Fahad Mahmood
Monthly
Unauthenticated remote attackers can trigger a full MySQL database dump on any WordPress site running Keep Backup Daily before version 2.1.4 by invoking the publicly exposed `kbd_cron_process` parameter with no credentials required. The generated dump file is stored in the publicly accessible uploads directory with a partially predictable filename derived from the database name, a limited random value, and the current Unix timestamp - making retrieval via brute-force enumeration feasible. No active exploitation is confirmed in CISA KEV at time of analysis, but the attack requires no privileges or special tooling, making it an immediate data-exposure priority for affected deployments.
WP Sort Order WordPress plugin versions 1.3.5 and below expose an unauthenticated broken access control flaw (CWE-862: Missing Authorization) that allows remote attackers without any credentials to invoke restricted plugin functionality. The CVSS vector confirms network-accessible, zero-complexity, unauthenticated exploitation with high confidentiality impact, meaning protected data can be read by any external party. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Stored Cross-Site Scripting in the WP Docs WordPress plugin (versions ≤2.3.1) allows authenticated subscribers to inject malicious scripts that execute in the browsers of other users, including administrators. The CVSS vector (PR:L/UI:R/S:C) confirms this is a subscriber-initiated, stored XSS with scope change, meaning a low-privilege account can affect higher-privilege sessions. No public exploit code or active exploitation has been identified at time of analysis.
Stock Locations for WooCommerce plugin (versions through 3.1.8) exposes one or more privileged operations without performing authorization checks, allowing authenticated low-privileged WordPress users to manipulate stock location data they should have no rights to modify. Rooted in CWE-862 (Missing Authorization), the flaw means the plugin accepts and executes sensitive requests based solely on authentication rather than verifying the requester's WordPress capability level. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low-privilege access requirement and straightforward network exploitation path make it a realistic risk for any multi-location WooCommerce store running the affected plugin.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated remote attackers can trigger a full MySQL database dump on any WordPress site running Keep Backup Daily before version 2.1.4 by invoking the publicly exposed `kbd_cron_process` parameter with no credentials required. The generated dump file is stored in the publicly accessible uploads directory with a partially predictable filename derived from the database name, a limited random value, and the current Unix timestamp - making retrieval via brute-force enumeration feasible. No active exploitation is confirmed in CISA KEV at time of analysis, but the attack requires no privileges or special tooling, making it an immediate data-exposure priority for affected deployments.
WP Sort Order WordPress plugin versions 1.3.5 and below expose an unauthenticated broken access control flaw (CWE-862: Missing Authorization) that allows remote attackers without any credentials to invoke restricted plugin functionality. The CVSS vector confirms network-accessible, zero-complexity, unauthenticated exploitation with high confidentiality impact, meaning protected data can be read by any external party. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Stored Cross-Site Scripting in the WP Docs WordPress plugin (versions ≤2.3.1) allows authenticated subscribers to inject malicious scripts that execute in the browsers of other users, including administrators. The CVSS vector (PR:L/UI:R/S:C) confirms this is a subscriber-initiated, stored XSS with scope change, meaning a low-privilege account can affect higher-privilege sessions. No public exploit code or active exploitation has been identified at time of analysis.
Stock Locations for WooCommerce plugin (versions through 3.1.8) exposes one or more privileged operations without performing authorization checks, allowing authenticated low-privileged WordPress users to manipulate stock location data they should have no rights to modify. Rooted in CWE-862 (Missing Authorization), the flaw means the plugin accepts and executes sensitive requests based solely on authentication rather than verifying the requester's WordPress capability level. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low-privilege access requirement and straightforward network exploitation path make it a realistic risk for any multi-location WooCommerce store running the affected plugin.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.