CVE Vulnerability Catalog

The Payment Plugins for PayPal WooCommerce WordPress plugin before version 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any authenticated user, such as a subscriber, to bind another customer's stored card to their own account and then charge or delete it. Exploitation requires the attacker to already know the payment provider's identifier for the victim's stored method, which the Payment Plugins for PayPal WooCommerce WordPress plugin before version 2.0.26 does not expose.

The Payment Plugins for PayPal WooCommerce plugin before version 2.0.26 does not validate the order key before adding order data to the JavaScript configuration output on the front end. This allows unauthenticated users to obtain the secret that gates access to any order and, through it, the customer's billing and shipping details, by iterating sequential order identifiers.

The Payment Plugins for Stripe WooCommerce plugin before version 4.0.12 does not validate the order key before adding order data to the JavaScript configuration output on the front end. This allows unauthenticated users to obtain the billing details of any order, together with the secret that gates access to it, by iterating sequential order identifiers.

The Next-Cart Store to WooCommerce Migration plugin for WordPress up to version 3.9.8 has an authentication bypass vulnerability in the NCWM_Kitconnect::run() function. The REST route /wp-json/next_cart/v1/migration has permission_callback set to __return_true and relies on a hardcoded fallback token '__token__' when the nextcart_token option is not yet set. This allows unauthenticated attackers to bypass authentication and execute arbitrary SQL and delete files.

The WP Recipe Maker plugin for WordPress up to version 10.8.0 is vulnerable to authorization bypass. Authenticated attackers with contributor-level access and above can take ownership of admin-authored recipes and unpublish them.

The Ultimate Gift Cards for WooCommerce plugin before version 3.2.10 does not verify that the user redeeming a gift card is its intended recipient. This allows any authenticated user, such as a subscriber, to redeem gift cards belonging to other users, zeroing their balance and crediting the value to themselves. In version 3.2.9 an ownership check was added on one of the two affected redemption paths; the one that remains requires a companion Ultimate Gift Cards for WooCommerce plugin before 3.2.10 from the same vendor to be active.

The Awesome Support plugin for WordPress up to version 6.3.9 has a missing authorization check in the wpas_do_mr_deny_user() function. Authenticated attackers with subscriber-level access and above can set the mr_user_denied flag on any user account, including administrators, permanently blocking their activation and sending a denial email.

The WP Travel WordPress plugin before version 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers. This allows unauthenticated attackers to cancel the payment on any customer's booking.

The Loops & Logic WordPress plugin before version 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see. This allows unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options.

The ELEX WooCommerce Request a Quote WordPress plugin before version 2.4.1 does not properly sanitise and escape a parameter before using it in a SQL query. This allows unauthenticated users to perform SQL injection attacks and extract arbitrary data from the database.

The WP Travel WordPress plugin before version 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission. This allows an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a file to it.

The WP Travel WordPress plugin before version 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler. This allows an unauthenticated attacker who knows the target customer's email address to reset that customer's booking payment to an unpaid state and wipe its stored deposit-reconciliation data.

The Content Mask WordPress plugin before version 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates. This allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewing the affected page. The option to restrict its use by role does not prevent this.

In the mirage-crypto-ec package before version 2.4.0 for OCaml, a timing side channel was discovered in NIST elliptic-curve scalar multiplication: the time required for a lookup can depend on a secret. This could allow an attacker to recover private keys through timing measurements.

In the mirage-crypto-ec package before version 2.3.0 for OCaml, an out-of-bounds read was discovered for compressed EC public key points. This could lead to data disclosure or program crash.

In the mirage-crypto-pk package before version 2.3.0 for OCaml, an undocumented exception was discovered for a small message during RSA decryption or encryption. This could lead to unexpected program termination.

An issue was discovered in the utcp package before 0.0.6 for OCaml. Out-of-order segment reassembly allows remote denial of service.

In the mirage-crypto-ec package before version 2.2.0 for OCaml, the ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets accept 0x00, the encoding of the point at infinity, as a public key. With such a public key, signatures can be forged without a private key.

In the mirage-crypto package before version 2.2.0 for OCaml, the AES.GCM.authenticate_decrypt_into and Chacha20.authenticate_decrypt_into functions write the decrypted plaintext into a caller-provided buffer and only then compare the tag. On a forged tag, the functions return false, but the destination buffer already holds the full plaintext.

In Visual Voicemail prior to version 20.1.00.05, improper export of Android application components allows local attackers to initiate calls without proper permission.