Missing authorization on an AJAX endpoint in the CryptoPayment Gateway WordPress plugin (versions 1.2.1 through 1.2.2) lets remote unauthenticated attackers invoke administrative operations. An attacker can delete arbitrary files on the server, overwrite the payment gateway configuration, and read stored wallet credentials in cleartext. Publicly available exploit detail exists (reported by WPScan); there is no public evidence of active exploitation at time of analysis, though the CVSS vector (10.0, AV:N/AC:L/PR:N/UI:N/S:C) marks it as trivially exploitable.
Unauthenticated stored XSS in the YouTube Embed WordPress plugin (versions 10.0-10.3) allows any unauthenticated site visitor to inject and persist arbitrary JavaScript in the WordPress database by exploiting an AJAX endpoint that performs no authorization check beyond a nonce embedded in every public-facing page. The stored payload executes in the browser session of any subsequent visitor or administrator who views the affected content, enabling session hijacking, administrative account takeover, or full site compromise. A publicly available exploit exists (reported by WPScan), materially elevating real-world risk for any site running the affected plugin versions.
The GenieWords WordPress plugin versions 1.5.27 through 1.5.34 allows unauthenticated attackers to overwrite plugin configuration via unprotected REST API and AJAX endpoints, then achieves persistent stored XSS on every front-end page because stored values are decoded and printed without sanitization. Any site visitor who loads a front-end page becomes an XSS victim, enabling session hijacking, credential theft, or malicious redirects at scale. A publicly available exploit exists (WPScan); no active exploitation is confirmed in CISA KEV at the time of analysis, but the unauthenticated attack path and low complexity make opportunistic mass-scanning feasible.
Unauthenticated stored XSS and theme settings destruction in the Hoo Companion WordPress plugin (≤1.0.2) allows any remote attacker to inject persistent JavaScript into the active theme's settings via the plugin's ungated import endpoint, causing malicious scripts to execute in every visitor's browser including administrators. The same single request unconditionally overwrites and destroys the site's existing theme settings, combining a persistent cross-site scripting attack with immediate site defacement. A publicly available exploit exists via WPScan; no public exploit identified at time of analysis for active exploitation (not in CISA KEV).
Local privilege escalation in Tonec Internet Download Manager (IDM) versions up to 6.42 Build 63 on Windows allows a low-privileged local attacker to gain full SYSTEM-level kernel control by exploiting improper access controls in the idmwfp.sys kernel driver (CWE-284). A public proof-of-concept exploit is available on GitHub under the repository name IDM_LPE_PoC, substantially lowering the barrier to exploitation. The vendor was notified prior to disclosure but did not respond, and no patch has been released at time of analysis.
Sandbox escape in CrewAI's CodeInterpreterTool allows untrusted Python code to break out of the in-process restricted execution environment and execute arbitrary commands on the host system. Pre-fix versions implemented import-time module name blocking as the sole security boundary, which is bypassable because Python's complete object graph remains accessible - for example, `ctypes.CDLL(None)` loads the C standard library via the dynamic linker without invoking any import machinery, and `__class__.__mro__` traversal can recover the original `__import__` built-in. All crewai-tools deployments using CodeInterpreterTool without Docker (triggering the now-removed fallback sandbox) are affected. No public exploit code or KEV confirmation exists at time of analysis, though the researcher advisory and vendor commit both describe the escape technique explicitly.
Unauthenticated permanent deletion of arbitrary WordPress content is possible in sites running the MDJM Event Management plugin (before 1.7.8.5) or Mobile Events Manager plugin (through 1.4.8.3). Both plugins expose a playlist entry removal endpoint that performs no capability check, nonce validation, or post-type verification before permanently deleting the post identified in the request, bypassing the WordPress trash mechanism. A publicly available proof-of-concept exploit reported by WPScan makes this trivially exploitable against any affected installation, with irreversible content destruction as the outcome.
Two-factor authentication bypass in the Really Simple Security WordPress plugin (versions before 9.8.1) allows an attacker who already holds a target account's password to eliminate that account's email 2FA requirement entirely and obtain the resulting session, up to administrator level. The root flaw is an unauthenticated endpoint that resets a completed email 2FA enrollment, collapsing multi-factor authentication to single-factor for the attack window. A publicly available exploit has been published via WPScan, and the vendor has released a fix in version 9.8.1.
