A privilege management vulnerability exists in the FooSales WordPress plugin before version 1.43.3. The plugin does not verify that an authenticated user is authorized to act as the user specified in a request. This flaw allows any authenticated user to impersonate another user, including administrators, potentially exposing account details and enabling account takeover.

CVE-2026-93548 describes an improper privilege management vulnerability (CWE-269) in the FooSales WordPress plugin versions prior to 1.43.3. The plugin fails to verify that an authenticated caller is entitled to act as the user named in the request. This allows an authenticated user to have the plugin perform actions on behalf of arbitrary other users, including administrators, leading to exposure of account details and possible account takeover.

CVE Database V5

A privilege management vulnerability exists in the FooSales WordPress plugin before version 1.43.3. The plugin does not verify that an authenticated user is authorized to act as the user specified in a request. This flaw allows any authenticated user to impersonate another user, including administra

CVE-2026-93548: CWE-269 Improper Privilege Management in FooSales

The SendPress Newsletters WordPress plugin up to version 1.26.1.20 contains an information exposure vulnerability. A logging endpoint is protected by a hardcoded token that is identical across all installations rather than a unique per-site secret. This flaw allows unauthenticated users to access newsletter sending logs, which include recipient email addresses.

CVE-2026-92990 describes an information exposure vulnerability (CWE-200) in the SendPress Newsletters WordPress plugin through version 1.26.1.20. The plugin uses a hardcoded token to protect a logging endpoint, but this token is the same on every site. As a result, attackers can bypass authentication and retrieve newsletter sending logs, exposing recipient email addresses. No CVSS score or exploit in the wild is reported. No patch or remediation information is provided in the source data.

The SendPress Newsletters WordPress plugin up to version 1.26.1.20 contains an information exposure vulnerability. A logging endpoint is protected by a hardcoded token that is identical across all installations rather than a unique per-site secret. This flaw allows unauthenticated users to access ne

CVE-2026-92990: CWE-200 Information Exposure in SendPress Newsletters

SendPress Newsletters WordPress plugin versions up to 1.26.1.20 have an improper access control vulnerability. Authenticated users with subscriber-level privileges can perform newsletter management actions without proper capability checks. This allows them to synchronize all site users into a mailing list and manipulate the newsletter send queue.

CVE-2026-92989 describes an improper access control vulnerability (CWE-284) in the SendPress Newsletters WordPress plugin through version 1.26.1.20. The plugin fails to verify user capabilities on several newsletter-management actions, enabling any authenticated subscriber-level user to synchronize all site users into a mailing list and control the newsletter send queue.

SendPress Newsletters WordPress plugin versions up to 1.26.1.20 have an improper access control vulnerability. Authenticated users with subscriber-level privileges can perform newsletter management actions without proper capability checks. This allows them to synchronize all site users into a mailin

CVE-2026-92989: CWE-284 Improper Access Control in SendPress Newsletters

The Social Web Suite WordPress plugin versions up to 4.1.12 contain a missing authorization vulnerability. This flaw allows unauthenticated attackers to write to plugin settings via an exposed endpoint, potentially overwriting arbitrary options including the shared secret that protects privileged endpoints.

CVE-2026-88931 describes a missing authorization vulnerability (CWE-862) in the Social Web Suite WordPress plugin through version 4.1.12. The plugin does not properly restrict which settings can be modified through an unauthenticated endpoint. This allows attackers to overwrite arbitrary plugin options, including the shared secret used to secure privileged plugin endpoints, potentially enabling further unauthorized actions.

The Social Web Suite WordPress plugin versions up to 4.1.12 contain a missing authorization vulnerability. This flaw allows unauthenticated attackers to write to plugin settings via an exposed endpoint, potentially overwriting arbitrary options including the shared secret that protects privileged en

CVE-2026-88931: CWE-862 Missing Authorization in Social Web Suite

The UnitechPay WordPress plugin versions up to 1.0.6.3 suffers from a missing authorization vulnerability. It does not verify the authenticity of payment notifications, allowing unauthenticated attackers to mark orders as paid without actual payment or force orders into a failed state.

CVE-2026-87841 describes a missing authorization (CWE-862) vulnerability in the UnitechPay WordPress plugin up to version 1.0.6.3. The plugin fails to verify the authenticity of payment notifications it receives, enabling unauthenticated attackers to manipulate order statuses by marking orders as paid without payment or forcing orders into a failed state.

CVE-2026-87841: CWE-862 Missing Authorization in UnitechPay

CVE-2026-78477 is classified under CWE-266, which relates to improper access control or authorization issues. The vulnerability affects all versions up to and including 1.4.2 of the impacted software. The CVE record lacks detailed technical information and does not provide a CVSS score or vendor advisory. No patch or remediation level has been indicated, and no active exploitation has been reported.

Detailed information about CVE-2026-78477: CWE-266 Incorrect Privilege Assignment in MVPThemes Jawn affecting MVPThemes Jawn. Get real-time updates, technical d

CVE-2026-78477 has been rejected

Official rejection reason