Puppet Enterprise versions 2023.8.0 through 2023.8.10 and 2025.0.0 through 2025.11.2 contain a command injection vulnerability (CWE-78). An authenticated user with Puppet administrative privileges can inject arbitrary shell commands due to insufficient sanitization of input passed to a shell execution context. Exploitation allows execution of commands with root privileges, potentially leading to full system compromise. The issue is resolved in Puppet Enterprise 2023.8.11 and 2025.11.3.
The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site.
CVE-2026-75777 is a high-severity vulnerability in IBM Aspera Enterprise WebApps versions 1.0.0 through 1.0.5. It involves improper privilege management that allows a local attacker to escape container protections by making unrestricted system calls within the container.
CVE-2026-87958 is a high-severity vulnerability in IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5. It involves improper privilege management (CWE-269) that allows a privileged user to disable a specific functionality on the Db2 server, resulting in a denial of service condition.
CVE-2026-9327 is a vulnerability in IBM WebSphere Application Server versions 8.5 and 9.0 where an authenticated user with a low-privilege administrative role can modify security configurations. This improper privilege management flaw could lead to denial of service but does not impact confidentiality or integrity.
CVE-2026-84042 is a high-severity vulnerability in crun affecting versions 1.29 and later. When crun is built with libkrun and a container is started rootful with passt networking enabled (krun.use_passt), it allows execution of attacker-controlled payloads from the container image with host root privileges. This is a regression introduced in version 1.29 due to improper privilege management, resulting in privilege escalation to host root. Mitigation currently involves avoiding running untrusted container images with krun and passt networking until a fixed version is released.
The Registration Form for WooCommerce WordPress plugin versions 1.1.0 through 1.1.2 contains an improper privilege management vulnerability. It fails to validate that the form used during registration is legitimate, allowing users with Contributor or higher privileges to manipulate the permitted-role allow-list via attacker-controlled posts. This enables them to register new accounts with arbitrary roles, including Administrator, potentially leading to full site takeover. The issue is a partial fix of a previous vulnerability (CVE-2026-54807) and was resolved in version 1.1.3.
The YITH WooCommerce Waitlist Premium WordPress plugin versions up to and including 3.35.0 contain a privilege escalation vulnerability. This flaw arises because the add_user_in_waiting_list() function lacks proper capability checks and nonce verification, allowing authenticated users with Subscriber-level access or higher to create new user accounts and assign themselves administrator roles. This vulnerability enables unauthorized privilege escalation to administrator level.
The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the `addPluginCapabilities()` function unconditionally granting the Editor role all 15 `manage_capabilities_*` capabilities — including `manage_capabilities`, `manage_capabilities_roles`, `manage_capabilities_settings`, and `manage_capabilities_backup` — via a hard-coded `$eligible_roles = ['administrator', 'editor']` assignment that runs automatically on the first `admin_init` after plugin activation with no administrator opt-in, persisting the grants directly to the database. This makes it possible for authenticated attackers with Editor-level access to elevate their privileges to a site-wide capability manager, enabling them to create, rename, and delete non-system roles, modify capabilities of non-administrator roles, restore role backups, and write arbitrary plugin options whose names begin with `cme_`, `capsman`, `pp_capabilities`, or `presspermit` via `update_option()`. The escalation stops short of full Administrator access, as WordPress's `map_meta_cap` layer still prevents the escalated Editor from granting administrator-only capabilities to other roles; however, all role-management and plugin-settings functionality gated solely on `manage_capabilities_*` capabilities remains fully accessible.
The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec_ajax_save_page_default_options() AJAX handler iterating over every $_POST key and passing it directly into update_option() without any allowlist, while gating the handler only on 'manage_options' OR the plugin's custom 'wpec_manager' capability. The plugin's built-in 'wpec_store_manager' role holds 'wpec_manager' but not 'manage_options', and the required nonce is emitted on frontend product/category templates that render for any user with 'wpec_manager'. This makes it possible for authenticated attackers, with Store Manager-level access and above, to elevate their privileges to administrator by updating arbitrary WordPress options such as default_role='administrator' and users_can_register='1', then self-registering a new account that is assigned the administrator role.
The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.1.10 via the value function. This is due to a trivially bypassable regex blacklist in Executer::allowedToRun() that fails to block WordPress core functions such as wp_insert_user, update_option, and file_put_contents, combined with no sanitization of PHP condition rule values stored via the firebox_meta REST endpoint. This makes it possible for authenticated attackers, with author-level access and above, to execute code on the server. On sites upgraded from a version prior to 3.1.10, the Migrator::preserveCampaignRoleAccess() function automatically grants the edit_fireboxes and publish_fireboxes capabilities to the Author role, lowering the effective entry point to Author-level access.
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
In checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-66818 is a high-severity vulnerability in Microsoft SQL Server 2017 (CU 31) involving improper privilege management. It allows an authorized attacker to elevate privileges over a network without user interaction. The vulnerability affects multiple versions prior to specific fixed releases. Microsoft has issued official fixes for the affected versions.
CVE-2026-68830 is a vulnerability in Microsoft Windows 10 Version 1607 and related builds involving improper link resolution before file access in the Windows Universal Plug and Play (UPnP) Device Host. This flaw allows an authorized attacker with local access to disclose information by exploiting link following behavior. The issue affects multiple Windows 10 builds prior to specific fixed versions. A patch is available from Microsoft to address this vulnerability.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Privilege Management vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges.
WP Fusion (Pro) plugin for WordPress versions up to 3.47.13 contains a privilege escalation vulnerability. Authenticated users with Subscriber-level access or higher who have the access_key can exploit insufficient authorization checks in the ThriveCart Auto Login handler to create new administrator accounts. This vulnerability requires the ThriveCart Auto Login option to be enabled and the attacker to have the access_key, which is shared with ThriveCart customers. The vulnerability allows full control over the WordPress site.