Threat Intelligence Database

The Booking calendar, Appointment Booking System plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 3.2.36. This flaw allows unauthenticated attackers to manipulate reservation statuses, cancel payments, auto-approve bookings (if a specific site option is enabled), and trigger booking-related emails by injecting crafted payment status and transaction data into the payments table.

The Image Uploader for Welcart WordPress plugin contains a SQL Injection vulnerability in the 'post_title' parameter in all versions up to and including 1.4.6. Authenticated users with author-level access or higher can exploit this flaw to append additional SQL queries, potentially extracting sensitive database information. The vulnerability arises from insufficient escaping and lack of proper query preparation. No official patch or remediation guidance is currently available.

The MaxUpload – Big File Uploads – Increase Maximum File Upload Size WordPress plugin contains an arbitrary file upload vulnerability in all versions up to and including 1.4.0. This occurs due to improper validation of the final assembled filename, allowing unauthenticated attackers to upload potentially executable files. This vulnerability can lead to remote code execution.

The User Session Synchronizer plugin for WordPress contains an authentication bypass vulnerability in all versions up to and including 1.4.0. The vulnerability arises because the synchronize_session() function does not validate critical parameters, allowing attackers to impersonate any user, including administrators, without prior knowledge of site secrets.

The Propovoice: All-in-One Client Management System WordPress plugin contains a privilege escalation vulnerability in all versions up to and including 1.7.8. The vulnerability arises because the REST endpoint for the create() function does not properly validate the user-supplied role parameter and lacks a capability check before assigning roles. This allows authenticated users with the ndpv_manager capability or higher to create new administrator accounts, resulting in full vertical privilege escalation.

The 6Storage Rentals WordPress plugin contains a critical authentication bypass vulnerability in versions up to and including 2.27.0. This flaw allows unauthenticated attackers to log in as any existing WordPress user, including administrators, by exploiting an AJAX handler that lacks proper verification. The vulnerability arises because the six_storage_create_wp_user() AJAX handler is registered without nonce, capability, credential, or ownership checks, enabling attackers to impersonate users by submitting their email addresses.

The Object Sync for Salesforce WordPress plugin contains an unauthenticated SQL Injection vulnerability in its /wp-json/object-sync-for-salesforce/push/ REST route via the wordpress_object_type parameter. The route lacks proper permission checks beyond the HTTP method, allowing unauthenticated attackers to inject arbitrary SQL queries. This can lead to extraction of sensitive data such as password hashes from the database. A patch is available, and since this is a cloud-hosted service, the vendor manages remediation.

The bLoyal: Loyalty & Promotions by bLoyal WordPress plugin contains a privilege escalation vulnerability in all versions up to and including 3.1.611.78. This flaw allows authenticated users with Subscriber-level access or higher to manipulate unprotected AJAX actions to overwrite critical plugin settings and subsequently authenticate as any WordPress user, including administrators. The vulnerability arises from missing capability and nonce checks on AJAX actions and improper trust in external API data for automatic customer login.

The RapiSafe – Secure Multi File Upload for Contact Form 7 WordPress plugin up to version 1.0.4 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary files on the server. This is due to insufficient validation of file paths in the handleAjaxRemoveUpload function. The required nonce to trigger the file removal is exposed in public JavaScript on pages with the RapiSafe upload field, making it accessible to any visitor. Exploitation can lead to remote code execution if critical files like wp-config.php are deleted.

The Online Booking & Scheduling Calendar for WordPress by vcita plugin is affected by a stored cross-site scripting (XSS) vulnerability via the 'business_id' parameter in all versions up to and including 4.6.0. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when users access the affected pages. The vulnerability is due to insufficient input sanitization and output escaping.