CVE-2026-64634 is a high severity vulnerability in Veeam ONE that allows local privilege escalation to the Reporter service context. It involves improper privilege management (CWE-269), enabling an attacker with some level of local access to escalate privileges. No patch or official remediation guidance is currently available, and no known exploits are reported in the wild.
CVE-2026-18759 is a high-severity local privilege escalation vulnerability in ASUSTOR Inc.'s ABP (ASUSTOR Backup Plan) and AES (ASUSTOR EZSync) products. The background service runs with NT AUTHORITY\SYSTEM privileges and uses a file-based IPC mechanism encrypted with AES. However, the encryption key file is accessible to standard users, allowing any authenticated local user to recover the key and forge valid IPC requests. The service also fails to verify the identity of requesting processes and uses insufficient substring checks for destination path validation. This enables attackers to perform arbitrary file reads and writes as SYSTEM, resulting in full local privilege escalation. Affected versions include ABP 2.0.7.10171 and earlier and AES 1.1.1.3113 and earlier.
CVE-2026-15430 is an improper access control vulnerability in Wellbia XIGNCODE3 version 2026.6.1.192. It affects the IRP_MJ_WRITE command interface in the xhunter2.sys driver, allowing a local, unprivileged attacker to escalate privileges to NT AUTHORITY\SYSTEM. The attacker can also extract credentials from PPL-protected lsass.exe and terminate PPL-protected security processes.
A critical privilege management vulnerability exists in the Import and export users and customers WordPress plugin before version 2.4.2. The plugin fails to enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing users with only user-creation capability to create administrator accounts or overwrite existing administrator credentials.
The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new administrator account and take over the site.
The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the `maybe_update_user_role()` function passing an attacker-controlled Gravity Forms field value (`$lead[$feed->user_role_field_id]`) directly into `WP_User::set_role()` without any allowlist validation, capability comparison, or permission check to constrain which roles can be assigned. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their own WordPress account to Administrator by tampering with the role field value in a form submission. Exploitation requires that an administrator has already configured a Pronamic Pay payment feed in Gravity Forms with the **Update User Role** option enabled and mapped to a form field; once that configuration is in place, no further preconditions exist to prevent an authenticated attacker from exploiting this vulnerability.
The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on sites using a supported but non-default configuration.
The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0. This is due to the `save_meta_boxes()` function persisting the `_wps_plan_user_role` membership plan meta from `$_POST` without an allowlist that excludes privileged roles — the only validations applied, `sanitize_key()` and `wp_roles()->is_role()`, both accept `'administrator'` as a valid value, and the UI's `disabled` attribute on the role dropdown is a client-side-only control trivially bypassed via DevTools or a direct POST request; additionally, because the `wps_membership_plan` custom post type is registered with `capability_type => 'post'`, any user who can edit posts satisfies the `current_user_can('edit_post', $post_id)` guard in `save_meta_boxes()`. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their privileges to Administrator by storing `'administrator'` as the role granted on membership acquisition, which the Pro companion plugin then applies via `add_role()` during membership lifecycle events. Successful exploitation requires the Subscriptions for WooCommerce Pro companion plugin to be active, as it is the component that reads the stored `_wps_plan_user_role` meta via `get_post_meta()` and calls `add_role()` to apply the role during membership lifecycle events.
A vulnerability in the Ultimate Member WordPress plugin before version 2.12.1 allows unauthenticated users to register with roles that have administrator capabilities due to improper filtering of roles and a disabled safeguard against privilege escalation by default.
The Demi WordPress plugin versions before 0.0.7 improperly manage privileges by storing full-site backup archives in a publicly accessible location with predictable filenames and no access protection. This allows unauthenticated attackers to download complete backups, including the site database and user password hashes. The vulnerability is classified as CWE-269 (Improper Privilege Management) and has a high severity with a CVSS score of 7.5.
CVE-2026-65835 is a medium severity vulnerability in projectcapsule's capsule framework affecting versions prior to 0.13.8. It involves improper privilege management where tenant owners could create cluster-scoped resources due to incomplete enforcement of resource scope restrictions. The issue was fixed in version 0.13.8.
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled.
ProfileGrid WordPress plugin versions before 5.9.9.8 allow unauthenticated users to register into privileged groups via the front-end registration. This flaw permits privilege escalation by assigning the user the role configured for that group, potentially up to Administrator. The vulnerability arises from improper privilege management in group registration restrictions.
Inappropriate implementation in AdFilter in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
Inappropriate implementation in File Input in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-17816 is a privilege escalation vulnerability in Google Chrome on Android versions prior to 151.0.7922.72. It arises from insufficient policy enforcement in the Speech component, allowing a remote attacker who has compromised the renderer process to escalate privileges via a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 7.5.
The Wholesale for WooCommerce WordPress plugin contains a privilege escalation vulnerability in all versions up to and including 2.0.5. Authenticated users with author-level access or higher can exploit insufficient validation in the save_requests_meta() function to escalate their privileges to administrator. This occurs because the user_role_set POST parameter is sanitized but not validated against allowed roles, and no capability checks are performed before assigning roles. The vulnerability is gated only by a nonce accessible to authors of wwp_requests posts, enabling exploitation by legitimate authors.
The WP Password Policy plugin for WordPress contains a privilege escalation vulnerability in all versions up to and including 3.7.1. This flaw arises from missing authorization checks and nonce verification in the get_user() function of the Module_Password_Hint class, allowing authenticated users with subscriber-level access or higher to escalate their privileges to Administrator by submitting a crafted POST request to the password-reset form endpoint. The vulnerability is triggered via the password_hint filter during password-reset form rendering and requires only a valid password-reset cookie.
The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.1. This is due to insufficient authorization on the `wp_ajax_pos_get_option` AJAX handler, which verifies only a nonce that is localized to every logged-in admin-area user via `admin_enqueue_scripts` — without any capability check — before returning the value of any arbitrary WordPress option via `get_option()`, combined with the `admin_login_endpoint_handler` REST endpoint (`GET /wp-json/epm/v1/admin/login`) being registered as publicly accessible and authenticating callers solely by a whirlpool hash of values stored in those same options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the `site_url`, `connection_key`, and `remote_user_id` values stored in the `eazywp_connecting_info` and `eazywp_connection` options, compute the required `auth_key`, call the `admin/login` REST endpoint to obtain Administrator authentication cookies, and fully take over the site. Exploitation requires the plugin's remote connection feature to have been configured, as the `eazywp_connecting_info` and `eazywp_connection` options must be populated with valid credentials.