Giveaways and Contests by RafflePress < 1.12.11 - IP Spoofing

Description The Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 1.12.7 due to insufficient IP address validation. This makes it possible for...

Classified Listing < 3.0.5 - Cross-Site Request Forgery to Account Takeover via rtcl_update_user_account

Description The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.4. This is due to missing or incorrect nonce validation on the 'rtclupdateuseraccount' function. This makes it...

Seriously Simple Podcasting < 3.0.0 - Unauthenticated Administrator Email Disclosure

Description The plugin discloses the Podcast owner's email address which by default is the admin email address via an unauthenticated crafted request. This was fixed in 3.0.0 for new plugin installation, however when upgrading, users will have to unset the "Owner email address" in the Feed Detail...

Ninja Forms Contact Form < 3.7.2 - Unauthenticated Second Order SQL Injection

Description The plugin is vulnerable to Second Order SQL Injection via the email address value submitted through forms due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to...

JobSearch WP Job Board < 2.3.4 - Authentication Bypass

Description The plugin does not prevent attackers from logging-in as any users with the only knowledge of that user's email address. PoC Browse to the site, paste the following in your browser's console replace the email address with that site's administrator's email address:...

Fatal Error Notify < 1.5.3 - Subscriber+ Test Error Email Sending

Description The plugin does not have authorisation and CSRF checks in its testerror AJAX action, allowing any authenticated users, such as subscriber to call it and spam the admin email address with error messages. The issue is also exploitable via CSRF PoC As a subscriber, open...

Spam protection, AntiSpam, FireWall by CleanTalk < 6.21 - Email Update via CSRF

Description The plugin does not have CSRF check in its apbctsettingsupdateaccountemail function, which could allow attackers to make logged in admins update email address via a CSRF attack...

Email Address Encoder 1.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Email Address Encoder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's eaeshortcode shortcode in version 1.0.22 due to insufficient input sanitization and output escaping on the 'link' user supplied attribute. This makes it possible for...

WP Mail Log < 1.1.3 – Incorrect Authorization in REST API Endpoints

Description The plugin does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users. PoC The following actions may be taken by a Contributor user: --- /wmllogs - Information leak Execute the...

UserPro < 5.1.2 - Authentication Bypass to Administrator

Description The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthenticated attackers to log ...

Funnelforms Free < 3.4.2 - Missing Authorization to Test Email Sending

Description The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfaf2testmail function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions a...

WP Mail SMTP Pro < 3.8.1 - Unauthenticated Email Address Disclosure

Description The plugin does not have authorisation in the isprintpage function, allowing unauthenticated users to retrieve sensitive information such as email address...

Jupiter X Core Premium < 3.4.3 - Unauthenticated Privilege Escalation

Description The plugin does not properly validate users during the Facebook login process, allowing unauthenticated users to login as any user by knowing their email address...

Biometric Login for WooCommerce < 1.0.4 - Unauthenticated Privilege Escalation

Description The plugin does not validate that a user's WebAuthn authentication request succeeded before sending them authentication cookies, making it possible for unauthenticated attackers to take over any accounts having WebAuthn credentials set up on affected sites. PoC While on the site not...

Security Advisory 0029

Security Advisory 0029 PDF Date: May 15th, 2017 Version: 1.0 Revision| Date| Changes ---|---|--- 1.0 | May 15th, 2017 | Initial release Affected Platforms: All EOS platforms Affected Software Version: All EOS releases prior to 4.18.1F. The list of affected releases is documented in Table-2. The...