CVE Database

CVE-2026-5626 Medium · 4.3 CWE-862 Jul 29, 2026

Survey Form Block <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission Data Export

The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_all_data() function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export all survey submission data and column metadata.

CVE-2026-17166 Medium · 4.3 CWE-862 Jul 28, 2026

Event Booking Manager for WooCommerce <= 5.3.7 - Missing Authorization to Authenticated (Contributor+) Site-Wide Payment Settings Modification via mep_save_payment_settings_modal AJAX Action

The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to modify site-wide payment settings — including WooCommerce payment enablement, cart redirect behavior, login requirements for checkout, confirmation page ID, and confirmed ticket statuses — that govern how all event bookings are processed.

CVE-2026-54719 High · 7.5 CWE-862 Jul 28, 2026

goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder ACLs and block lists. This issue is fixed in version 2.1.1. This vulnerability exists due to an incomplete fix for CVE-2026-40189.

CVE-2026-16184 Critical · 9.8 CWE-862 Jul 28, 2026

IBM WebSphere Application Server is affected by an authentication bypass

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request.

CVE-2026-66751 Medium · 5.4 CWE-862 Jul 28, 2026

Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and permanently archive private or password-protected rooms they cannot access, with no application-level recovery path requiring direct database intervention to restore.

CVE-2026-66750 Medium · 4.3 CWE-862 Jul 28, 2026

Let's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files route

Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can enumerate adjacent MongoDB ObjectIds derived from a known file ID to recover files uploaded by other users, as the GET /files/:id/:name route in app/controllers/files.js only enforces login authentication without consulting room membership or the Room.canJoin check.

CVE-2026-16774 Medium · 5.3 CWE-862 Jul 28, 2026

WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action

The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcs_send_email() AJAX handler. This is due to the wpcs_send_email() function being registered on both wp_ajax_wpcs_send_email and wp_ajax_nopriv_wpcs_send_email with no nonce verification, capability check, or rate limiting, while forwarding attacker-controlled recipient, subject, and body directly to wp_mail(). This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient from the site's domain, enabling spam, phishing, and abuse that can lead to the site's IP/domain being blacklisted.

CVE-2026-15411 Medium · 5.3 CWE-862 Jul 28, 2026

StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Options Update via create_popup AJAX Action

The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the spsg_popup_products option with arbitrary attacker-controlled data. The 'ajd_protected' nonce used as the sole gate is exposed to unauthenticated visitors on every frontend page through the BoGo module's wp_localize_script call, rendering it ineffective as an authorization barrier.

CVE-2026-15025 High · 7.5 CWE-862 Jul 28, 2026

Uncanny Automator <= 7.3.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Integration Metadata Disclosure via Multiple AJAX Endpoints

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.3.2 via the automator_google_contacts_fetch_labels, automator_mautic_segment_fetch, automator_mautic_tags_fetch, and automator_mautic_render_contact_fields AJAX actions due to a missing capability check and missing nonce verification in the corresponding handlers (ajax_fetch_labels, segments_fetch, tags_fetch, and render_contact_fields). This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate sensitive Google Contacts groups/labels and Mautic segments, tags, and contact-field definitions retrieved via integration credentials configured by an administrator, and to consume third-party API quota.

CVE-2026-13110 Medium · 5.3 CWE-862 Jul 28, 2026

StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via bogo_category_msg_create AJAX Action

The Storegrowth Sales Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.1.0. This is due to a missing capability check on the bogo_category_msg_create() AJAX handler, which is registered for both authenticated (wp_ajax_) and unauthenticated (wp_ajax_nopriv_) users and only validates a nonce ('ajd_protected') that is emitted publicly via wp_localize_script() on every frontend page through front_scripts() . This makes it possible for unauthenticated attackers to modify the plugin's BOGO category-message configuration stored in the spsg_bogo_general_settings option by reading the nonce from any public page and POSTing attacker-controlled data to admin-ajax.

CVE-2026-14168 High · 8.8 CWE-862 Jul 28, 2026

ads-tec Industrial IT: Vertical privilege escalation via configuration table write

A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gaining full system access.

CVE-2026-16587 Medium · 4.3 CWE-862 Jul 28, 2026

Advanced Form Integration <= 2.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary MailUp OAuth Token Overwrite via auth_redirect() Function

The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the site's stored MailUp OAuth tokens in the adfoin_mailup_keys option with attacker-controlled tokens, hijacking future form-submission data to a MailUp account they control or nulling the tokens to break the integration entirely. This is exploitable by any authenticated user who can reach /wp-admin/profile.php, as admin_init fires for all logged-in users visiting any wp-admin page.

CVE-2026-14924 High · 7.5 CWE-862 Jul 28, 2026

Tablesome < 1.1.31 - Unauthenticated Post Creation and Modification

The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated users to create new published posts and to overwrite arbitrary existing posts and pages.

CVE-2026-14821 Low · 2.7 CWE-862 Jul 28, 2026

Quiz And Survey Master < 11.1.5 - Contributor+ Arbitrary Template Deletion

The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates.

CVE-2026-12124 Medium · 5.3 CWE-862 Jul 28, 2026

PDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameter

The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax() function and the serveTemplatePdf() REST route (which is registered with `permission_callback => '__return_true'`) in versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to download stored template PDFs — which may contain customer PII, invoice, order, and certificate data — by requesting the publicly registered admin-ajax action `pdfdraft_embed_pdf` or the REST endpoint `/wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf` with a known or guessable design slug, bypassing the plugin's own .

CVE-2026-66473 High · 7.5 CWE-862 Jul 27, 2026

WordPress Xendit Payment plugin <= 7.1.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Xendit Payment <= 7.1.0 versions.

CVE-2026-65445 Medium · 6.5 CWE-862 Jul 27, 2026

WordPress Ad Invalid Click Protector (AICP) plugin <= 1.3.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions.

CVE-2026-64746 Critical · 9.8 CWE-862 Jul 27, 2026

Missing Authorization in Apple Ipados

An authorization issue was addressed with improved validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. An app may be able to add contacts without user authorization.

CVE-2026-43665 Medium · 5.5 CWE-862 Jul 27, 2026

This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia...

This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A local attacker may be able to determine the legacy VNC password configured for Screen Sharing.

CVE-2026-65922 Medium · 5.4 CWE-862 Jul 27, 2026

Potential unauthorized modification of Artifactory internal metadata

An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is not affected.

CVE-2026-66477 Medium · 5.3 CWE-862 Jul 27, 2026

WordPress Gillion theme <= 4.13 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Gillion <= 4.13 versions.

CVE-2026-66442 Medium · 5.4 CWE-862 Jul 27, 2026

WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerability

Subscriber Broken Access Control in YayPricing <= 3.5.6 versions.

CVE-2026-65568 Medium · 5.0 CWE-862 Jul 27, 2026

WordPress Visual Composer Website Builder plugin <= 45.15.0 - Broken Access Control vulnerability

Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions.

CVE-2026-65567 Medium · 5.3 CWE-862 Jul 27, 2026

WordPress Event Tickets plugin <= 5.29.0.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions.

CVE-2026-65435 Medium · 6.5 CWE-862 Jul 27, 2026

WordPress Thrive Leads Version plugin <= 10.9.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions.