The Clean Login WordPress plugin versions up to 1.20.1 have a missing authorization vulnerability. Authenticated users with Contributor-level access or higher can exploit this flaw by embedding specific shortcodes in posts they author, causing the plugin to overwrite certain URL and ID options with the post's ID and permalink. This vulnerability arises from a missing capability check in the get_pages_with_shortcodes() function hooked to the save_post action.
The Related Posts for WordPress plugin (up to version 3.0.0) contains a missing authorization vulnerability that allows authenticated users with contributor-level access or higher to view titles and publication dates of all private posts across the site. This information is normally restricted to users with editor-level permissions or above. The flaw arises because the plugin only checks edit permissions on a parent post owned by the attacker, which contributors satisfy, thus bypassing proper access control.
The Rich Showcase for Google Reviews WordPress plugin up to version 7.1.6 contains an authorization bypass vulnerability. Authenticated users with contributor-level access or higher can retrieve a sensitive 127-character authentication secret (grw_auth_code). This secret allows impersonation of the WordPress site to the RichPlugins backend service, potentially exposing site identity to unauthorized parties.
The Related Posts for WordPress plugin (up to version 3.0.0) contains a missing authorization vulnerability that allows authenticated users with Contributor-level access or higher to read titles of non-public posts authored by others. This occurs because the plugin fails to verify read permissions on child post IDs supplied by the user, exposing titles of drafts, pending, private, future, or trashed posts in the editor meta box.
The AI ChatBot for WooCommerce – WoowBot WordPress plugin up to version 5.0.0 contains an authorization bypass vulnerability. Authenticated users with subscriber-level access can exploit this flaw to trigger repeated RAG document sync operations that consume paid AI embedding API calls charged to the site administrator's API key. The vulnerability arises because the plugin does not properly verify user authorization and exposes a required nonce to all authenticated frontend users, making exploitation trivial. This can lead to financial loss due to drained AI API credits.
The PayPal Brasil para WooCommerce WordPress plugin versions up to and including 1.7.8 contain an authorization bypass vulnerability. This flaw allows unauthenticated attackers to enable or disable the PayPal Brasil BCDC payment gateway and modify its WooCommerce gateway settings, effectively removing PayPal as a checkout option for all customers.
A missing authorization vulnerability exists in PayPlug for WooCommerce (Official) WordPress plugin versions 2.8.0 up to but not including 3.1.1. The plugin fails to perform capability or ownership checks on certain unauthenticated AJAX actions that accept an order identifier, allowing unauthenticated attackers to read, modify, and delete arbitrary WooCommerce orders.
CVE-2026-110691 is a vulnerability in the WPOrLogin WordPress plugin versions before 3.1.0. The plugin fails to perform capability checks or validate nonces before allowing updates to its hidden-login URL settings. This flaw could enable unauthenticated attackers to change the login, registration, and password-recovery URLs, potentially locking out the administrator from the login interface.
A missing authorization vulnerability in Royal Addons for Elementor WordPress plugin versions 1.3.71 up to but not including 1.7.1070 allows unauthenticated attackers to add arbitrary subscriber records to the site owner's Mailchimp audience using stored credentials. This flaw permits injection of email addresses and contact details without any authorization checks.
CVE-2026-106647 is a missing authorization vulnerability in the Royal Addons for Elementor WordPress plugin versions 1.3.68 up to but not including 1.7.1070. The plugin improperly scopes contact form email delivery configurations in a site-global namespace keyed by a non-secret identifier exposed publicly. This allows users with Author role or higher to overwrite other users' form configurations, potentially redirecting form submissions to attacker-controlled email addresses. The issue is fixed in version 1.7.1070.
CVE-2026-106002 is a vulnerability in the Court Reservation WordPress plugin versions before 1.12.4. It lacks authorization and nonce verification on a challenge-management action, allowing unauthenticated users to delete tournament-ladder challenge records and associated court-booking events.
CVE-2026-105997 is a vulnerability in the Booking Package WordPress plugin before version 1.7.33. It allows unauthenticated users to trigger booking verification-code emails to arbitrary recipients because the plugin does not restrict who can initiate these emails nor bind the recipient to server-side state. This can lead to denial of service impacts due to email flooding but does not affect confidentiality or integrity.
The Animated Text Block plugin for WordPress (versions up to 1.2.6) contains a missing authorization vulnerability. Authenticated users with Contributor-level access or higher can exploit this flaw to read the rendered content of any published post, including non-public custom post types that are normally hidden from direct access. This occurs because the plugin's shortcode handler fetches posts by attacker-supplied IDs without proper capability checks or validation of post type visibility.
CVE-2026-58255 is a privilege escalation vulnerability in Cronicle task scheduler versions prior to 0.9.121. It allows a non-administrator user or scoped API key with certain privileges to inject arbitrary user and group IDs into event creation or update API calls. This injection leads to jobs running with elevated privileges, including root, bypassing intended access controls. The issue is fixed in version 0.9.121.
CVE-2026-118171 is a missing authorization vulnerability in the strapi/content-manager package of Strapi Open Source and Enterprise Headless CMS. It allows low-privileged administrators to generate preview URLs for content without needing to know document identifiers or having read permissions. This flaw affects version 5.51.0 of the product and has a CVSS score of 6.5, indicating a medium severity impact primarily on confidentiality.
CVE-2026-118170 is a critical broken access control vulnerability in the strapi/review-workflows package of Strapi Open Source and Enterprise Headless CMS version 5.51.0. It allows unauthorized users to update documents without verifying their update rights, potentially leading to unauthorized data modification. The vulnerability has a high CVSS score of 9.1, indicating severe impact on confidentiality and integrity. No patch or remediation details are currently provided by the vendor, and no known exploits are reported in the wild.
OpenWISP Controller versions from 1.0.0 up to but not including 1.3.2 contain a missing authorization vulnerability in the GET /api/v1/controller/ca/<integer-id>/crl endpoint. An authenticated organization manager with CA view permission can access the certificate revocation list (CRL) of other organizations by specifying their CA identifier, bypassing intended authorization boundaries. The vulnerability allows disclosure of CA issuer information and revoked certificate serial numbers but does not expose private keys or permit modification. This issue is fixed in version 1.3.2.
CVE-2026-16491 is a missing authorization vulnerability in Grafana Enterprise's RBAC service. It causes the system to ignore the requested folder when verifying if a user is a folder administrator for deleted dashboard listings. This flaw allows users with dashboard permission-management rights on any folder to be treated as administrators of all folders, potentially exposing deleted dashboard items from folders where they lack administrative access.
CVE-2026-90465 is an authentication bypass vulnerability in WatchGuard Fireware OS affecting the FireCluster Sync processing. An attacker on the cluster interconnect, such as a compromised cluster peer or an on-path attacker, can send specially crafted requests to perform privileged firewall management actions as root. This flaw affects multiple versions prior to fixed releases in 2026.4, 12.12.4, and 12.5.22. The vulnerability has a high severity CVSS score of 8.7.
CVE-2026-93865 is a critical vulnerability in WatchGuard Fireware OS affecting the FireCluster synchronization daemon. It allows a remote unauthenticated attacker to perform privileged system-level administrative actions by sending crafted requests to the FireCluster management IP when clustering is enabled. The flaw is due to missing authentication for critical functionality. Fixed versions are available.