Privilege escalation in the User Registration & Membership WordPress plugin (versions 4.4.6 through pre-5.2.8) allows any subscriber-level authenticated user to be granted the WordPress role attached to a paid membership plan without completing payment, by exploiting a missing capability check and absent payment method and plan validation on the purchase endpoint. Where site administrators have configured membership plans mapped to privileged WordPress roles - including administrator - this results in full privilege escalation from subscriber to administrator without financial transaction. A publicly available proof-of-concept exploit from WPScan confirms the attack path is well-documented and reproducible against sites with open user registration.
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.8 allows any authenticated user holding an Author-level role or above to assign themselves an arbitrary WordPress role, including Administrator, resulting in full site takeover. The plugin fails to enforce server-side authorization checks when creating membership plans and when users attach plans to their own accounts, permitting role manipulation that bypasses WordPress's native access-control hierarchy. A publicly available exploit exists via WPScan, and the CVSS 7.2 score understates real-world risk because the provided PR:H metric conflicts with the description's requirement of only Author-level access - a low-privilege role - suggesting a closer real-world base score of approximately 8.8.
ZooKeeper credential disclosure in Apache Storm 3.0.0 exposes `storm.zookeeper.topology.auth.payload` through two independent channels: Nimbus serves the full topology configuration verbatim to any caller holding read-only permissions, and the submission client logs the same payload at INFO level on every submission while SASL handlers emit it at DEBUG. An authenticated user with only read-only topology view rights can recover the ZooKeeper write credential and use it to forge or suppress worker heartbeats, backpressure, and error state for the affected topology, or indirectly obtain it via log aggregation pipelines or support bundles. No public exploit has been identified; vendor-released patch version 3.1.0 is available.
Unauthenticated remote attackers can exhaust the heap of the Apache Storm DRPC server by sending requests with arbitrarily many distinct function names, causing a permanent, unbounded memory leak that accumulates until the process is killed by OOM. Affected is org.apache.storm:storm-server versions 3.0.0 through 3.0.x; version 3.1.0 is the fix release. Because drpc.authorizer is unset in the default configuration, no credentials are required to trigger the condition, making this a zero-configuration DoS against any network-reachable DRPC endpoint. No public exploit code has been identified at time of analysis.
Unauthenticated remote memory exhaustion in Apache Storm Worker (org.apache.storm:storm-client 3.0.0-3.0.x) allows any TCP peer reachable to a worker slot port to drive arbitrarily large JVM heap allocations with a single crafted frame. The Netty pipeline installs the message decoder ahead of SASL authentication handlers, and the default value of storm.messaging.netty.authentication is false, meaning no credentials are required regardless of configuration. Impact is availability-only - worker process crash or severe GC pressure at the 768 MB default heap - with no code execution or data exfiltration path. No public exploit has been identified at time of analysis; the vulnerability was discovered via automated Claude agent security research and validated by the Apache Storm project.
Authorization bypass in Apache Storm Client 3.0.0 permits any authenticated Nimbus principal to perform unrestricted user-level cluster operations when access control is configured via `nimbus.groups` alone. The `SimpleACLAuthorizer` evaluates user-level commands by returning early with a grant when `nimbus.users` is empty, never reaching the group evaluation branch, so group restrictions are silently ignored. Operators who followed the documented `nimbus.groups`-only access control pattern in `docs/SECURITY.md` would believe their cluster was restricted while every authenticated credential held full permission to submit topologies, upload files, and retrieve Nimbus configuration. No public exploit code exists and no CISA KEV listing is present at time of analysis.
Missing authentication on update endpoints in jaychouchannel's Tourism-Management-System exposes write operations across 12 Spring controllers - including chat messages, forum posts, hotel/restaurant discussions, news, friend links, and bookmarks - to unauthenticated remote attackers. The root cause is confirmed by the patch commit (84d8ec3): the custom `@IgnoreAuth` annotation was incorrectly applied to update-path handlers, causing the authentication interceptor to skip those routes entirely. A public proof-of-concept exists via GitHub Issue #11; no CISA KEV listing has been issued.
Authentication bypass in vvbbnn00's WARP-Clash-API allows unauthenticated remote attackers to circumvent the `authorized` function by manipulating the SECRET_KEY argument, gaining unauthorized access to the API's proxy configuration management functions. All versions up to commit c7bf2360073959861219b422e51ae86411051b46 are affected, and no patch exists because the maintainer has abandoned the project and did not respond to disclosure. A public proof-of-concept exploit is available via a GitHub gist, lowering the bar for exploitation against any internet-exposed instance.
