Base de CVEs

CVE-2026-65554 Alta · 7.1 CWE-862 06/08/2026

WordPress AnsPress – Question and answer plugin 4.4.4 - Broken Access Control vulnerability

Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions.

CVE-2026-65541 Alta · 7.3 CWE-862 06/08/2026

WordPress Staff Training plugin <= 1.0.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.

CVE-2026-65504 Alta · 7.5 CWE-862 06/08/2026

WordPress BOX NOW Delivery Croatia plugin <= 3.3.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions.

CVE-2026-32548 Média · 5.3 CWE-862 06/08/2026

WordPress SureCart plugin <= 4.6.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions.

CVE-2026-28140 Alta · 7.5 CWE-862 06/08/2026

WordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions.

CVE-2026-28005 Crítica · 9.8 CWE-862 06/08/2026

WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.

CVE-2026-25403 Média · 6.5 CWE-862 06/08/2026

WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.

CVE-2026-65551 Alta · 7.5 CWE-862 06/08/2026

WordPress Breakdance plugin < 2.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7.

CVE-2026-11983 Média · 5.3 CWE-862 06/08/2026

Ad Inserter <= 2.8.16 - Missing Authorization to Block Visibility Bypass via ai_ajax

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check in the `ai_ajax` function. This makes it possible for unauthenticated attackers to view the contents of ad blocks that an administrator has restricted to administrator-only visibility.

CVE-2025-9266 Média · 4.3 CWE-862 06/08/2026

Accelerate <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation

The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueue_scripts() function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate the ThemeGrill Demo Importer plugin.

CVE-2026-19010 Alta · 7.3 CWE-862 06/08/2026

TinyAGI Message API Endpoint index.ts processMessage authorization

A security vulnerability has been detected in TinyAGI 0.0.20. Impacted is the function processMessage of the file packages/main/src/index.ts of the component Message API Endpoint. Such manipulation leads to missing authorization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-16734 Alta · 7.5 CWE-862 06/08/2026

Stripe Payment Forms by WP Full Pay < 8.5.2 - Unauthenticated Payment Intent Amount Manipulation

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a payment form — to change the amount of a payment intent that the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 then updates server-side through the Stripe API with the store's secret key. An ownership check added in 8.5.0 was applied to only one payment-intent handler, leaving the pricing-recalculation and payment-intent-update actions unprotected against amount manipulation.

CVE-2026-16290 Média · 5.3 CWE-862 06/08/2026

ProfileGrid < 6.0.0.0 - Unauthenticated Group Member List Disclosure via pm_get_all_users_from_group

The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks before returning a group's member list, and registers the handler for unauthenticated users, allowing any unauthenticated visitor to disclose the members and their identifiers of any group, including private or closed ones, bypassing the ProfileGrid WordPress plugin before 6.0.0.0's member-visibility setting.

CVE-2026-15991 Alta · 8.8 CWE-862 06/08/2026

File Manager 6.0 - 6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read and Deletion via 'cmd' Query Parameter

The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0 - 6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to read and delete arbitrary files on the server, which can lead to remote code execution when the right file is deleted (such as wp-config.php). The bypass is triggered by passing cmd=rm or cmf=file in the URL query string of a POST request: elFinder's bind registration reads the command exclusively from $_POST and therefore never registers the rm.pre permission handler, while the dispatcher reads from the merged $_GET+$_POST superglobal and executes the rm or file command unchecked against a volume that defaults to ABSPATH.

CVE-2026-70618 Média · 4.3 CWE-862 05/08/2026

Spacebar Server Missing Authorization via member-ids Endpoint

Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership by querying the GET /guilds/{guild_id}/roles/{role_id}/member-ids endpoint without guild membership verification. Attackers can exploit the unprotected route handler in the roles member-ids endpoint, which lacks permission checks present in sibling endpoints, to retrieve the full list of member user IDs for any guild on the instance using only a valid bearer token and a known guild ID.

CVE-2026-70617 Alta · 8.1 CWE-862 05/08/2026

Spacebar Server Missing Authorization via Group DM Recipient Endpoint

Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated attacker to add themselves to arbitrary group DM channels by sending a PUT request to the channels recipient endpoint without membership verification. Attackers can exploit the unguarded PUT /channels/{channel_id}/recipients/{user_id} handler to join private group DMs, read complete message history, post messages as a participant, and force-add third-party users without their consent.

CVE-2026-48168 Crítica · 10.0 CWE-862 05/08/2026

PraisonAI: GitHub Actions Claude workflow command injection via unquoted PR branch name

PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. Additionally, the workflow allows any @claude comment to trigger the job regardless of whether the commenter is a trusted collaborator. An outside contributor can open a pull request from a fork whose branch name contains shell metacharacters and comment @claude, causing Bash to execute arbitrary shell code in the GitHub Actions runner. Because these commands run in a job holding a GitHub App token with write permissions, OIDC access, and gh/git access, the injection can be chained through $GITHUB_PATH to compromise later privileged steps, enabling repository writes, pull request and issue manipulation, or OIDC-token abuse. This issue has been fixed in version 4.6.40.

CVE-2026-70447 Média · 4.3 CWE-862 05/08/2026

Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with...

Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

CVE-2026-70446 Média · 4.3 CWE-862 05/08/2026

Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with...

Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

CVE-2026-70445 Média · 4.3 CWE-862 05/08/2026

Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with...

Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

CVE-2026-70439 Média · 6.5 CWE-862 05/08/2026

Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing...

Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions to invoke the conversion functionality.

CVE-2026-70438 Média · 4.3 CWE-862 05/08/2026

A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier...

A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

CVE-2026-70436 Média · 4.3 CWE-862 05/08/2026

Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check ...

Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check (1.4.0 and earlier) or performs an improper permission check (1.4.1) when providing access to externally-managed workspaces through the workspace browser, allowing attackers with Overall/Read permission to read files in workspaces they are not authorized to access.

CVE-2026-70435 Média · 4.2 CWE-862 05/08/2026

A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with...

A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

CVE-2026-70433 Média · 4.3 CWE-862 05/08/2026

Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with...

Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.