WP Booking System - Booking Calendar through 2.1.0.3 allows an authenticated user with pre-existing per-form edit delegation to overwrite user_permission meta and grant edit access to all booking forms, including to arbitrary other users. The issue is a missing-authorization flaw (CWE-862) rated CVSS 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N); the key precondition is that an administrator must already have delegated edit rights on at least one form, which exposes the edit page and a reusable wpbs_edit_form nonce. No public exploit has been identified at time of analysis, and impact is confined to the plugin’s booking-form ACL and data rather than site-wide takeover.
Authenticated SQL injection in the BSK PDF Manager WordPress plugin through 3.8.1 allows users with contributor-level access or higher to inject malicious input into an unsanitised plugin parameter and read sensitive database contents, including administrator password hashes. Exploitation requires a valid low-privilege WordPress account; sites that do not allow untrusted registration or do not grant contributor access to outsiders have substantially reduced exposure. No public exploit was identified at time of analysis, and the impact described is confidentiality-only.
SQL injection in the Ukr-To-Lat WordPress plugin, affecting all versions through 1.3.5, allows authenticated users holding Contributor-level access or higher to inject arbitrary SQL through an unsanitized term name and thereby read sensitive data from the site's database. The assessed impact is confidentiality-only (high), with no integrity or availability effect, and exploitation requires a valid low-privileged account - a realistic path on sites with open registration or weak account hygiene. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, so this is a moderate-priority rather than top-priority issue.
PHP object injection in ACF Frontend Admin by DynamiApps through 3.29.13 lets an authenticated administrator store crafted serialized content that the plugin later deserializes when rendering public-facing pages. Remote code execution is conditional: it requires a usable POP/gadget chain in the plugin or WordPress core, so object injection alone does not guarantee code execution; the CVSS 3.1 score is 6.6 with PR:H and AC:H. No public exploit code or CISA KEV entry was identified at time of analysis.
Low-privilege information disclosure in the WP Booking System - Booking Calendar WordPress plugin through version 2.1.0.3, where the calendar AJAX handler fails to enforce a capability check on the 'id' parameter. Any authenticated user at subscriber level or above (PR:L, network-reachable, no user interaction) can pull private per-event booking descriptions and booking IDs from calendars they do not own. Assessed CVSS 6.5 reflects high confidentiality impact with no integrity or availability effect; there is no public exploit identified at time of analysis and no confirmed active exploitation, and the practical risk is bounded by the need for a valid subscriber account - sites that disable open registration and have no untrusted low-privilege users are largely insulated.
An authorization bypass in the LearnPress WordPress LMS plugin (all versions through 4.4.10) lets any authenticated user with subscriber-level access or above abuse the plugin's user-search handler as a character-by-character oracle, reconstructing the full site user roster and the complete email address of any account, including administrators. Because LearnPress is a course-selling plugin that commonly permits open registration, the PR:L prerequisite is often trivially satisfied; no user interaction or additional configuration is required. The issue is a bounded confidentiality problem (C:H, no integrity or availability impact) and no public exploit code or CISA KEV entry was identified at time of analysis, though upstream fix work is visible in the plugin's Trac repository.
Unauthenticated information disclosure and click-statistics manipulation in the ThirstyAffiliates WordPress plugin before 3.12.1 lets remote attackers query the plugin's link redirect tracking handler to reveal destination URLs of unpublished affiliate links and to record fabricated clicks. The issue affects WordPress sites running the plugin with its redirect/click-tracking handler reachable, requires no credentials or user interaction, and is fixed in vendor release 3.12.1; no public exploit was identified at time of analysis.
CSRF in the Patreon WordPress plugin before 1.10.0 allows remote attackers to re-link a WordPress site's Patreon integration to an attacker-controlled Patreon account by tricking a logged-in administrator into loading a crafted request, because the account-connect action does not verify a nonce. The flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N): exploitation needs a victim administrator with an active session and the plugin's Patreon connect feature in use, but no attacker authentication. Impact is limited to integrity - takeover of the site's Patreon integration, with no direct code execution or data disclosure reported; no public exploit was identified at time of analysis, and a vendor fix is available in 1.10.0.
Stored DOM-based cross-site scripting in the YMC Smart Filter plugin for WordPress (all versions through 3.12.19) allows a user with Author-level access or higher to plant script inside a post title that is later rendered unsafely by the plugin's front-end search widget, executing in the browser of anyone who views the injected page or types into the filter search box. The autocomplete REST search endpoint registers a permission callback that unconditionally returns true, so triggering the payload requires no authentication whatsoever, while only Author-level capability is needed to store it; this mismatch is reflected in the CVSS scope change (S:C) and the PR:L rating. Impact is limited to client-side script execution in the visitor's session (C:L/I:L/A:N); no public exploit code or confirmed active exploitation was identified at time of analysis, and the primary exposure limiter is whether a site hands Author accounts to untrusted users.
Stored cross-site scripting in the xSpeed Cache WordPress plugin through version 1.4.2 allows authenticated users with contributor-level access or higher to inject arbitrary web scripts through the 'content' parameter, which then execute when another user views the affected page. The flaw stems from insufficient input sanitization and output escaping in the lazy-loading code path and is rated CVSS 6.4 with PR:L and S:C. No public exploit code was identified at time of analysis, and exposure is concentrated on multi-author or open-registration sites where an attacker can obtain a contributor account.
Stored cross-site scripting in the Themify Popup plugin for WordPress (all versions up to and including 1.4.7) allows an authenticated user holding author-level privileges or higher to persist arbitrary script into the site's popup configuration via the 'popup_width_unit' parameter, which is then executed in the browser of any visitor or administrator who loads the injected page. Because the payload is stored rather than reflected, a single low-privilege write can compromise every subsequent page view, and the CVSS:3.1 scope-change rating (S:C) reflects that the injected script runs in the broader site context rather than an isolated component. Exploitation is gated by the author-level account prerequisite and requires no interaction from the victim (UI:N); there is no public exploit code or CISA KEV entry identified at time of analysis, and EPSS data was not supplied, so the practical risk is concentrated on multi-author sites that grant author or higher roles to untrusted or self-registered users.
Stored cross-site scripting in the Themify Builder plugin for WordPress (all versions through 7.8.2) allows an authenticated attacker holding a contributor-level account or above to inject arbitrary JavaScript through the 'visible' attribute of the slider shortcode, which is then persisted and executed in the browser of any user who views the injected page. The payload survives in post content because the attribute is neither sanitized on input nor escaped on output, and it is only reachable when the 'slider' custom post type is registered - normally satisfied automatically by a Themify theme or any other plugin that registers that CPT. Exploitation is not anonymous (CVSS PR:L) and requires a victim to load the poisoned page; no public exploit code or confirmed in-the-wild activity was identified at time of analysis, and the issue rates as a moderate-priority stored-XSS rather than an emergency.
Coder self-hosted deployments expose an unauthenticated account-enumeration oracle that lets remote attackers distinguish valid SSO-only accounts from nonexistent ones and identify the authentication provider, aiding credential-stuffing and phishing reconnaissance. The flaw affects Coder before 2.29.17, 2.30.0 through 2.32.6, 2.33.0 through 2.33.7, and 2.34.0 through 2.34.1, and is fixed in 2.29.17, 2.32.7, 2.33.8, and 2.34.2. No public exploit code was identified at time of analysis, and the issue yields only information disclosure-no authentication bypass, credential recovery, or data access.
IP spoofing in the Coder platform (versions before 2.34.7) allows unauthenticated remote attackers to bypass per-IP rate limits by forging the leftmost X-Forwarded-For header value, which the ExtractRealIPAddress middleware incorrectly trusts when Coder sits behind a proxy that appends rather than overwrites that header. This enables sustained brute-force attempts against login, one-time passcode, and password validation endpoints, and also lets attackers falsify the source IPs recorded in audit logs. No public exploit code or confirmed active exploitation was identified at time of analysis, and impact is bounded to integrity (rate-limit bypass and log falsification) rather than code execution or data disclosure.
Reflected cross-site scripting in the Hippoo Mobile App for WooCommerce WordPress plugin (all versions through 1.12.0) lets an unauthenticated attacker execute arbitrary script in a victim's browser by luring them to a crafted URL that supplies a malicious 'token_id' query parameter to the plugin's REST endpoint. The path segment is filtered to word characters, but WP_REST_Request's query-string precedence lets '?token_id=' override the path value and reach the handler unsanitized, so the regex protection is effectively void on default installs. Successful exploitation requires user interaction (UI:R, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1), and impact is limited to reflected script execution in the context of the targeted site; no public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-organization file disclosure in Coder's provisioner daemon (versions 2.30.0 through 2.34.7) lets an authenticated attacker holding an org-scoped provisioner key retrieve another organization's cached Terraform module archives through the DownloadFile gRPC handler. Exploitation is constrained by high attack complexity because the attacker must already know the target file's UUID, which is not enumerable, and single-organization deployments have no cross-org data to expose. No public exploit or proof-of-concept code has been identified at time of analysis, and the issue is assessed as medium severity (CVSS 4.0 base 6.0; assessed CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).