Improper access control in Rizwan17's PHP-based inventory-management-system exposes dashboard.php to unauthorized access via manipulation of the `userid` parameter, allowing remote unauthenticated attackers to access other users' data or bypass authentication controls. The affected codebase is identified by commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f and is distributed as a rolling release with no versioned patch available. A public proof-of-concept exploit has been published in a GitHub issue, and the maintainer has not responded to the responsible disclosure.
Unauthenticated remote attackers can register accounts with elevated (administrator) privileges in jaychouchannel Tourism-Management-System by manipulating the UsersEntity parameter during registration, bypassing role assignment controls. The commit diff reveals a broader scope than the description implies: at least 12 controller classes (ChatmessageController, multiple Discuss* controllers, ForumController, FriendController, FriendlinkController, NewsController, NewstypeController, StoreupController) had security() endpoints decorated with @IgnoreAuth, making those endpoints callable without any authentication. Publicly available exploit code exists; no active exploitation confirmed in CISA KEV.
Privilege escalation through parameter manipulation in Rizwan17's inventory-management-system allows remote unauthenticated attackers to register accounts with arbitrary privilege levels, including administrative roles, by supplying a crafted `usertype` value to the `createUserAccount` function in `register.php`. The vulnerability stems from the registration handler trusting client-controlled role values without server-side enforcement of permitted self-registration tiers. A public exploit is available via a GitHub issue report, and the vendor has not responded to the coordinated disclosure as of the time of reporting.
SQL injection in SourceCodester School Registration and Fee System 1.0 allows unauthenticated remote attackers to read, modify, or delete database contents via the Category parameter in /bilal/save_class.php. A public proof-of-concept exploit has been disclosed on GitHub, lowering the skill threshold for exploitation. No KEV listing exists, but the combination of unauthenticated network access and a publicly available exploit makes this an active concern for any deployed instance.
Unconstrained memory allocation in TooTallNate Java-WebSocket 1.6.0-1.6.1 allows remote unauthenticated attackers to exhaust server heap memory by sending WebSocket frames with arbitrarily large declared payload lengths. The Draft_6455 fragmentation handler initialized maxFrameSize to Integer.MAX_VALUE (~2 GiB), so the library attempts to allocate the full declared frame size before any payload data is actually received. A publicly available proof-of-concept exists via GitHub issue #1508; the upstream fix is in PR #1509 but has not yet shipped in a tagged release.
SQL injection in SourceCodester School Registration and Fee System 1.0 allows remote unauthenticated attackers to manipulate database queries via the `period` parameter of `/bilal/normal/pay_report.php`. A public proof-of-concept exploit has been published on GitHub (vuldb.com/submit/912055, github.com/zuojiu567/cve/issues/3), lowering the bar for exploitation significantly. No vendor patch has been identified at time of analysis, leaving deployments exposed with no vendor-supplied remediation path.
Uncontrolled resource consumption in evanchiu/serverless-todo (versions 1.0.3 and 2.0.0) allows remote unauthenticated attackers to exhaust compute or memory resources by sending crafted payloads to the API Todo Endpoint's saveTodos function. The vulnerability stems from unsanitized processing of the event.body argument in src/index.js without input size or rate limits. A public proof-of-concept is available via a GitHub issue; no patch has been released and the maintainer has not responded to the disclosure.
Authentication bypass in Cheshire Cat AI up to version 1.9.2 allows remote unauthenticated attackers to manipulate the `user_id` argument within the `_authorize_http_key` function to circumvent HTTP API key validation entirely. Any publicly exposed Cheshire Cat AI instance is at risk of unauthorized access to its AI agent API, enabling arbitrary interaction with the agent without valid credentials. A proof-of-concept exploit has been publicly disclosed via GitHub issue #1137, and the project maintainers had not responded to the disclosure at time of writing; no patch is available.
Insecure Direct Object Reference (IDOR) in PHPGurukul Bank Locker Management System 1.0 allows unauthenticated remote attackers to enumerate and view locker assignment records belonging to arbitrary customers by manipulating the `ltid` parameter in `/blms/view-assign-locker.php`. The application fails to verify whether the requesting party is authorized to access the referenced locker transaction record, exposing sensitive banking assignment data. A publicly available proof-of-concept exploit exists, though no CISA KEV listing indicates confirmed active exploitation at scale.
