A privilege escalation vulnerability exists in the User Registration & Membership WordPress plugin before version 5.2.6. The plugin fails to perform a proper capability check when saving login settings, allowing users with limited management capabilities to change arbitrary site options and escalate their privileges to administrator.
Ultimate Member WordPress plugin versions before 2.13.0 contain an improper privilege management vulnerability that allows unauthenticated users registering through the plugin's own form to assign themselves arbitrary roles, including administrator-level access. This occurs because the plugin validates role selections against the site's registered roles rather than the form's allowed roles. The vulnerability has a high severity with a CVSS score of 8.1.
CVE-2026-78174 is a critical vulnerability in WatchGuard Dimension version 2.0 where unredacted session identifiers for logged-in users are recorded in the web UI diagnostic log. A low-privileged Dimension Administrator can access this log and extract a Super Administrator's session token while the latter is logged in, potentially allowing account takeover.
A vulnerability in the CMP WordPress plugin before version 4.1.18 allows users with the Editor role, if granted access to the plugin's admin-bar controls, to update arbitrary WordPress options via an AJAX action. This improper privilege management can lead to privilege escalation to Administrator.
Mang Board WP, a WordPress plugin, contains a vulnerability in all versions up to and including 2.3.7 that allows authenticated users with subscriber-level access or higher to forge administrator authentication cookies. This is caused by improper privilege management due to flawed HMAC generation and insufficient validation of authentication cookies. Exploiting this flaw can lead to complete site takeover by changing administrator passwords.
Forminator Forms WordPress plugin versions before 1.57.1 contain an improper privilege management vulnerability. This flaw allows unauthenticated visitors to create a new site on a WordPress multisite network without verifying if site registration is enabled. As a result, attackers can gain administrator privileges on the newly created site. The vulnerability has a low CVSS score of 3.7 and no known exploits in the wild. No official patch or remediation guidance is currently provided.
The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress contains a privilege escalation vulnerability in all versions up to and including 4.9.4. The vulnerability arises because the `rum_importer()` function is hooked to the WordPress `import_start` action without proper capability checks, allowing authenticated users with Shop Manager-level access to write arbitrary WordPress options. This can enable attackers to set options such as `users_can_register` to `1` and `default_role` to `administrator`, allowing open self-registration of administrator accounts and full site takeover.
The Content Mask WordPress plugin versions from 1.8.0 up to but not including 1.8.5.5 contains an improper privilege management vulnerability. This flaw allows users with the Contributor role, who normally cannot publish posts or pages, to publish content without having the required publish capability. The vulnerability is identified as CWE-269 and has a low CVSS score of 2.7.
CVE-2026-13598 is a critical vulnerability in the RestrictMate WordPress plugin versions before 1.3.0. It allows unauthenticated attackers to specify arbitrary user roles during account registration, enabling them to create new administrator accounts and gain full administrative access to the site. This leads to a complete site takeover.
The Security Hardener plugin for WordPress versions up to and including 2.4.4 contains an authorization bypass vulnerability. This flaw arises because the plugin overwrites permission callbacks on user-related REST API endpoints, removing WordPress's core capability checks. As a result, authenticated users with Subscriber-level access or higher can create new Administrator accounts or reset passwords of existing Administrators without proper authorization. The vulnerability is active by default due to the enabled user-enumeration protection feature.
CVE-2026-19222 is a vulnerability in the Forminator Forms WordPress plugin before version 1.57.0.7. It involves improper privilege management where the plugin does not consistently enforce role restrictions on registration forms. This flaw allows users who have permission to build forms to create a registration form that assigns the administrator role to any visitor who registers through it.
The WPeMatico RSS Feed Fetcher plugin for WordPress contains a vulnerability in versions up to and including 2.8.24 that allows authenticated users with subscriber-level access or higher to modify arbitrary site options. This occurs due to a missing capability check in the wpematico_import_settings function, enabling privilege escalation by changing the default user role to administrator and enabling user registration. The vulnerability has a high severity score of 8.8 and can lead to full administrative control of the affected WordPress site.
LeafWiki versions 0.1.0 through 0.10.0 contain a privilege escalation vulnerability in the user update API that allows authenticated users to escalate their privileges from regular user roles to admin. Exploitation requires a valid authenticated account. Instances without public registration and with only trusted users are at lower risk. Users should update to version 0.10.1 or later. Until patched, restricting account creation and limiting access to the user update API to trusted users or administrators is recommended.
CVE-2026-59799 is an improper privilege management vulnerability in Apache CloudStack's two-factor authentication plugin. It allows bypassing the two-factor authentication disable flow. The issue affects Apache CloudStack versions from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Upgrading to versions 4.20.3.1 or 4.22.1.1 or later resolves the vulnerability.
CVE-2026-75796 is a privilege management vulnerability in the AI Engine WordPress plugin versions 2.8.0 and earlier. It allows users with the Administrator role on a Multisite sub-site to perform privileged user management operations without proper authorization checks. This flaw enables such users to take over any account on the network, including the Network Administrator's account.
CVE-2026-17145 is a critical vulnerability in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1, involving improper privilege management. This flaw could allow a remote attacker to execute arbitrary code without requiring user interaction or privileges. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No information about available patches or vendor advisories is provided.
CVE-2026-16997 is a high severity vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 involving improper privilege management. It allows a local attacker to execute arbitrary commands due to insufficient privilege controls. The vulnerability has a CVSS 3.1 score of 7.8, indicating significant impact on confidentiality, integrity, and availability. No vendor patch or remediation information is provided in the input data.
CVE-2026-16991 is a high-severity vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It involves improper privilege management due to incorrect handling of symbolic links, allowing a local attacker to gain elevated privileges. The vulnerability has a CVSS 3.1 score of 7.8, indicating significant impact on confidentiality, integrity, and availability. No patch or official fix information is provided in the available data.
CVE-2026-16937 is a high-severity vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It involves improper privilege management that could allow a local attacker to gain elevated privileges without user interaction. The vulnerability has a CVSS 3.1 score of 7.8, indicating significant impact on confidentiality, integrity, and availability. No patch or remediation details are currently provided.