Total
11535 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-2520 | 2026-09-08 | N/A | 5.4 MEDIUM | ||
| The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update any plugin with a main file of 'main.php' to its latest version. | |||||
| CVE-2026-81781 | 2026-09-08 | N/A | 7.1 HIGH | ||
| Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4. | |||||
| CVE-2026-12843 | 2026-09-08 | N/A | 5.4 MEDIUM | ||
| The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses without payment verification, bypassing the entire payment system and gaining unauthorized access to premium educational content. | |||||
| CVE-2026-15550 | 2026-09-08 | N/A | 4.3 MEDIUM | ||
| The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulk_actions' function. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary database records from the 'wp_nf3_objects' table, such as saved submissions. | |||||
| CVE-2026-81790 | 2026-09-08 | N/A | 7.5 HIGH | ||
| Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Csomagpontok és szállítási címkék WooCommerce-hez: from n/a before 4.2.8. | |||||
| CVE-2026-75018 | 2026-09-08 | N/A | 4.3 MEDIUM | ||
| The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently force-delete arbitrary posts of any post type (including pages, administrator-authored posts, and WooCommerce products) and write arbitrary ccf_field_* post meta onto any post regardless of ownership or post type. The top-level form ID is checked via edit_post/publish_posts, but the nested fields[].ID and choices[].ID paths processed by _create_and_map_fields() and _create_and_map_choices() carry no equivalent capability or post-type guard, leaving those sinks fully exposed while delete_item() and delete_submission() contain explicit post-type restriction fixes demonstrating the developer's awareness of scoping requirements. | |||||
| CVE-2026-83628 | 2026-09-08 | N/A | 4.3 MEDIUM | ||
| The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the `tml_ms_signup_handler()` function's `gimmeanotherblog` branch failing to enforce the network's `active_signup` registration policy, checking only `is_user_logged_in()` while sibling branches such as `validate-blog-signup` apply the full policy gate. This makes it possible for authenticated attackers, with Subscriber-level access and above, to directly POST `stage=gimmeanotherblog` to Theme My Login's signup route, bypassing the configured registration policy entirely — even when it is set to `none` or `user` — which causes `wpmu_create_blog()` to execute with the attacker's user ID, after which WordPress core assigns the Administrator role on the newly created subsite via `add_user_to_blog()`. The privilege gain is scoped to the newly created subsite only; the attacker's account retains Subscriber-level access on the main site and does not obtain Super Admin or network-level capabilities such as `manage_network` or `manage_sites`. | |||||
| CVE-2026-85311 | 2026-09-07 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MarketKing: from n/a through 2.1.60. | |||||
| CVE-2026-84238 | 2026-09-07 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions. | |||||
| CVE-2026-85309 | 2026-09-05 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Maps by Supsystic: from n/a through 1.5.3. | |||||
| CVE-2026-84847 | 2026-09-05 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions. | |||||
| CVE-2026-84758 | 2026-09-05 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions. | |||||
| CVE-2026-72671 | 1 Elastic | 1 Kibana | 2026-09-04 | N/A | 4.3 MEDIUM |
| A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomaly detection jobs and data frame analytics jobs. A user whose role grants create anomaly detection jobs and data frame analytics jobs without the trained model privilege can therefore remove a trained model from a space. The model itself is not deleted and remains available in its other spaces, and the change can be reversed by a suitably privileged user. | |||||
| CVE-2026-72669 | 1 Elastic | 1 Kibana | 2026-09-04 | N/A | 7.6 HIGH |
| The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flows of other users, read their onboarding state, and write arbitrary progress data into them. A tampered flow can also cause the owner's onboarding view to fail with a server error. | |||||
| CVE-2026-32480 | 2026-09-04 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11. | |||||
| CVE-2026-27347 | 2026-09-04 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JetPopup: from n/a through 2.0.20.2. | |||||
| CVE-2026-85512 | 2026-09-04 | 7.5 HIGH | 7.3 HIGH | ||
| A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /admin/session.php. The manipulation of the argument ID results in missing authorization. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. | |||||
| CVE-2026-85306 | 2026-09-04 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Connector for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MountDev AI MCP Connector for WordPress: from n/a through 1.6.5. | |||||
| CVE-2026-84754 | 2026-09-04 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions. | |||||
| CVE-2026-84794 | 2026-09-04 | N/A | 7.1 HIGH | ||
| Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deletion of conflicting files, allowing unauthorized asset deletion and replacement. | |||||