Pritect

Reported in 2016 (via @Hacker0x01): logged in @WordPress users could run arbitrary shortcodes. Fixed in 6.3.2 many years later. Who's looking out for third-party plugin developers? bit.ly/4fWVmOV

#WordPress plugin Advanced Custom Fields < 5.12.3 can allow unauthenticated users to upload arbitrary files @wpacf @dliciousbrains bit.ly/3veR5QE

Ⓦ WordPress plugin Advanced Custom Fields (ACF) < 5.12.2 has an arbitrary file upload vulnerability. ACF has released an update. Recommended to update your site as soon as possible. Reported by James Golovich (@Pritect). #WordPress #security

The Membership will be on sale for 24 hours this Sunday (GMT). Be prepared.

Thanks to James Golovich from Pritect, Inc (@pritect) for reporting 🙌

We've just released ACF 5.12.3 with a security fix to prevent arbitrary file uploads to forms with ACF fields. Now that we've released this update, we recommend updating your sites as soon as possible.

Elementor Page Builder #WordPress plugin version <= 1.7.12 allows logged in users unrestricted editing @elemntor pritect.net/blog/elementor…

#WordPress shortcode injection as an attack vector pritect.net/blog/wordpress…

No @bluehost, it is not ok to aggressively cache HTTP GET requests that the response contains a Set-Cookie header

WordPress plugin Ultimate Member < 1.3.76 Critical Security Issue allows unauthenticated password changes pritect.net/blog/ultimate-… @umplugin

PeepSo <= 1.6.0 #WordPress plugin allows privilege escalation of a logged in user pritect.net/blog/peepso-1-… @peepsowp

MemberSonic Lite <= 1.2 #WordPress plugin allows login without proper authorization pritect.net/blog/memberson… @pluginresults

@pluginresults I've been emailing about an issue for a few days without a response, please get in touch asap.

Advanced Access Manager <= 3.2.1 #WordPress plugin allows privilege escalation by logged in users pritect.net/blog/advanced-… @vasyltech

[DB] Stream <= 3.0.5 - Unauthenticated Events Export - wpvulndb.com/vulnerabilitie…

Important Security Update or You Always Hurt the Ones You Love ninjaforms.com/important-secu…

@danielcid Ninja Forms

Multiple Critical Vulnerabilities in Ninja Forms WordPress plugin <= 2.9.42. Update immediately. pritect.net/blog/ninja-for… @wpninjas

@pixolin @wpninjas If you don't select any options it allows you to deactivate. IMO cancel button should just be deactivate.

@Josh412 @zamoose I'd guess that it has some code to not cache POST