PHP object injection in the Newsletters WordPress plugin (all versions before 4.16) permits unauthenticated remote attackers to supply arbitrary serialized PHP objects through a public-facing form, bypassing class restrictions entirely. If a suitable PHP gadget chain is present in the WordPress environment - commonly introduced by co-installed plugins or PHP libraries - this can escalate to remote code execution, data exfiltration, or full site compromise. A publicly available exploit has been confirmed by WPScan; however, EPSS stands at 0.16% (5th percentile), indicating limited observed mass exploitation at time of analysis despite the public PoC.
Privilege escalation in the Solace Extra WordPress plugin (versions before 1.6.1) allows any authenticated user with Subscriber-level access to modify site-wide presentation settings and permanently delete imported site-builder content by exploiting missing capability checks across multiple AJAX endpoints. The plugin incorrectly exposes nonce values on admin-accessible pages that low-privileged users can reach, collapsing the intended authorization boundary between Subscriber and Administrator roles. A publicly available proof-of-concept exists via WPScan; no public exploit identified at time of analysis has been confirmed by CISA KEV, and the EPSS score of 0.13% (3rd percentile) reflects low observed exploitation probability to date.
SQL injection via an unsecured AJAX endpoint in WP Directory Kit (WordPress plugin) before 1.5.5 allows any authenticated WordPress user - including low-privilege Subscribers - to query the underlying database and exfiltrate sensitive data. The AJAX action omits both authorization and nonce checks, collapsing what should be a privileged operation to the lowest authenticated tier. A public proof-of-concept exists per WPScan, though EPSS at 0.16% (6th percentile) indicates no widespread automated exploitation at time of analysis; this is not listed in CISA KEV.
Unauthenticated user enumeration in the Admin Safety Guard WordPress plugin (versions before 1.4.0) exposes the full registered user list - including usernames, email addresses, assigned roles, and two-factor authentication enrollment status - to any unauthenticated HTTP caller via an unprotected REST API endpoint. The irony is significant: a plugin marketed specifically for login security and brute-force protection inadvertently facilitates credential-stuffing and targeted attack preparation by leaking the exact user data attackers need. A publicly available proof-of-concept exploit exists, though EPSS sits at only 0.18% and CISA has not added this to the Known Exploited Vulnerabilities catalog.
WP Directory Kit versions before 1.5.5 expose the plugin's full settings - including sensitive API keys and third-party secrets - to any authenticated WordPress user, including low-privileged Subscribers, due to missing authorization and nonce validation on an AJAX endpoint. A vendor-released patch (version 1.5.5) is available, and a publicly available proof-of-concept exploit has been published by WPScan. Despite POC availability, EPSS sits at 0.14% (4th percentile), suggesting limited opportunistic exploitation at this time though the technical barrier to abuse is very low.
Unbounded retry loops in BC-FJA's JNI native entropy layer cause calling threads to hang indefinitely when Intel RDSEED or RDRAND instructions persistently fail, producing a non-interruptible thread-level denial of service in any Java FIPS application backed by bc-fips 2.1.x before 2.1.3. The affected JNI seeding routine re-issues the CPU entropy instruction without any iteration limit whenever the carry flag signals failure - a condition reproducible by hardware entropy source faults, DRBG exhaustion under heavy multi-core contention, or hypervisors that do not forward these Intel instructions to guest VMs. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the conditions are routinely present in virtualized environments where hypervisors commonly withhold RDRAND/RDSEED forwarding, making this a realistic operational risk for enterprise Java FIPS deployments in cloud or VM-based infrastructure.
Cryptographic key material in Bouncy Castle for Java FIPS (BC-FJA) persists in the JVM heap far beyond its intended lifetime on Java 12 and later runtimes because the library's zeroisation scheme relies on Object.finalize(), a mechanism progressively de-emphasized since Java 9 and deprecated for removal in Java 18. Under load, the single finalizer thread cannot retire pending objects as fast as they are allocated, causing the queue to grow without bound - resulting in an OutOfMemoryError that crashes the application and defeating the cryptographic hygiene goal of prompt key zeroisation. No public exploit is identified at time of analysis; however, any network-accessible application built on BC-FJA prior to the fixed versions is exposed to both a remotely triggerable denial-of-service and prolonged in-memory residence of sensitive key material.