, leading to arbitrary PHP function calls. This allows overwriting the administrator account credentials, granting full administrative access. The vulnerability is exploitable through the plugin's publicly accessible auto-generated page.

The Gwolle Guestbook WordPress plugin up to version 5.1.1 is vulnerable to reflected Cross-Site Scripting (XSS) via the 'permalink' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when a user interacts with a crafted link. The issue arises from insufficient input sanitization and output escaping.

The Bulk Page Generator – LPagery WordPress plugin up to version 3.1.0 contains an authorization bypass vulnerability. Authenticated users with subscriber-level access or higher can create, modify, and delete pages and bulk page-generation processes without proper authorization checks. On fresh installations without Freemius opted in, the AES-256-CBC key used for Bearer token validation defaults to a publicly known value, allowing token forgery by any authenticated user.

Klarna for WooCommerce plugin versions up to and including 4.13.3 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to access sensitive order information, including secret order keys and full billing and shipping personally identifiable information (PII). The vulnerability arises because the plugin does not properly verify user authorization before exposing order details via a JavaScript variable. Attackers can enumerate all orders by exploiting sequential WooCommerce order IDs without needing authentication.

The FunnelKit – Funnel Builder Plugin for WooCommerce Checkout for WordPress has an authorization bypass vulnerability in all versions up to and including 3.16.0.6. This flaw allows unauthenticated attackers to retrieve billing personally identifiable information (PII) such as full name, street address, email, and phone number by submitting sequential order IDs. Exploitation requires the presence of a FunnelKit thank-you page rendering specific shortcodes. The vulnerability has a high severity rating with a CVSS score of 7.5.

The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin for WordPress contains a privilege escalation vulnerability in all versions up to and including 4.7.11. This flaw allows authenticated users with Subscriber-level access or higher to regain Administrator privileges under specific conditions related to the plugin's role-switching feature and bulk role changes. The vulnerability arises because the plugin's reset-view handler lacks proper nonce or capability checks and the cleanup mechanism does not trigger during bulk role changes, leaving stale administrator role metadata intact.

The Mang Board WordPress plugin up to version 2.4.3 is vulnerable to stored cross-site scripting (XSS) via the 'content' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. The vulnerability is exploitable through the publicly accessible wp_ajax_nopriv_mb_template endpoint, which lacks nonce verification for the content_reply mode and responds with Content-Type: text/html, causing browsers to execute injected scripts embedded in JSON responses.

Forminator Forms plugin for WordPress versions up to 1.58.1 contains a vulnerability allowing unauthenticated attackers to execute arbitrary shortcodes. This occurs due to improper validation before calling do_shortcode, enabling code injection via unauthenticated GET requests or anonymous comments. No specific Forminator configuration is required to exploit this issue.