The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user registration and set the default role to administrator, leading to privilege escalation and full site takeover.
CVE-2026-16874 is a high-severity vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It involves improper privilege management due to incorrect enforcement of Role-Based Access Control (RBAC) authentication roles. This flaw could allow a local attacker with limited privileges to escalate to root privileges without user interaction.
CVE-2026-16850 is a high-severity vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves improper privilege management (CWE-269) that could allow a remote attacker to execute arbitrary code via crafted Router Advertisements. The vulnerability does not require user interaction and has a low attack complexity. It impacts confidentiality, integrity, and availability.
CVE-2026-68561 is a high-severity privilege management vulnerability in Wekan versions prior to 9.89. It allows any board member, including those with read-only or comment-only permissions, to escalate privileges by modifying multiple board fields in a single update. This flaw enables an attacker to make themselves the sole board administrator, expose private boards, and remove legitimate owners. The issue is fixed in version 9.89 by restricting modifications to the 'sort' field alone and preventing removal of the last active administrator.
CVE-2026-16703 is a high-severity vulnerability in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves improper privilege management that could allow a local attacker with some privileges to escalate their privileges further. The vulnerability has a CVSS 3.1 score of 7.8, indicating a significant impact on confidentiality, integrity, and availability if exploited.
Dell PowerPath versions 7.2 through 8.0 SP1 contain an improper privilege management vulnerability (CWE-269) that allows a low privileged local attacker to potentially elevate their privileges. The vulnerability has a medium severity rating with a CVSS score of 5.3. No patch or remediation information is currently provided.
Dell OpenManage Enterprise versions prior to 4.7.0 contain an improper privilege management vulnerability (CWE-269) that could allow a high privileged attacker with remote access to elevate their privileges. The vulnerability has a CVSS 3.1 score of 7.2, indicating a high severity impact on confidentiality, integrity, and availability.
CVE-2026-18776 is a critical vulnerability in the TrueBooker WordPress plugin versions before 1.2.7. It involves improper authorization checks in certain AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators. This flaw enables attackers to take over accounts by exploiting the password reset process.
CVE-2026-73974 is a path traversal vulnerability in linuxfabrik monitoring-plugins prior to version 7.0.0 and linuxfabrik-lib prior to 6.1.0. The issue arises because the test helper function lib.lftest.test() improperly handles filesystem paths from a hidden --test argument, allowing unauthorized file reads without path confinement. This vulnerability enables an attacker with sudo-authorized plugin access to read arbitrary root-readable files. The flaw affects multiple plugins that expose file content or existence checks. The vulnerability is fixed by confining fixture reads to a safe directory and routing bypasses through the helper in the fixed versions.
Linuxfabrik monitoring-plugins prior to version 7.0.0 contain a path traversal vulnerability in the logfile check plugin. The plugin accepts a free-form --filename argument and opens the specified file as root without restricting the path to /var/log. This allows an attacker with control over the monitoring account to read arbitrary root-readable files such as /etc/shadow. The issue is fixed in version 7.0.0 by confining paths to documented log roots and resolving symlinks and parent-directory traversal before access.
CVE-2026-66782 is a medium severity vulnerability in the Submariner operator component of Red Hat Advanced Cluster Management for Kubernetes 2.16. It involves improper privilege management where a long-lived broker service account bearer token is exposed within the Submariner Custom Resource specification. An attacker with access to the cluster's etcd database or the ability to run 'kubectl get' commands could obtain this token, which grants full control over the mesh network and management of network resources such as endpoints and secrets. Red Hat has addressed this issue in version 2.17 with security fixes and updated container images.
The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network.
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because `ActionUser::conditions_logic()` gates the `current_user_can('edit_user', $user_id)` authorization check behind an `is_numeric()` test, causing the check to be skipped entirely when `$user_id` is a non-numeric string — a condition that can be induced by passing a crafted value such as `1one` through the unvalidated `item_id` parameter of the unauthenticated `wp_ajax_nopriv_frontend_admin/forms/change_form` AJAX endpoint. This makes it possible for attackers to escalate privileges to administrator by obtaining a server-signed `_acf_objects` payload carrying the non-numeric user ID, which WordPress subsequently coerces to integer 1 (the default administrator), allowing the attacker to overwrite that account's password or email address. Exploitation by unauthenticated users requires a public-facing frontend user form to be configured; in all other cases a subscriber-level account is sufficient.
The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This is due to improper capability handling in the allow_attachment_actions() function, which can treat a target user ID as a media attachment ID during user capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit an administrator account and escalate their privileges to Administrator when the targeted user ID matches the ID of an existing media attachment.
The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the ced_wholesale_request_send AJAX action. The ced_wholesale_request_send_callback() handler only verifies a nonce (which is exposed to any authenticated user through wp_localize_script on the frontend) and that the caller has a positive user ID, then calls WP_User::add_role() with the client-supplied role_required POST parameter without restricting the value to an allowlist of wholesale roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator when the site administrator has enabled the 'Assigning requested role directly' option.
The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions `save_bloyal_configuration_data` and `save_bloyal_accesskeyverification_data` being registered without any capability or nonce checks, and the `bloyal_customer_auto_login` function unconditionally trusting the `Customer.ExternalId` value returned by whichever API URL is stored in the plugin's options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin's bLoyal Loyalty Engine API URL (`bloyal_custom_loyaltyengine_api_url`) and the `is_bloyal_custom_api_url` flag via the unprotected AJAX actions, then trigger the unauthenticated `/cart` REST route to cause `bloyal_customer_auto_login` to fetch customer data from an attacker-controlled endpoint and call `wp_set_auth_cookie()` with an attacker-supplied `Customer.ExternalId`, thereby authenticating as any WordPress user including the site Administrator.
The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the `create()` function's REST endpoint failing to validate the user-supplied `role` parameter against an allowlist of permitted WordPress roles and omitting any `promote_users` capability check before passing the sanitized value directly to `WP_User::set_role()`. This makes it possible for authenticated attackers with `ndpv_manager`-level access and above to create a new WordPress user account with the `administrator` role assigned, achieving full vertical privilege escalation. The `ndpv_manager` capability is a sub-administrator CRM team role granted by Propovoice itself, meaning the attack surface extends beyond site administrators to any user the plugin has elevated to a manager position.
Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Incorrect Default Permission vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation.
Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Improper Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation.