The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the Events Manager WordPress plugin before 7.4.1's own posts.
An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring unauthorized activity, or degrade operational monitoring by causing excessive log volume.
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.11.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the BCC field of the acy_notification_cms notification template, causing subsequent WordPress password-reset emails — including those targeting administrator accounts — to be silently copied to an attacker-controlled address, enabling account takeover via the captured reset link. Successful exploitation requires the site administrator to have enabled the "Send website emails with AcyMailing" option, which routes WordPress core notification emails through AcyMailing's templating system.
A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to take over any user account including superusers by provisioning a SCIM user that matches an existing local user by username. The SCIM user ingest function adopts pre-existing local accounts by username without validating scope boundaries. An attacker can rewrite or delete any account, including the superuser, using only a limited provisioning credential.
A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to gain superuser privileges by provisioning a SCIM group that matches an existing administrator group by name. The SCIM group ingest function adopts any existing group by name and replaces its membership without validating the source scope against the target group. An attacker can grant their provisioning token full IdP superuser access and lock out all existing administrators.
Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0.
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to reset any user's password, including an administrator's, and take over the account.
The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.
The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to create a new administrator-level user account and achieve full site takeover by saving and executing a malicious workflow containing a wp_create_user action node specifying role=administrator. This vulnerability is exploitable by unauthenticated attackers on any site where the [aiwu-form] shortcode or public chatbot is rendered on a frontend page, as the waic-nonce value is emitted into publicly accessible JavaScript (WAIC_DATA.waicNonce) on those pages, rendering the nonce check a non-functional authorization barrier.
Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account.
A privilege management vulnerability exists in the Subscriptions for WooCommerce WordPress plugin before version 2.0.1. The plugin fails to verify user capabilities properly before allowing installation and activation of plugins via a nonce-protected AJAX action. This flaw permits users with the Shop Manager role, who normally lack plugin management permissions, to install and activate arbitrary plugins, potentially leading to remote code execution.
CVE-2026-48086 is a critical privilege escalation vulnerability in OpenReception's appointment booking software prior to version 1.0.2. A tenant administrator (TENANT_ADMIN) can promote themselves or another tenant staff member to platform-wide GLOBAL_ADMIN via a single PUT request due to lack of proper authorization checks. This allows full administrative control over all tenants on the platform, including configuration, users, and tenant lifecycle management. The issue is fixed in version 1.0.2.
CVE-2026-1728 is a critical vulnerability in WSO2 API Manager where tokens issued to low-privileged users are not sufficiently restricted. This flaw allows these tokens to access product-level Admin REST APIs, potentially enabling an attacker with a low-privileged account to escalate privileges to full administrative control. The vulnerability affects multiple specific versions of WSO2 API Manager. No official patch or remediation guidance has been provided yet.
CVE-2026-9193 is a critical improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server. It affects versions 11.0.0 and 12.0.0, allowing an authenticated user with a low-privileged Hadoop role to escalate privileges and perform privileged operations on the Security database. The vulnerability has a CVSS score of 9.9, indicating a severe impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor.
CVE-2026-8709 is a critical improper privilege management vulnerability in Progress Software Corporation's MarkLogic Server. It affects the REST API document patch operation in versions 11.0.0 and 12.0.0, allowing an authenticated user with a low-privileged REST role to escalate privileges and perform privileged operations on the Security database. The vulnerability has a CVSS score of 9.9, indicating a severe impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor.
CVE-2026-7329 is a critical improper privilege management vulnerability in Progress Software Corporation's MarkLogic Server. It affects the SQL, SPARQL, and Optic REST query interfaces in versions 11.0.0 and 12.0.0. An authenticated user with a low-privileged REST role can escalate privileges to administrator, enabling execution of privileged operations and unauthorized data access.
CVE-2026-7327 is a high-severity vulnerability in Progress Software Corporation's MarkLogic Server affecting versions 11.0.0 and 12.0.0. It involves improper privilege management in the REST API document processing pipeline, allowing an authenticated user with an administrative REST role to escalate privileges. This escalation can lead to unauthorized disclosure of sensitive server-side data accessible by higher-privileged users.
Smart Popup by Supsystic WordPress plugin versions up to 1.12.0 contain a privilege escalation vulnerability. This arises from improper permission management in the havePermissions() function, allowing unauthenticated attackers to create persistent administrator accounts by exploiting a nonce reuse and lack of server-side role restrictions. The vulnerability enables attackers to submit crafted POST requests to admin-ajax.php and escalate privileges to administrator.