The Basel Post Types plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.18. The vulnerability exists because a missing-quotes coding error in the defined() call for SECUREAUTHSALT inside BASELAuth::getconfig() causes PHP to evaluate the constant's value rather than its name, making the check always fail and permanently falling back to the static hardcoded salt 2NlBUibcszrVtNmDnxqDbwCOpLWq91eatIz6O1O that is publicly visible in the theme source code; because this salt is static and known, an attacker can compute a valid Opauth signature entirely offline and submit a forged ?opauth callback to the unauthenticated init hook endpoint processed by registerorlogin. This makes it possible for unauthenticated attackers to authenticate as any existing WordPress user, including administrators, by forging a callback tied to a known target account email address — bypassing all password verification, multi-factor authentication, and ownership checks, and receiving a fully authenticated session cookie via wcsetcustomerauthcookie(). Exploitation requires WooCommerce to be active and at least one Basel social-login provider (Facebook, Google, or VKontakte) to be configured with a valid appid and appsecret in the theme settings.

The WP Duplicate WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not validate the path or type of uploaded files, making it possible for unauthenticated attackers to write arbitrary files to the server and achieve remote code execution. This vulnerability is being actively exploited in the wild.

The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validatecheckoutfields() function in versions up to, and including, 1.1.4 The My Account registration path (validatefields()) validates a submitted 'tgwcfb/user-roles' value against the form's configured allowed roles, but the checkout registration path (validatecheckoutfields(), hooked to woocommerceaftercheckoutvalidation) stores the raw $POST['userroles'] value in $this->validdata without any allow-list enforcement, and adduserdata() then injects that value into woocommercenewcustomerdata as the new account's role. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by supplying a userroles=administrator parameter when creating an account during checkout, resulting in full site takeover.

The Static Snapshot WordPress plugin through 0.2.1 does not sanitise shell metacharacters in a user-supplied value before concatenating it into operating-system commands run by the server, allowing unauthenticated attackers to execute arbitrary commands on the host.

The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spoofable client-supplied content type, allowing unauthenticated attackers to upload arbitrary files, including PHP, which can lead to remote code execution.

The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files (including ones containing the database credentials) and delete arbitrary files on the server.

The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The /wp-json/woo-telegram/v1/main/ REST endpoint is registered with permissioncallback => 'returntrue' and performs no Telegram webhook signature verification, allowing an unauthenticated attacker to POST a forged bot update with a message.chat.id set to any WordPress login name; bftowgetusersystemid() resolves this attacker-supplied value to the targeted account via getuserby('login', $tgId) with no ownership proof, and writes a login token computed as md5($SERVER['HTTPUSERAGENT'] . time()) — both inputs are fully attacker-controlled or bounded within seconds using the response's own Date header. The resulting token is redeemable at the unauthenticated, capability-check-free, and nonce-less ?action=bftowcreateorder&bftowtoken= endpoint, which calls wpsetauthcookie() unconditionally via loginuserbyid, issuing a persistent authenticated session cookie for the targeted account to the attacker. This makes it possible for unauthenticated attackers to log in as any WordPress user, including administrators, given only that user's username.

The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function. This is due to missing WordPress bootstrap, authentication, capability, and nonce checks in the standalone save-to-cache.php script, combined with insufficient sanitization of the pluginURL parameter before it is written to a web-executable PHP file. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The save-to-cache.php script is directly reachable without loading WordPress; FILTERSANITIZEURL — the only filter applied to the pluginURL value — preserves the characters required to craft a valid PHP payload, which is then written verbatim into cached-content/cached-feed.php and immediately executable via a single GET request.

The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site.

Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.

Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.

Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.

Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.

Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.

Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.

Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.

Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.

Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.

Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.

Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.

Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.

Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.

Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.

Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.

Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.

Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.

Unauthenticated PHP Object Injection in Juno <= 2.25 versions.

Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.

Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.

Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.