Hard-coded AES encryption in dromara orion-visor up to version 2.5.7 renders all SSH private keys and host passwords stored by the application recoverable by any attacker who can access the data store. The vulnerable function `HostKeyServiceImpl.encryptKey` in the asset-service module applies a fixed, unchanging key that is embedded in the publicly available GitHub source - making the key universally known to anyone who inspects the repository. A proof-of-concept demonstrating full plaintext recovery of stored SSH credentials has been publicly disclosed, and the maintainer has not responded to the issue report.
Default credential exposure in lenve vhr 1.0-SNAPSHOT allows unauthenticated remote attackers to authenticate as a privileged application user by submitting credentials embedded verbatim in the vhr.sql database seed file. A public proof-of-concept advisory (VHR-VULN-008) documents the specific credentials, removing any discovery barrier. The vendor did not respond to responsible disclosure, leaving no official patch available and the default credentials in place across all unmodified deployments.
SQL injection in SourceCodester School Registration and Fee System 1.0 exposes the student deletion endpoint (/bilal/normal/delete_stud.php) to remote unauthenticated attackers through an unsanitized PHP array parameter `selector[]`. A proof-of-concept exploit is publicly available via GitHub, enabling attackers to read or manipulate the underlying MySQL/MariaDB database. The CVSS 4.0 score of 6.9 (Medium) reflects per-axis Low impact across confidentiality, integrity, and availability, consistent with a PHP application database rather than a critical infrastructure system; no KEV listing indicates no confirmed mass exploitation at time of analysis.
Unauthenticated SQL injection in Feng Office's Legacy API allows remote attackers to manipulate the `auth` argument passed to the Contacts::instance->findAll function in application/models/CompanyWebsite.class.php, enabling partial read, write, and availability impact against the underlying database on versions up to and including 3.11.13.11. Publicly available exploit code has been disclosed on Google Drive, and the vendor did not respond to responsible disclosure contact prior to publication. No KEV listing exists, but the combination of PR:N attack surface and a live POC elevates practical risk above the moderate CVSS 4.0 score of 6.9.
Privilege escalation in the Simple Membership WordPress plugin before 4.7.8 allows authenticated members to obtain higher-tier memberships without paying the correct price. The plugin's PayPal IPN (Instant Payment Notification) handler accepts the membership level asserted in the payment notification without verifying it matches the level configured for the specific payment button that was purchased, enabling a low-cost membership purchase to be fraudulently upgraded to any higher tier. A publicly available exploit exists, and vendor patch 4.7.8 resolves the issue.
Unauthenticated information disclosure in the Bookit - Booking & Appointment Calendar WordPress plugin (versions before 2.6.0.1) exposes appointment records belonging to other customers via the availability-check endpoint. Any unauthenticated visitor can query this endpoint and receive free-text booking comments, personal contact information, and appointment details that belong to other registered users. A publicly available proof-of-concept exploit exists (documented by WPScan), lowering the skill barrier for abuse. No active exploitation has been confirmed in CISA KEV.
Unauthenticated information disclosure in the 'Contact Form to Chat Apps | Click to Chat to Order' WordPress plugin before 2.15.8 exposes all submitted form entries to any anonymous HTTP client. The plugin registers a public WordPress AJAX action that performs no capability check, nonce verification, or session validation - three standard WordPress authorization layers - allowing any remote actor to dump contact form submissions. A publicly available proof-of-concept exploit exists, reported by WPScan, making opportunistic mass scanning trivial.
Stored cross-site scripting in Strapi's headless CMS admin panel allows a low-privileged Author to inject persistent JavaScript that runs in the session of Editor or Super Admin reviewers. The WYSIWYG preview component (PreviewWysiwyg.tsx) rendered markdown through a sanitize-html configuration set to allowedTags:false, permitting script tags to survive into the DOM; when a higher-privileged user expands the preview pane the payload executes, enabling account takeover. It affects Strapi 4.x through 4.26.2 and 5.x before 5.48.1, was reported by VulnCheck, and carries a CVSS 4.0 base of 9.3, with no public exploit identified at time of analysis.
