SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface /account/person/signup.serv. Email ownership is not verified prior to registration.
The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can assert through a provider account of their own.
The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage users, to create administrator accounts and to overwrite the credentials and role of existing accounts, including administrators.
IBM Guardium Data Protection version 12.2 contains a vulnerability related to improper privilege management that could allow a local attacker to gain elevated privileges. This flaw has a high severity rating with a CVSS score of 7.8, indicating significant impact on confidentiality, integrity, and availability if exploited.
IBM Guardium Data Protection version 12.2 contains a local privilege escalation vulnerability due to improper privilege management in a SUID-root binary named nmap_wrapper on the Collector appliance. A local attacker with low privileges can exploit insufficient argument validation in this binary to execute arbitrary commands as root, leading to full compromise of the Collector appliance.
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writable part_config.time_encoder text value and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with the documented partman_user INSERT and UPDATE privileges can store SQL rather than a function name. When pg_partman_bgw later creates a child partition for a text- or UUID-keyed set, the worker executes the stored SQL with pg_partman_bgw.role privileges, which default to PostgreSQL superuser. The persistent configuration row can repeatedly restore elevated access on later maintenance ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0.
IBM Guardium Data Protection version 12.2 contains a vulnerability related to improper privilege management that could allow a local attacker to gain elevated privileges. This vulnerability has a high severity rating with a CVSS score of 7.8. No public exploits or patches are currently documented.
CVE-2026-63349 is a privilege assignment vulnerability in AnyIO versions 4.14.0 up to but not including 4.14.2. The issue arises because anyio.open_process() incorrectly forwards the extra_groups argument, causing child processes to retain parent supplementary groups instead of properly clearing or setting them. This affects POSIX privilege dropping correctness in applications relying on AnyIO subprocess helpers. The flaw can also cause a TypeError if conflicting arguments are supplied.
The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 11.8.2 via the `wpbc_ajax_option_save` AJAX action. The vulnerability exists because the `handle_ajax_save()` function applies per-option safeguards only to names explicitly registered via `register_option_policy()`, causing `get_option_policy()` to return an empty policy — bypassing all can_save, force_mode, and allowed_keys checks — for any unregistered option name, including core WordPress options, while an attacker-controlled `data_name` parameter passes through `sanitize_key()` and is written directly to `update_option()` without restriction. This makes it possible for authenticated attackers with Editor-level access and above to escalate their privileges to Administrator by writing core WordPress options such as `default_role=administrator` and `users_can_register=1`, then self-registering a new Administrator account. The nonce check does not meaningfully restrict this attack, as both the nonce value and nonce action are attacker-supplied POST parameters, and a valid nonce is trivially obtainable via `admin-ajax.php?action=rest-nonce`.
The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installation-wide secret which it discloses to any user permitted to export the site, allowing such a user to import an arbitrary site archive and gain administrator access. Exploitation requires an administrator to have granted the export capability to a role that does not hold the All-in-One WP Migration and Backup WordPress plugin before 7.111's own import capability, which is not a default configuration.
Dell OpenManage Server Administrator Managed Node for Windows versions prior to 11.1.0.3 contain an improper privilege management vulnerability. This flaw allows a high privileged attacker with remote access to potentially elevate their privileges. The vulnerability is identified as CWE-269 and has a CVSS 3.1 score of 7.2, indicating high severity.
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege Management vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Unauthorized access.
The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby escalate their privileges.
The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration against the roles an administrator chose to offer, allowing unauthenticated users to request any role, including administrator, and to be granted it once the request is approved. Exploitation requires the Choose User Role at Registration WordPress plugin before 1.3.3's role selection feature and public account registration to both be enabled.
Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contains an Improper Privilege Management vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group without an invitation or approval.
It did not grant application-wide administrator privileges, and the vulnerability could not be used to obtain root access to the application or its underlying host.
CVE-2026-85569 is a privilege management vulnerability in the Tutor LMS WordPress plugin versions 2.7.1 up to but not including 4.0.8. The plugin fails to correctly verify if an incoming request targets its own REST API and does not enforce the permissions associated with API credentials. This flaw allows a user holding a read-only API key to perform actions with the privileges of the administrator who issued the key.
CVE-2026-85530 is a high-severity vulnerability in the GiveWP WordPress plugin versions 4.16.6 up to but not including 4.16.8.1. It involves improper privilege management due to inconsistent normalization of donor email addresses. This flaw allows unauthenticated users to impersonate arbitrary donors and reset the WordPress password of any user account linked to that donor, including administrator accounts.
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account.