Path traversal in the Contact Form 7 Signature Addon WordPress plugin (versions through 4.2.2) lets an unauthenticated attacker attach arbitrary files to a form's outgoing email by supplying a crafted signature field value that is used unsanitized to build the attachment path. The read is bounded to the wp-content directory, and disclosure only occurs when the affected form is configured to send a copy of the submission to a submitter-controlled address, so default single-recipient (site-admin-only) forms are not exploitable for exfiltration; this deployment dependency is why CVSS rates attack complexity High (5.9, AV:N/AC:H/PR:N/UI:N/C:H/I:N/A:N). No public exploit code has been identified at time of analysis.
Code execution in THU-MIG YOLOE's AutoBackend model loader allows a local attacker to run arbitrary Python by supplying a crafted model whose imgsz, names, or kpt_shape metadata is passed to eval() in ultralytics/nn/autobackend.py; the victim must load the untrusted artifact, so this is not a network-facing trigger. Publicly available exploit code exists, but there is no CISA KEV confirmation, and the combination of local access, crafted-file prerequisite, user interaction, and limited deployment of this research project yields LOW real-world priority.
Arbitrary media file deletion in the weForms WordPress plugin (all versions through 1.6.28) lets an unauthenticated attacker poison a form entry's image-upload attachment path with directory-traversal sequences and then persuade an administrator to permanently delete that entry, at which point the plugin unlinks whatever file the traversed path resolves to. The CVSS 5.4 (Medium) score is well-calibrated: the attacker never gains read, execution, or exfiltration capability, impact is limited to files the web server process can unlink, and the mandatory administrator interaction (UI:R) makes end-to-end automation impossible. No public exploit code and no CISA KEV entry were identified at time of analysis; the practical risk concentrates on sites that accept file-upload entries and routinely hard-delete spam-looking submissions.
phpMyFAQ before 4.1.9 and the 4.2.0-alpha line before 4.2.0-beta permits authenticated users holding the dlattachment permission to retrieve attachment files belonging to draft FAQs that are not published or visible to them. The issue is an improper authorization check in attachment.php, results in limited confidentiality exposure only, and no public exploit identified at time of analysis.
Missing authorization in phpMyFAQ's admin dashboard allows any authenticated user with an activated non-admin account to read restricted site data, including unpublished FAQ questions, admin edit URLs, recent user identities, and site statistics. The issue affects phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta, and exploitation requires a valid low-privilege account (PR:L), making it a medium-severity, read-only information-disclosure risk rather than a top-tier priority; no public exploit was identified at time of analysis. Fixed releases are 4.1.9 and 4.2.0-beta.
Information disclosure in Coder 2.26.0 through 2.34.7 lets authenticated users who have been granted workspace 'use' access query GET /api/v2/workspaces/{id}/acl and retrieve group members' email addresses, login types, status, last-seen, and creation timestamps. The endpoint checks only workspace read access before resolving group membership under an elevated system context, creating an authorization gap for low-privileged workspace users. No public exploit code was identified at time of analysis, and the issue is limited to low-impact confidentiality exposure of account metadata rather than credentials or code; 2.34.8 is the fixed release.
An authorization bypass in Admidio 5.0.0 through 5.0.15 lets an authenticated user with list-view rights download group and role member lists as PDF even when export permissions were deliberately withheld, because the groups_roles_export check in modules/groups-roles/lists_show.php does not account for the pdfl mode that the underlying PDF export routine honors. Only accounts already holding valid credentials plus list-view permission on the relevant group can exploit this, so the impact is limited to confidentiality of roster data (CVSS 4.0 base 5.3, assessed CVSS 3.1 5.3 with C:L/I:N/A:N) and only affects deployments that actually restrict exports. No public exploit code or confirmed active exploitation was identified at time of analysis.
Write-level project members in Vikunja 0.13.0 through 2.6.0 can delete admin-tier link shares they are not authorized to touch, because the deletion handler builds a LinkSharing object containing only the URL-supplied IDs and the permission check then reads that object's Go zero value (Read) instead of the stored share permission. An authenticated attacker who already holds Write membership on a project can iterate sequential share IDs against DELETE /api/v1/projects/{project}/shares/{share} or the v2 equivalent (present from v2.4.0) to revoke admin links and invalidate existing share sessions, yielding limited integrity and availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor CVSS 4.0 base score is 5.3.
An improper authorization flaw in Vikunja's saved-filter creation flow lets any authenticated user who has engineered a zero-accessible-projects account state cause RecalculateTaskPositions to write task_positions rows for every task on the instance, including tasks belonging to other tenants. Triggering it requires a saved filter created with an empty filter string and no search string, which collapses the project scope and drops the WHERE clause entirely, producing a single-request write-amplification primitive that scales with instance size and enables denial of service plus cross-tenant integrity violations. Vikunja versions from 1.0.0-rc0 through 2.6.0 are affected and 2.7.0 contains the fix; the flaw is authenticated-only (PR:L per the assessed vector), yields no read access to other tenants' task contents, and is only materially impactful in multi-tenant deployments - no public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Open redirect in Coder workspace-app proxy (versions 2.0.0 through 2.34.7) lets unauthenticated attackers craft links on trusted workspace app subdomains that bounce victims to attacker-controlled sites. The flaw lives in the handleAPIKeySmuggling path handling: a request path beginning with a double slash is emitted as a scheme-relative redirect, so 'https://<workspace>.coder.example//evil.tld' is resolved by the browser as https://evil.tld. Impact is confined to phishing and credential-harvesting redirection (no code execution, data read, or direct session theft), it requires victim user interaction, and no public exploit code or in-the-wild exploitation was identified at time of analysis; severity is medium-to-low, so patching should be scheduled rather than treated as an emergency.
Vikunja 2.6.0 allows an authenticated collaborator who holds a higher permission on a parent project to override an explicitly set read-only share on a nested child project, enabling modification of that child's tasks and content. This broken access control is a permission-resolution regression introduced in 2.6.0 and only affects users who already have access to the project tree; no public exploit was identified at time of analysis. The issue is limited to integrity impact and is a low-to-moderate priority rather than a critical remote threat.
Coder 2.0.0 before 2.34.8 can retain an organization-scoped access grant after a user is removed from that organization, allowing that authenticated user to continue reaching templates and workspaces they were previously granted through per-user ACL entries. The issue is an incorrect authorization check in the acl_allow rule of coderd/rbac/policy.rego, and it only affects accounts that remain active and had explicit per-user grants on those resources. Impact is limited to the specifically granted org-scoped resources rather than broad organization access, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated retrieval of WooCommerce order secret keys in the PeachPay payments plugin (versions 1.117.9 up to but not including 1.120.70) lets remote attackers read customer name, email, postal address, and order contents for any paid order. The plugin returns an order's secret key without performing capability or ownership checks, so anyone who can reach the store and reference a valid paid order can harvest the key and use it to view that order's PII. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released version 1.120.70 to correct the missing authorization check.
Unauthenticated account creation in the WP User Manager WordPress plugin versions 2.9.x before 2.9.20 allows remote attackers to obtain functional WordPress accounts without completing payment when the site uses payment-gated registration. The plugin creates the WordPress user before payment confirmation and does not roll it back if the payment step fails, leaving an integrity-only impact (CVSS 5.3, C:N/I:L/A:N). Exploitation is configuration-dependent because only sites with payment-gated registration enabled are exposed; no public exploit identified at time of analysis.
Unauthenticated visitors can overwrite site-wide ACF option values on WordPress sites running ACF Frontend Admin by DynamiApps through 3.29.13 when a publicly exposed form reaches one of the plugin's form-submission actions. The missing capability check means no login, privileges, or user interaction are required where such a form is published, but exposure is deployment-dependent because the vulnerable action must be reachable from a front-end form. The provided data contains no CISA KEV entry or public exploit code; impact is assessed as integrity-only at CVSS 5.3 Medium.
Stored cross-site scripting in phpMyFAQ 4.2.0-alpha lets an authenticated user with FAQ_EDIT permission upload a crafted SVG whose XML DTD entity expands to a javascript: URI in an anchor href, so script runs when a victim clicks the link and can be used to hijack an admin session. The bug is limited to 4.2.0-alpha builds before 4.2.0-beta, requires user interaction (the victim must view the FAQ and click the anchor), and no public exploit code was identified at time of analysis. Rated CVSS 4.0 5.1 (CWE-79), it is a moderate-severity issue that sits below the top of most patch queues.
Stored cross-site scripting in phpMyFAQ (3.2.1 through before 4.1.9, and 4.2.0-alpha before 4.2.0-beta) lets users who hold content-author accounts embed iframes with data:text/html sources in FAQ or News entries, bypassing the hostless media-host allowlist in FaqHelper::cleanUpContent(). Because that content is emitted through Twig's raw filter without escaping, the script runs in the browser of anyone who views the affected entry, enabling phishing interfaces or top-frame redirects; exploitation requires an authenticated author account and victim interaction, and no public exploit code or CISA KEV confirmation was identified at time of analysis.
Stored cross-site scripting in phpMyFAQ 4.2.0-alpha allows FAQ editors to bypass SVG sanitization and execute script in the application origin when a victim opens a crafted SVG file. Exploitation requires an authenticated account with FAQ-editor privileges and victim interaction; the root cause is a single-pass sanitizer that can reassemble a split script tag around removed XML processing instructions. Only the 4.2.0 pre-release window from 4.2.0-alpha up to but not including 4.2.0-beta is affected, and no public exploit identified at time of analysis.
Public-facing news items in phpMyFAQ 4.0.0 through 4.1.8 can be modified by delegated administrators who lack the editnews permission because the news-update API incorrectly authorizes the request against NEWS_DELETE rather than NEWS_EDIT. The assessed CVSS 3.1 vector is 5.1 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N), requiring an authenticated delegated-admin account with addnews and delnews rights and access to the update-news CSRF token from its own cookie; no public exploit identified at time of analysis. Vendor-released patch: 4.1.9.
Authenticated administrator-level users of the WordPress plugin Post Export Import with Media through 1.17.2 can read files outside the intended export directory through the theme_slug parameter when the peiwm_enable_admin_download_buttons setting is enabled. The issue is a CWE-22 directory traversal rated CVSS 4.9 with confidentiality-only impact, and exploitation is gated by both administrator authentication and a non-default feature toggle. No public exploit was identified at time of analysis, and the admin-only prerequisite makes this a low-priority edge-case risk rather than a broadly exploitable path traversal.
WP Data Access plugin versions before 5.5.88 expose an action that lacks both an authorization capability check and a CSRF nonce, allowing any authenticated user, including a self-registered subscriber, to make the WordPress server connect to arbitrary hosts and ports, including internal network endpoints, and read back the connection result. This is a medium-severity server-side request forgery issue (CVSS 5.0, CWE-918) with a changed scope because the attacker can pivot requests from the public site into internal services, though confidentiality impact is limited to the returned connection outcome. No public exploit identified at time of analysis; exploitation requires an account on the target site, which is trivial where open registration is enabled but infeasible where registration is disabled and no attacker-controlled account exists.
Welcart e-Commerce versions through 2.12.4 allow authenticated users with editor-level privileges or higher to inject SQL through the searchSql and searchSkuSql JSON fields in the wp_usces_order_old request, enabling read-only disclosure of sensitive database contents. The flaw is an authenticated order-management SQL injection (CWE-89) with high confidentiality impact but no integrity or availability impact. No public exploit identified at time of analysis, and the elevated account requirement keeps overall risk moderate.
Stored HTML injection in Coder's deployment appearance settings lets a user holding the Owner role persist unescaped markup in the ApplicationName and LogoURL fields, which is then rendered into the Coder dashboard and into SMTP notification emails received by other users of the deployment. It affects releases below 2.29.17 (ESR), 2.30.0 through 2.32.6, 2.33.0 through 2.33.7, and 2.34.0 through 2.34.1, and is fixed in 2.29.17, 2.32.7, 2.33.8, and 2.34.2 respectively. Severity is low because the Owner role already confers full administrative control of the deployment, the assessed impact is limited to integrity (CVSS 3.1: AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N), and no public exploit code was identified at time of analysis; the issue is not in CISA KEV.
Information disclosure in Coder 2.10.0 through 2.34.7 allows a lower-privileged local Unix user or unprivileged process inside the same workspace to read secrets from the workspace agent's debug HTTP server bound to 127.0.0.1:2113, because the /debug/manifest handler returns the complete agent manifest including template-provided environment variable values such as cloud keys and registry tokens. The listener is loopback-only and requires an existing local foothold in the workspace (CVSS v4.0 4.8; independently assessed CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so this is a genuine but moderate, locally-scoped issue rather than a mass-exploitation priority, with impact bounded to whatever secrets the template actually injects. No public exploit code or confirmed active exploitation was identified at time of analysis, and the flaw is fixed in 2.34.8.