Administrator account takeover in LangBot before 4.10.11 stems from password-recovery keys generated with only 24 bits of entropy (secrets.token_hex(3)) combined with a total absence of rate limiting on the unauthenticated reset-password endpoint. A remote attacker who knows the administrator's email address can fire concurrent requests to exhaust the ~16.7M-value keyspace and reset the admin password, seizing full control of the instance. VulnCheck reported the issue and a vendor patch exists (4.10.11); no public exploit is identified at time of analysis, and the flaw is not in CISA KEV.
Stack buffer overflow in SIPp through 3.7.7 allows unauthenticated remote attackers to crash the process by sending a crafted SIP message whose To header tag parameter is 2049 bytes or longer. The get_peer_tag() function in sip_parser.cpp copies the tag value into a fixed-size static buffer without a bounds check, enabling the overflow and resulting in a process crash. No public exploit has been identified at time of analysis, but the trigger condition is trivial to reproduce given the precise byte threshold documented by VulnCheck, and an upstream fix has been committed.
Stack-based buffer overflow in SIPp through 3.7.7 allows a malicious SIP server to crash the client process by sending a crafted 401 or 407 authentication challenge containing an oversized algorithm parameter. The flaw originates in createAuthHeader() at src/auth.cpp:183-192, where the original code uses strncpy bounded by end-start (an attacker-controlled length derived from the algorithm field) rather than the fixed size of the stack-allocated algo buffer. No public exploit has been identified at time of analysis, but upstream fix code is publicly available via GitHub PR #880.
Arbitrary code execution in ESPnet before v.202609 is triggered when a user loads an attacker-crafted PyTorch checkpoint through any of the framework's model initialization, fine-tuning, or averaging pipelines. The root cause is CWE-502 (Deserialization of Untrusted Data): ESPnet called torch.load with weights_only=False across at least four distinct code paths, allowing pickle-embedded payloads to execute arbitrary commands with the privileges of the ESPnet process. No public exploit has been identified at time of analysis, but the attack technique - crafting malicious PyTorch pickle checkpoints - is thoroughly documented in the ML security community and requires minimal skill to reproduce.
Cross-tenant code execution in Apache Storm Client 3.0.x allows any authenticated cluster user to pre-position a malicious JAR under a predictable blob key and have it loaded into a victim tenant's worker topology. The blob key for `--artifacts` dependency uploads is derived solely from the Maven coordinate, making it identical and guessable for all cluster principals; when the key already exists the client silently reuses the blob without verifying ownership or content integrity. Exploitation results in arbitrary code execution inside the victim's Storm topology, enabling full access to the data and credentials that topology processes. No public exploit has been identified at time of analysis.
Path traversal in rustypaste before 0.18.1 permits unauthenticated remote attackers to write uploaded content to arbitrary filesystem locations by supplying path traversal sequences (e.g., '../../') in the optional custom `filename` HTTP header. The flaw is a validation-ordering error in `src/paste.rs`: the upload destination is validated against the configured upload directory before the attacker-controlled filename header is applied, so the directory-escape check never evaluates the final resolved path. No public exploit has been identified at time of analysis, but the fix commit and GitHub issue make the exact vulnerable code pattern publicly visible, substantially lowering the barrier for reproduction.
Denial of service in UnrealIRCd's embedded webserver (versions 6.0.5-6.2.6) allows unauthenticated remote attackers to exhaust server memory by sending an HTTP request containing an unbounded number of headers, rendering the IRC daemon unresponsive. The attack surface exists only when a WebSocket or JSON-RPC listener is explicitly enabled, both of which are disabled in the default configuration. The issue is resolved in version 6.2.7 per the vendor advisory, and no public exploit code has been identified at time of analysis.
Open redirect in the User Registration & Membership WordPress plugin before 5.2.8 permits unauthenticated attackers to craft post-login redirect URLs pointing to arbitrary external domains, enabling phishing campaigns targeting site visitors. The plugin fails to validate the destination parameter before executing the redirect, meaning any visitor who follows a specially crafted login link is silently forwarded to an attacker-controlled page after authenticating. A publicly available proof-of-concept exists per WPScan, and a vendor patch was released in version 5.2.8.
SIPp's get_header() parser function in versions through 3.7.7 is vulnerable to a classic CWE-120 stack buffer overflow triggered by SIP messages containing header content exceeding approximately 20,490 bytes. Any unauthenticated network peer reaching the SIPp listener can crash the process with a single crafted SIP packet; the CVSS 4.0 vector (VA:H, no C/I impact) and source code evidence confirm this is an availability-only impact with no confirmed code-execution path. The upstream fix (commit 8ddfb43, PR #881) replaces unbounded sprintf() calls with snprintf() bounds enforcement, but no official tagged release incorporating the fix has been confirmed at time of analysis.
Quadratic time complexity in Nodemailer's addressparser component, versions 9.1.0 through 10.0.4, allows remote unauthenticated attackers to block the Node.js event loop for multiple seconds by supplying crafted email addresses containing RFC 5322 comment-separated atoms. The root cause is a `slice(-1)` call on a growing string accumulator in `_handleAddress` that forces JavaScript engine string-flattening on every token, producing O(n²) parse time - empirical test data in the fix commit shows 1.5 MB of crafted input caused approximately 10 seconds of event-loop stall before the patch. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the attack payload is trivially constructable by simple string repetition and requires no authentication.
Remote code execution in Spug through v3.4.0 allows authenticated users holding monitor permissions to inject arbitrary OS commands via the `/monitor/run_test/` HTTP endpoint, where user-supplied ping target addresses are interpolated directly into Python f-string shell commands executed with `subprocess.run(..., shell=True)`. Exploitation yields arbitrary command execution as the Spug process user, enabling full server takeover. No public exploit identified at time of analysis, but the vulnerable code path is trivially constructable from public source and the upstream patch commit is publicly visible.
Missing task ownership verification in CAPEv2's REST API allows any authenticated user to enumerate, read, and delete malware analysis submissions belonging to other users. Affecting all CAPEv2 installations through commit 471ee4b, the flaw resides in the task view and delete endpoints within `web/apiv2/views.py`, where the API authenticates the caller but never checks whether the caller owns the requested task. No public exploit has been identified at time of analysis, but the low attack complexity and entirely network-accessible API surface make this trivially exploitable by any user with a valid account on a multi-tenant CAPEv2 instance.
Heap buffer overflow in MKVToolNix through 101.0 allows code execution when a victim processes a crafted AVI file with mkvmerge. The bundled avilib 0.6.10 library's ODML superindex parser performs 32-bit size arithmetic on attacker-controlled entry counts, producing an integer wraparound (CWE-680) that causes an undersized heap allocation; subsequent data writes overflow the buffer. An attacker who delivers a malicious AVI file and induces a user or automated pipeline to process it with mkvmerge can achieve arbitrary code execution with user-level privileges. No public exploit has been identified and no KEV listing exists, but a patch commit is available on Codeberg.
Server-side request forgery in Open Notebook before 1.11.0 allows authenticated users to pivot through the application server to reach cloud instance metadata services, internal network hosts, and localhost-bound services by supplying arbitrary URLs to the POST /api/sources endpoint. The vulnerable parameter is passed directly to the server's HTTP client without any allowlist or blocklist validation, making the application a proxy for internal reconnaissance. No public exploit code has been identified at time of analysis, but the impact is high given the cloud metadata access path (e.g., AWS IMDSv1 credential theft).
Stored cross-site scripting in Amundsen Frontend through 4.3.0 allows authenticated users with description-write access to inject arbitrary JavaScript into table, dashboard, and feature description fields, executing attacker-controlled code in the browser of every user who subsequently views search results. The root cause is React's dangerouslySetInnerHTML used without any HTML sanitization in ResourceListItem components (TableListItem and siblings), meaning payloads such as img elements with onerror handlers stored via the metadata service or Elasticsearch persist and fire on each page load. No public exploit code has been identified at time of analysis, but the attack pattern is elementary for anyone with metadata write access.
Payment bypass in the Quads Ads Manager for Google AdSense WordPress plugin (versions before 3.0.5) allows any low-privilege authenticated user capable of placing an advertising order to obtain paid ad placements at no cost. The plugin fails to verify transaction completion with the configured payment gateway before updating an order's status to paid, representing a fundamental business logic failure in the purchase flow. A publicly available proof-of-concept exploit has been published by WPScan, and the vendor has released a fix in version 3.0.5.
Horizontal privilege escalation in rtMedia for WordPress, BuddyPress and bbPress plugin before version 4.7.12 allows any authenticated subscriber-level user to alter the privacy settings of other users' activities and attached media. The plugin's privacy-change endpoint validates only a WordPress nonce that is shared across all logged-in users, performing no ownership verification against the requesting account. A publicly available exploit for this flaw has been disclosed via WPScan, enabling unauthorized exposure of private media or suppression of public content across a community site's user base.