Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application versions prior to 5.36.00.16 and 5.36.00.00 respectively contain an improper privilege management vulnerability. This flaw allows a low privileged attacker with local access to potentially elevate their privileges. The vulnerability has a medium severity with a CVSS score of 5.5. No public exploits or vendor patch information is currently provided.
CVE-2026-77697 is a medium severity vulnerability in Zohocorp ManageEngine Endpoint Central that allows improper privilege management leading to privilege escalation during JAR extraction. It affects versions prior to 11.4.2540.23. The vulnerability has a CVSS 3.1 score of 6.3, indicating a locally exploitable issue with low attack complexity but requiring some privileges. No known exploits are reported in the wild, and no official patch information is provided in the source data.
Zohocorp ManageEngine Endpoint Central versions prior to 11.5.2605.01 contain a local privilege escalation vulnerability due to improper privilege management. The issue arises from loading a DLL from an untrusted path, which can allow a local attacker to escalate privileges. The vulnerability has a medium severity rating with a CVSS score of 5. No official patch or vendor advisory is provided in the input data.
Zohocorp ManageEngine Endpoint Central versions before 11.5.2605.01 contain a local privilege escalation vulnerability related to improper privilege management during agent upgrade. This flaw allows a user with limited privileges to escalate their rights on the affected system. The vulnerability has a medium severity rating with a CVSS score of 5.7. No known exploits are reported in the wild, and the product is not a cloud service.
The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that account via a password reset. It further allows an attacker-controlled customer record to be associated with an arbitrary user, and discloses customer identifiers and email addresses to any authenticated user, which together make the takeover reachable from a subscriber-level account alone.
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcap_save_connector_settings, wcap_send_manual_email, wcap_abandoned_cart_info, and wcap_change_manual_email_data. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify SMTP connector settings to route administrator recovery emails through an attacker-controlled server and intercept auto-login links to gain full administrative access. The plugin's auto-login feature must be enabled, which is the default configuration.
The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take over the site. Exploitation requires the SEO Flow by LupsOnline WordPress plugin before 3.0.3 to have been configured, which is its normal operating state.
SEPPmail Secure Email Gateway versions before 15.0.7 contain a command injection vulnerability (CWE-78) that allows authenticated administrators to execute OS commands with elevated privileges. This vulnerability has a high severity score of 8.6 and affects all versions from initial up to but not including 15.0.7.
The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them.
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with elevated capabilities and then escalate it to administrator.
The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates the site.
The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled 'type' parameter in the customer update endpoint, which allows customers to set their role to 'manager' and trigger creation of a WordPress user with the wpamelia-manager role when the 'externalId' parameter is set to 0. This makes it possible for unauthenticated attackers to escalate their privileges to administrator by first elevating to the manager role, then creating a provider entity linked to an administrator user ID and overwriting that administrator's password.
The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the `nokri_reset_password()` function, which allows empty attacker-supplied reset tokens to match empty or unset `sb_password_forget_token` user meta values. This makes it possible for unauthenticated attackers to reset the password of any user, including administrators, and gain access to their account.
CVE-2026-79744 is a high severity vulnerability in samanhappy mcphub prior to version 1.0.29. The PUT /api/system-config endpoint lacks proper authorization checks, relying only on app-wide authentication and rate limiting without verifying administrative privileges. This improper privilege management allows users with limited privileges to potentially modify system configuration. The issue has been fixed in version 1.0.29.
CVE-2026-81766 is a privilege management vulnerability in the Really Simple Security WordPress plugin before version 9.8.0. It allows a subsite administrator on a multisite network to install and execute arbitrary code in the shared plugin directory, which is normally restricted to the network administrator. Exploitation requires that the network administrator has enabled the plugin's administration menu for subsites, which is not enabled by default.
A critical privilege escalation vulnerability exists in the Custom User Registration Fields for WooCommerce plugin for WordPress, affecting versions up to and including 2.2.3. The flaw allows unauthenticated attackers to specify arbitrary user roles, including Administrator, during account creation at checkout if the "User Role Selection" setting is enabled. This occurs because the plugin does not validate the attacker-controlled role value before assigning it, leading to unauthorized privilege escalation.
The Uix UserCenter WordPress plugin up to version 1.0.3 contains a critical improper privilege management vulnerability. It fails to verify that an unauthenticated profile-update request belongs to the requester and uses a hardcoded signing key for authentication tokens shared across all installations. This flaw allows unauthenticated attackers to forge tokens for any user, enabling them to overwrite administrator email and password details and take over accounts.
The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthenticated attackers to register a new user with an arbitrary role, including Administrator, leading to a full site takeover.
Version 6.9 is advertised as resolving this issue, but the fix is incomplete and the current version remains exploitable by unauthenticated attackers to obtain administrator access and to take over existing accounts. No version that fully addresses the issue is available at the time of this advisory.
Mitigation: deactivate and remove the MemberHero WordPress plugin through 6.9 until a version that fully resolves this issue is released. If the MemberHero WordPress plugin through 6.9 must stay active, disable public registration, restrict access to the registration functionality, and monitor the site for unexpected administrator accounts.
CVE-2026-55485 is a high-severity vulnerability in piccolo_admin prior to version 1.14.0 that allows a non-superuser administrator to obtain another user's live session token via a GET request to the sessions API endpoint. This token can be replayed to impersonate a superuser and escalate privileges permanently. The issue arises because GET requests to user and session tables are allowed without superuser validation, and the session token is exposed as it is not treated as secret. The vulnerability is fixed in version 1.14.0.