The Custom Block Builder WordPress plugin before version 3.0.0 contains a code injection vulnerability due to improper permission checks on its REST routes. This flaw allows unauthenticated users to execute arbitrary PHP code on the server. The issue is fixed in version 3.0.0.
The Burst Statistics WordPress plugin before version 3.7.5 exposes titles and permalinks of unpublished posts (draft, pending, and private) in its public statistics output. This occurs because the plugin does not verify that page views belong to published content or check post status before displaying post information. This allows unauthenticated attackers to access sensitive information about unpublished content.
The Burst Statistics WordPress plugin before version 3.7.5 contains a vulnerability where the date range restriction on shared reports is not enforced. This allows anyone with the share link to access analytics data for any date range retained by the site, not just the intended period. This exposure of sensitive information can lead to unauthorized disclosure of site analytics.
A vulnerability in the WPGraphQL WordPress plugin before version 2.27.1 allows users with the Contributor role and above to access posts in custom non-public post statuses that they should not be able to read. This exposure of sensitive information occurs because the plugin does not properly restrict access to these posts.
A vulnerability in the Membership Plugin for WordPress before version 4.0.6 allows subscriber-level users to bypass authorization checks. This flaw enables them to access another member's Stripe payment client secret and attach a payment method to that member's pending payment. The issue arises because the plugin does not verify that the membership referenced in a saved-card payment request belongs to the user making the request.
A missing authorization and CSRF check vulnerability exists in the Membership Plugin WordPress plugin before version 4.0.6. This flaw allows unauthenticated users to trigger a schema-altering database maintenance routine that converts the plugin's tables to a narrower character set. This conversion irreversibly replaces every 4-byte character, including emoji and some CJK characters, in membership level, discount code, and payment records with question marks.
The RegistrationMagic WordPress plugin before version 6.1.0.4 contains a missing authorization vulnerability. It fails to verify ownership of submitted email addresses before updating associated user accounts. This allows unauthenticated attackers to overwrite profile fields of arbitrary non-administrator users by submitting a public form with crafted name and primary-email fields.
A Cross-site Scripting (XSS) vulnerability exists in the RegistrationMagic WordPress plugin before version 6.1.0.4. The flaw allows unauthenticated attackers to inject arbitrary JavaScript into several admin screens by exploiting improper escaping of user-supplied values inside inline script blocks. This malicious script executes in the context of an administrator's session if they open a crafted link.
A SQL injection vulnerability exists in the RegistrationMagic WordPress plugin before version 6.1.0.4. The plugin fails to properly sanitise and escape a parameter before using it in a SQL statement, which could allow high privilege users such as administrators to perform SQL injection attacks. This vulnerability is fixed in version 6.1.0.4.
Auth Armor WordPress plugin versions up to 1.0.3 have an improper authentication vulnerability that allows unauthenticated users to access handlers leaking stored API credentials and reset administrator enrollments, enabling account takeover.
The Payment Gateway via Valitor for WooCommerce WordPress plugin before version 1.9.41 contains an authorization flaw. It uses a hard-coded default verification secret for payment callbacks, which many stores may not have changed. This allows unauthenticated attackers to forge payment confirmations and mark arbitrary orders as paid.
The A2Reviews WordPress plugin versions up to 1.2.3 contain an authorization flaw where several API command handlers do not properly verify user permissions. This allows unauthenticated attackers to modify plugin settings and product review metadata, as well as read non-public product metadata.
Zr.Admin.NET versions from commit 0ee1ab8 through eb9228a have a path traversal vulnerability in the /common/DownloadFile endpoint. This flaw allows any logged-in user to read arbitrary files on the server by manipulating the path parameter with absolute paths or directory traversal sequences. Sensitive files such as appsettings can be accessed, potentially exposing the JwtSettings SecretKey, which attackers can use to forge administrator tokens.
A security vulnerability exists in Linux Foundation Magma up to version 1.9.0 involving hard-coded credentials in an unknown function within orc8r/lib/go/registry/interceptors.go. This flaw can be exploited remotely and has a CVSS score of 7.3, indicating high severity. Public exploit code is available, but the vendor has not responded to the disclosure. No patch or remediation information is currently provided.
An insecure direct object reference (IDOR) vulnerability exists in Zr.Admin.NET between commits e6ceaf4 and eb9228a in the FrontArticleController. Authenticated users can exploit this flaw to change the visibility and pin state of other users' articles by sending a crafted PUT request with their own UserId. This allows private articles to be made public and then accessed anonymously via a GET request.
Zr.Admin.NET versions from commit af07ffc through eb9228a contain an insecure direct object reference (IDOR) vulnerability in the SysProfileController.UpdateProfile function. This flaw allows any authenticated user to modify other users' accounts by specifying a UserId parameter. Exploiting this, an attacker can change the administrator's phone number to one they control, request an SMS code via the /checkMobile endpoint, and then log in as the administrator through /PhoneLogin, effectively taking over the administrator account.
A vulnerability in Linux Foundation Magma up to version 1.9.0 affects the hostOrgMiddleware function in the Host Middleware component. The flaw involves manipulation of the role argument, leading to missing authorization. The vulnerability can be exploited remotely. Public exploit code has been disclosed. The vendor has not responded to the disclosure, and no patch information is available.
Zr.Admin.NET versions between commits 85cff6a and eb9228a contain an insecure direct object reference (IDOR) vulnerability in the GET /workflow/instance/{instanceId} endpoint. This flaw allows authenticated low-privilege users to enumerate sequential instance IDs and access workflow instances belonging to other users, exposing sensitive data such as approval requests, form contents, applicant details, and approval records.
A cross-site scripting (XSS) vulnerability exists in Linux Foundation Magma up to version 1.9.0 in the handleReact function of the nms/server/main/routes.ts file within the NMS component. This vulnerability allows remote attackers to inject malicious scripts. Public exploit code is available, but the vendor has not responded to the disclosure. The vulnerability has a low CVSS score of 2.4.
A missing authorization vulnerability exists in Zr.Admin.NET between commits 1845017 and eb9228a in the TasksController.Get method. This flaw allows any authenticated user to access scheduled task details without requiring the monitor:job permission. Attackers can leverage an unprotected endpoint to enumerate task IDs and retrieve sensitive information such as job parameters, API URLs, cron expressions, and stored SQL statements. The vulnerability has a medium severity with a CVSS score of 4.3.