CVE Database

CVE-2026-18276 Medium · 4.3 CWE-862 Aug 6, 2026

Missing Authorization in eScriptorium

Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the object_cls and object_pk values of a join-room message, which are passed to group_add without an access check

CVE-2026-66712 High · 7.5 CWE-862 Aug 6, 2026

WordPress Simple Membership plugin <= 4.7.8 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions.

CVE-2026-66708 High · 8.2 CWE-862 Aug 6, 2026

WordPress Total Upkeep plugin <= 1.17.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions.

CVE-2026-66701 Medium · 5.3 CWE-862 Aug 6, 2026

WordPress Profile Builder plugin <= 3.16.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Profile Builder <= 3.16.5 versions.

CVE-2026-66699 Medium · 5.3 CWE-862 Aug 6, 2026

WordPress Dokan plugin <= 5.0.10 - Broken Access Control vulnerability

Custom role Broken Access Control in Dokan <= 5.0.10 versions.

CVE-2026-66678 Medium · 4.3 CWE-862 Aug 6, 2026

WordPress Advanced Custom Fields: Font Awesome Field plugin <= 6.1.1 - Broken Access Control vulnerability

Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions.

CVE-2026-66470 High · 7.1 CWE-862 Aug 6, 2026

WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Broken Access Control vulnerability

Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions.

CVE-2026-66452 Medium · 6.5 CWE-862 Aug 6, 2026

WordPress Legal Text Connector of the IT-Recht Kanzlei plugin <= 1.0.13 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei <= 1.0.13 versions.

CVE-2026-65554 High · 7.1 CWE-862 Aug 6, 2026

WordPress AnsPress – Question and answer plugin 4.4.4 - Broken Access Control vulnerability

Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions.

CVE-2026-65541 High · 7.3 CWE-862 Aug 6, 2026

WordPress Staff Training plugin <= 1.0.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.

CVE-2026-65504 High · 7.5 CWE-862 Aug 6, 2026

WordPress BOX NOW Delivery Croatia plugin <= 3.3.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions.

CVE-2026-32548 Medium · 5.3 CWE-862 Aug 6, 2026

WordPress SureCart plugin <= 4.6.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions.

CVE-2026-28140 High · 7.5 CWE-862 Aug 6, 2026

WordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions.

CVE-2026-28005 Critical · 9.8 CWE-862 Aug 6, 2026

WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.

CVE-2026-25403 Medium · 6.5 CWE-862 Aug 6, 2026

WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.

CVE-2026-65551 High · 7.5 CWE-862 Aug 6, 2026

WordPress Breakdance plugin < 2.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7.

CVE-2026-11983 Medium · 5.3 CWE-862 Aug 6, 2026

Ad Inserter <= 2.8.16 - Missing Authorization to Block Visibility Bypass via ai_ajax

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check in the `ai_ajax` function. This makes it possible for unauthenticated attackers to view the contents of ad blocks that an administrator has restricted to administrator-only visibility.

CVE-2025-9266 Medium · 4.3 CWE-862 Aug 6, 2026

Accelerate <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation

The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueue_scripts() function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate the ThemeGrill Demo Importer plugin.

CVE-2026-19010 High · 7.3 CWE-862 Aug 6, 2026

TinyAGI Message API Endpoint index.ts processMessage authorization

A security vulnerability has been detected in TinyAGI 0.0.20. Impacted is the function processMessage of the file packages/main/src/index.ts of the component Message API Endpoint. Such manipulation leads to missing authorization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-16734 High · 7.5 CWE-862 Aug 6, 2026

Stripe Payment Forms by WP Full Pay < 8.5.2 - Unauthenticated Payment Intent Amount Manipulation

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a payment form — to change the amount of a payment intent that the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 then updates server-side through the Stripe API with the store's secret key. An ownership check added in 8.5.0 was applied to only one payment-intent handler, leaving the pricing-recalculation and payment-intent-update actions unprotected against amount manipulation.

CVE-2026-16290 Medium · 5.3 CWE-862 Aug 6, 2026

ProfileGrid < 6.0.0.0 - Unauthenticated Group Member List Disclosure via pm_get_all_users_from_group

The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks before returning a group's member list, and registers the handler for unauthenticated users, allowing any unauthenticated visitor to disclose the members and their identifiers of any group, including private or closed ones, bypassing the ProfileGrid WordPress plugin before 6.0.0.0's member-visibility setting.

CVE-2026-15991 High · 8.8 CWE-862 Aug 6, 2026

File Manager 6.0 - 6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read and Deletion via 'cmd' Query Parameter

The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0 - 6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to read and delete arbitrary files on the server, which can lead to remote code execution when the right file is deleted (such as wp-config.php). The bypass is triggered by passing cmd=rm or cmf=file in the URL query string of a POST request: elFinder's bind registration reads the command exclusively from $_POST and therefore never registers the rm.pre permission handler, while the dispatcher reads from the merged $_GET+$_POST superglobal and executes the rm or file command unchecked against a volume that defaults to ABSPATH.

CVE-2026-70618 Medium · 4.3 CWE-862 Aug 5, 2026

Spacebar Server Missing Authorization via member-ids Endpoint

Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership by querying the GET /guilds/{guild_id}/roles/{role_id}/member-ids endpoint without guild membership verification. Attackers can exploit the unprotected route handler in the roles member-ids endpoint, which lacks permission checks present in sibling endpoints, to retrieve the full list of member user IDs for any guild on the instance using only a valid bearer token and a known guild ID.

CVE-2026-70617 High · 8.1 CWE-862 Aug 5, 2026

Spacebar Server Missing Authorization via Group DM Recipient Endpoint

Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated attacker to add themselves to arbitrary group DM channels by sending a PUT request to the channels recipient endpoint without membership verification. Attackers can exploit the unguarded PUT /channels/{channel_id}/recipients/{user_id} handler to join private group DMs, read complete message history, post messages as a participant, and force-add third-party users without their consent.

CVE-2026-48168 Critical · 10.0 CWE-862 Aug 5, 2026

PraisonAI: GitHub Actions Claude workflow command injection via unquoted PR branch name

PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. Additionally, the workflow allows any @claude comment to trigger the job regardless of whether the commenter is a trusted collaborator. An outside contributor can open a pull request from a fork whose branch name contains shell metacharacters and comment @claude, causing Bash to execute arbitrary shell code in the GitHub Actions runner. Because these commands run in a job holding a GitHub App token with write permissions, OIDC access, and gh/git access, the injection can be chained through $GITHUB_PATH to compromise later privileged steps, enabling repository writes, pull request and issue manipulation, or OIDC-token abuse. This issue has been fixed in version 4.6.40.