Verygoodplugins
Monthly
Unauthenticated loopback API access and path traversal in WhatsApp MCP Server (whatsapp-mcp) prior to v0.2.1 allow any same-user local process - including sibling MCP servers and IDE extensions - to send WhatsApp messages from the paired account and exfiltrate arbitrary user-readable files (SSH private keys, browser session data, dotfiles) as WhatsApp document attachments. The whatsapp-bridge HTTP service on 127.0.0.1:8080 requires no authentication and validates no Host header, enabling a DNS rebinding attack whereby a malicious webpage visited by the user can trigger identical file exfiltration remotely without any credentials. No public exploit identified at time of analysis; vendor-released patch v0.2.1 is available.
The WP Fusion Lite WordPress plugin is vulnerable to Cross-Site Request Forgery via the `show_logs_section` function found in the ~/includes/admin/logging/class-log-handler.php file which allows. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Fusion Lite WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the startdate parameter found in the ~/includes/admin/logging/class-log-table-list.php file which allows. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated loopback API access and path traversal in WhatsApp MCP Server (whatsapp-mcp) prior to v0.2.1 allow any same-user local process - including sibling MCP servers and IDE extensions - to send WhatsApp messages from the paired account and exfiltrate arbitrary user-readable files (SSH private keys, browser session data, dotfiles) as WhatsApp document attachments. The whatsapp-bridge HTTP service on 127.0.0.1:8080 requires no authentication and validates no Host header, enabling a DNS rebinding attack whereby a malicious webpage visited by the user can trigger identical file exfiltration remotely without any credentials. No public exploit identified at time of analysis; vendor-released patch v0.2.1 is available.
The WP Fusion Lite WordPress plugin is vulnerable to Cross-Site Request Forgery via the `show_logs_section` function found in the ~/includes/admin/logging/class-log-handler.php file which allows. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Fusion Lite WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the startdate parameter found in the ~/includes/admin/logging/class-log-table-list.php file which allows. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.