Workreap < 2.2.2 - Missing Authorization Checks in Ajax Actions

The theme had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operations such as modifying or deleting objects. This allowed a logged in user to modify or delete objects belonging to other users on the site. log in as arbitrary freelancer...

elFinder 安全漏洞

elFinder is a set of Drupal-based platform , open source AJAX file manager . The product provides multiple file uploads, image scaling and other features. A security vulnerability exists in ElFinder 2.1.47 and earlier versions, which stems from a command injection vulnerability in the program's P...

Workreap < 2.2.2 - Multiple CSRF + IDOR Vulnerabilities

Several AJAX actions available in the theme lacked CSRF protections, as well as allowing insecure direct object references that were not validated. This allows an attacker to trick a logged in user to submit a POST request to the vulnerable site, potentially modifying or deleting arbitrary object...

Workreap < 2.2.2 - Missing Authorization Checks in Ajax Actions

The theme had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operations such as modifying or deleting objects. This allowed a logged in user to modify or delete objects belonging to other users on the site. PoC log in as arbitrary...

WordPress Workreap premium theme <= 2.2.1 - Missing authorization checks in AJAX actions vulnerability

Missing authorization checks in AJAX actions vulnerability discovered by Harald Eilertsen Jetpack in WordPress Workreap premium theme versions = 2.2.1. Solution Update the WordPress Workreap premium theme to the latest available version at least 2.2.2...

WordPress MZ MBO Access plugin <= 2.0.8 - Unauthorized AJAX call vulnerability

Unauthorized AJAX call vulnerability discovered by WPScanTeam in WordPress MZ MBO Access plugin versions = 2.0.8. Solution Update the WordPress MZ MBO Access plugin to the latest available version at least 2.0.9...

Strong Testimonials < 2.51.3 - Unauthorised AJAX Call

The plugin did not propely check for CSRF and authorisation in all the wpmtstaddfieldfunction functions, allowing unauthorised call of the associated AJAX actions either via low privilege users or CSRF attack PoC https://example.com/wp-admin/admin-ajax.php?action=wpmtstgetcatcount...

MZ Mindbody API < 2.8.3 - Unauthorised AJAX Calls

The plugin did not properly check for CSRF and authorisation in various AJAX actions, allowing attacker to make users call them and perform unwanted actions, as well as allow low privilege users to call them As a low privilege user such as subscriber...

SEO Wizard <= 4.0.2 - Unauthorised AJAX Calls

The plugin does not properly check for CSRF in its ajaxsaveglobalsettings and ajaxsavepostsettings AJAX actions, as well as other AJAX actions. Furthermore, capability checks were also missing, resulting in any authenticated users as low as subscriber being able to call those actions and modify t...

Instantio < 1.2.6 - CSRF Bypass

The plugin did not properly check for CSRF in its wivariableproductquickview AJAX action, allowing attacker to make user call it via a CSRF attack...

Title Field Validation <= 1.1 - Unauthorised AJAX Calls

The plugin does not properly check for CSRF in its findposttype, savevalidation, editvalidation, updatevalidation and deletevalidation AJAX actions. Additionally, the actions were also missing any capability checks. As a result, any authenticated user such as subscriber could call them to create,...

Title Field Validation <= 1.1 - Unauthorised AJAX Calls

The plugin does not properly check for CSRF in its findposttype, savevalidation, editvalidation, updatevalidation and deletevalidation AJAX actions. Additionally, the actions were also missing any capability checks. As a result, any authenticated user such as subscriber could call them to create,...

Newspaper < 11 - Reflected Cross-Site Scripting (XSS)

Description The theme does not sanitise the tdatts.modulescategory parameter in its tdajaxsearch AJAX action, leading to a Reflected Cross-Site Scripting XSS vulnerability. PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate...

Newspaper < 11 - Reflected Cross-Site Scripting (XSS)

Description The theme does not sanitise the tdatts.modulescategory parameter in its tdajaxsearch AJAX action, leading to a Reflected Cross-Site Scripting XSS vulnerability. POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type...

Booking Calendar | Appointment Booking | BookIt < 2.1.6 - Authorised AJAX Calls

The plugin does not properly check for CSRF in some of its AJAX actions, allowing them to be bypassed. Attackers could make logged in users call them and perform unwanted actions...

Adapta RGPD < 1.3.3 - Unauthorised Consent via CSRF

The acceptcookieconsent AJAX action did not properly check for CSRF, allowing attackers to make users consent via a CSRF attack. PoC https://example.com/wp-admin/admin-ajax.php?action=acceptcookieconsent...

WP Prayer < 1.5.5 - Unauthorised AJAX call via CSRF

The plugin did not properly check for CSRF in its wpeajaxcall AJAX action, which then call other method dynamically, allowing attacker to make user perform unwanted actions...

SEO Wizard <= 4.0.2 - Unauthorised AJAX Calls

The plugin does not properly check for CSRF in its ajaxsaveglobalsettings and ajaxsavepostsettings AJAX actions, as well as other AJAX actions. Furthermore, capability checks were also missing, resulting in any authenticated users as low as subscriber being able to call those actions and modify t...

Express Shop < 4.0.3 - CSRF Bypass

The plugin did not properly check for CSRF in its qcldexpressvariableproductquickview AJAX action, allowing attacker to make user call it via a CSRF attack...

Food Store < 1.3.7 - Unauthorised AJAX call via CSRF

The plugin did not properly check for CSRF in its AJAX actions, allowing attackers to make users perform unwanted actions via a CSRF attack, such as add product add-on for users with the editproducts capability, as well as add/remove arbitrary products to the basket of the targeted user...