Shuffle
Monthly
Cross-tenant privilege escalation in Shuffle (self-hosted SOAR platform) through version 2.2.1 lets an administrator who holds org-admin rights in any single organization mint and read valid API keys for arbitrary users in other organizations, resulting in full account takeover across tenant boundaries. The flaw is an IDOR/authz bypass (CWE-639) in the HandleApiGeneration endpoint, which accepts a caller-supplied user ID and returns or resets that user's API key without verifying ownership; it is remotely reachable over the network and requires only an authenticated admin account (CVSS:4.0 8.6, PR:L, UI:N, high confidentiality and integrity impact). There is no CISA KEV listing and no public exploit code identified at time of analysis, but exploitation is trivial once any tenant admin account is obtained, and source-verified fix code exists in the upstream shuffle-shared repository.
Local File Inclusion in Edge-Themes' Shuffle WordPress theme (all versions through 1.8) exposes WordPress installations to unauthenticated remote code execution. An attacker without any credentials can supply a crafted path parameter to the theme's PHP include logic, causing the server to load and execute arbitrary PHP files - including attacker-uploaded content disguised as images. No public exploit has been identified at time of analysis, but the attack pattern (LFI chained with WordPress media uploads) is well-documented in the ecosystem, and the unauthenticated network vector warrants prompt remediation.
Unauthenticated Local File Inclusion (LFI) in the Shuffle WordPress theme by Edge Themes affects all versions up to and including 1.8, allowing a remote attacker without any credentials to force the PHP application to include arbitrary local files from the server. Successful exploitation can expose sensitive files such as wp-config.php (containing database credentials) and, under certain server configurations, escalate to remote code execution via log poisoning or similar chaining techniques. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.1 score and CWE-98 classification indicate a high-severity, high-impact path.
Cross-tenant privilege escalation in Shuffle (self-hosted SOAR platform) through version 2.2.1 lets an administrator who holds org-admin rights in any single organization mint and read valid API keys for arbitrary users in other organizations, resulting in full account takeover across tenant boundaries. The flaw is an IDOR/authz bypass (CWE-639) in the HandleApiGeneration endpoint, which accepts a caller-supplied user ID and returns or resets that user's API key without verifying ownership; it is remotely reachable over the network and requires only an authenticated admin account (CVSS:4.0 8.6, PR:L, UI:N, high confidentiality and integrity impact). There is no CISA KEV listing and no public exploit code identified at time of analysis, but exploitation is trivial once any tenant admin account is obtained, and source-verified fix code exists in the upstream shuffle-shared repository.
Local File Inclusion in Edge-Themes' Shuffle WordPress theme (all versions through 1.8) exposes WordPress installations to unauthenticated remote code execution. An attacker without any credentials can supply a crafted path parameter to the theme's PHP include logic, causing the server to load and execute arbitrary PHP files - including attacker-uploaded content disguised as images. No public exploit has been identified at time of analysis, but the attack pattern (LFI chained with WordPress media uploads) is well-documented in the ecosystem, and the unauthenticated network vector warrants prompt remediation.
Unauthenticated Local File Inclusion (LFI) in the Shuffle WordPress theme by Edge Themes affects all versions up to and including 1.8, allowing a remote attacker without any credentials to force the PHP application to include arbitrary local files from the server. Successful exploitation can expose sensitive files such as wp-config.php (containing database credentials) and, under certain server configurations, escalate to remote code execution via log poisoning or similar chaining techniques. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.1 score and CWE-98 classification indicate a high-severity, high-impact path.