Vulnerabilidades de Royalnavneet
CVEs publicadas que afetam produtos de Royalnavneet: 2 registro(s), com severidade, exploração e correções.
CVE-2026-105059
Média · 6.5
CWE-862 06/10/2026
WordPress Delete All Comments of wordpress plugin <= 7.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in royalnavneet Delete All Comments of wordpress delete-all-comments-of-website allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delete All Comments of wordpress: from n/a through 7.1.
CVE-2026-5617
Alta · 8.8
CWE-639 15/04/2026
Login as User <= 1.0.3 - Authenticated (Subscriber+) Privilege Escalation via 'oclaup_original_admin' Cookie
The Login as User plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the handle_return_to_admin() function trusting a client-controlled cookie (oclaup_original_admin) to determine which user to authenticate as, without any server-side verification that the cookie value was legitimately set during an admin-initiated user switch. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their privileges to administrator by setting the oclaup_original_admin cookie to an administrator's user ID and triggering the "Return to Admin" functionality.