Authorization bypass in the Fastcache by Host.it WordPress plugin (all versions up to and including 1.7.5) allows any authenticated user with subscriber-level access to add or remove the plugin's page-cache rewrite rules in the site's root .htaccess file. The root cause is a missing capability check (CWE-862) on the plugin's rewrite-rule management action, reachable remotely with low attack complexity and no user interaction. Impact is limited to the plugin's own cache rules rather than arbitrary file content, and no public exploit code or confirmed active exploitation was identified at time of analysis; overall priority is low (CVSS 4.3).
Insecure direct object reference in the Tutor LMS WordPress plugin (all versions up to and including 4.1.0) allows any authenticated user holding instructor/author-level capability to take over and overwrite courses belonging to other instructors. Because the course-save routine passes attacker-controlled POST data into wp_insert_post() without stripping the 'ID' key, a non-empty ID is interpreted by WordPress as an update to an existing post, letting the attacker change the victim course's title, content and status and reassign its ownership to themselves. Authentication with at least author-level access is required (CVSS PR:L) and there is no unauthenticated path; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, but sites that grant the instructor role to untrusted or numerous users - multi-instructor marketplaces and open registration setups - carry real content-integrity risk, while single-author sites are effectively unexposed.
The SMS Alert Order Notifications WordPress plugin (slug sms-alert) through version 4.0.1 performs insufficient authorization checks on at least one of its order-notification actions, allowing a logged-in low-privilege user to invoke functionality that should be reserved for shop managers or administrators. Because the CVSS vector carries PR:L, exploitation requires a valid authenticated WordPress account on a site where the plugin is active - there is no anonymous path - and the resulting impact is limited to integrity (I:L) with no confidentiality or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the 4.3 score reflects a genuinely moderate, not high-priority, exposure.
Cross-site request forgery in the WordPress plugin User Registration & Membership through 5.2.8 lets unauthenticated attackers trick a logged-in administrator into approving pending registrations or denying arbitrary user accounts, potentially locking targeted users out of the site. Exploitation requires the administrator to click a crafted link or visit a malicious page (UI:R) and depends on an empty new_role parameter that bypasses the plugin's nonce check and WordPress core's bulk-user nonce validation. Impact is limited to unauthorized registration-status changes (low integrity, no confidentiality or availability impact); no public exploit identified at time of analysis.
Open redirect in the Patreon WordPress plugin before 1.10.0 allows unauthenticated attackers to craft links that send visitors to arbitrary external sites after they click, enabling phishing that abuses the trusted WordPress site's domain. Exploitation requires user interaction (UI:R) and is limited to redirect abuse with low integrity impact; there is no code execution, data disclosure, or availability impact. Vendor-released patch: 1.10.0. No public exploit identified at time of analysis.
Unauthenticated customer-record disclosure in the LatePoint appointment booking plugin for WordPress, affecting all versions up to and including 5.7.4, allows remote attackers to harvest the first name, last name, email address, phone number and notes of every customer in the database by enumerating UUID prefixes through the steps__load_step AJAX endpoint using the params[customer[uuid]] parameter. Exploitation is strictly gated on a non-default configuration: the plugin's 'Field used for authentication' setting must be set to 'Disable ability to login' (guest checkout mode), so sites using default login-based authentication are not exposed. No public exploit code was identified at time of analysis; the AC:H rating reflects the request-heavy prefix enumeration required, which rate limiting or a WAF may slow or detect but does not prevent on an unprotected site.
Unauthenticated term-name enumeration in the Patreon WordPress plugin (versions below 1.10.0) lets remote attackers query taxonomy terms, including non-public and custom taxonomies that WordPress normally keeps off the front end. Successful exploitation leaks only the names of terms, not post content, credentials, or personally identifiable information, and no write access is gained, so the practical value depends on whether a site defines private or otherwise non-public taxonomies whose labels are themselves sensitive (for example internal customer segments or unpublished categorization schemes). The assessed vector (AV:N/AC:L/PR:N/UI:N, C:L) reflects a low-impact but easily reachable disclosure; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released 1.10.0 to address the missing authorization check.
Session expiration bypass in Coder before 2.23.0 lets authenticated OIDC users retain access after their identity provider token expires when the IdP does not issue a refresh token. Because the APIKey cookie can auto-extend by 24 hours on each successful use, a user who keeps using Coder can remain logged in beyond OIDC authorization; exploitation requires a specific non-default OIDC deployment, and no public exploit was identified at time of analysis.