【中文导读】Bot for Telegram on WooCommerce 存在信息泄露、访问控制风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。
【原始描述】The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on the 'stm_wpcfto_get_settings' AJAX action in all versions up to, and including, 1.2.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to view the Telegram Bot Token, a secret token used to control the bot, which can then be used to log in as any existing user on the site, such as an administrator, if they know the username, due to the Login with Telegram feature.
【中文导读】WordPress File Upload 存在路径遍历风险（严重风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。
【原始描述】The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier.
【中文导读】该 CVE 涉及SQL 注入（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。
【原始描述】The WP Post Author – Boost Your Blog's Engagement with Author Box, Social Links, Co-Authors, Guest Authors, Post Rating System, and Custom User Registration Form Builder plugin for WordPress is vulnerable to time-based SQL Injection via the linked_user_id parameter in all versions up to, and including, 3.8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
【中文导读】Zendesk 存在安全缺陷风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。
【原始描述】Zendesk before 2024-07-02 allows remote attackers to read ticket history via e-mail spoofing, because Cc fields are extracted from incoming e-mail messages and used to grant additional authorization for ticket viewing, the mechanism for detecting spoofed e-mail messages is insufficient, and the support e-mail addresses associated with individual tickets are predictable.