A critical vulnerability (CVE-2026-14205) exists in the WP Events Manager WordPress plugin versions before 2.2.5. The flaw allows any authenticated user to manipulate the quantity parameter when registering for a paid event, causing the plugin to compute the price based on attacker-controlled input. This enables the creation of completed bookings for paid events without actual payment.
CVE-2026-48087 is a critical improper authentication vulnerability in OpenReception's appointment booking software prior to version 1.0.2. The flaw allows an unauthenticated attacker to register a WebAuthn passkey credential under a victim's user ID by exploiting insufficient validation between the userId in the URL and the email associated with the registration cookie. This enables the attacker to impersonate the victim and gain unauthorized access. The issue is fixed in version 1.0.2.
Statamic CMS versions prior to 5.74.1 and 6.24.0 contain an improper authentication vulnerability when OAuth login is enabled with providers that do not guarantee verified email addresses. This flaw allows an unauthenticated attacker to sign in as an existing user, including potentially a super admin, without knowing the user's password. The vulnerability arises because the application matches OAuth identities to user accounts solely by email address. This issue is fixed in versions 5.74.1 and 6.24.0.
The Estatik Real Estate Plugin for WordPress before version 4.3.3 contains an authentication flaw that allows unauthenticated users to send emails through the site's property request form without proper anti-spam checks or recipient restrictions. This enables attackers to use the site as a mail relay to send emails with arbitrary recipients, subjects, bodies, and Reply-To headers, potentially facilitating spam or phishing campaigns.
The WPMU DEV Dashboard plugin for WordPress contains an authentication bypass vulnerability in all versions up to and including 5.0.0. This flaw allows unauthenticated attackers to perform privileged actions such as installing and activating plugins from attacker-supplied URLs, deleting plugins and themes, upgrading WordPress core, or logging in as an administrator via SSO. The vulnerability arises because sites not connected to the WPMU DEV Hub have an empty API key, making request signatures trivially forgeable. Version 5.0.0 also removed a replay check, increasing exploitability. Sites connected to a WPMU DEV account with a valid API key are not affected.
CVE-2026-9192 is a critical authentication bypass vulnerability in the ODBC App Server component of Progress Software Corporation's MarkLogic Server. It affects versions 11.0.0 and 12.0.0. This flaw allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user, including administrators.
rust-iot-platform's AuthToken request-guard implementation (api/src/main.rs) only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header (e.g. ) satisfies the guard, granting access to every endpoint protected only by this request guard.
The Contest Gallery WordPress plugin versions before 30.0.7 contain an improper authentication vulnerability. The plugin bypasses the standard WordPress authentication flow by issuing an authentication cookie directly after password verification. This flaw allows attackers to perform unlimited, unthrottled password guessing attacks against any account, including administrators, potentially leading to full account takeover.
CVE-2026-16036 is a high-severity vulnerability in the miniOrange 2FA WordPress plugin before version 6.2.7. It allows an attacker who knows a user's password to rebind the user's second factor authentication to an attacker-controlled destination during the pre-login two-factor challenge. This flaw enables account takeover, including administrator accounts, by bypassing proper binding of the second factor to the target account.
WP 2FA WordPress plugin versions before 4.1.0 contain an improper authentication vulnerability. The plugin does not validate the second authentication factor when certain supported methods are selected at login. This flaw allows an attacker who already knows a user's password to bypass two-factor authentication and gain full account access, including administrator privileges.
The OTP Login With Phone Number, OTP Verification WordPress plugin before version 1.8.71 has an improper authentication vulnerability. It does not limit the number of OTP verification attempts nor invalidate the OTP after incorrect guesses. This allows unauthenticated attackers to brute-force short numeric OTP codes and potentially take over any user account, including administrators.
CVE-2026-70482 is an improper authentication vulnerability in open-webui versions from 0.8.0 up to but not including 0.11.0. When the ENABLE_OAUTH_TOKEN_EXCHANGE setting is enabled, the /oauth/{provider}/token/exchange endpoint accepts a raw provider access token and validates it by calling the provider's userinfo endpoint without verifying the OAuth client to which the token was issued. This allows an attacker holding any access token issued by the same provider for any client to exchange it for an open-webui session as the token user, potentially gaining unauthorized access. The issue is fixed in version 0.11.0.
A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privileges locally.
CVE-2026-18759 is a high-severity local privilege escalation vulnerability in ASUSTOR Inc.'s ABP (ASUSTOR Backup Plan) and AES (ASUSTOR EZSync) products. The background service runs with NT AUTHORITY\SYSTEM privileges and uses a file-based IPC mechanism encrypted with AES. However, the encryption key file is accessible to standard users, allowing any authenticated local user to recover the key and forge valid IPC requests. The service also fails to verify the identity of requesting processes and uses insufficient substring checks for destination path validation. This enables attackers to perform arbitrary file reads and writes as SYSTEM, resulting in full local privilege escalation. Affected versions include ABP 2.0.7.10171 and earlier and AES 1.1.1.3113 and earlier.
CVE-2026-11366 is a low-severity vulnerability in the MonsterInsights WordPress plugin versions before 11.1.0. It involves improper authentication due to incorrect validation of the signature on an unauthenticated AJAX action. When the plugin is not connected to Google Analytics, the HMAC signing key is empty, allowing unauthenticated attackers to forge a valid signature and overwrite a configuration value. This disrupts server-side analytics in Manual GA4 mode.
CVE-2026-8508 is an improper authentication vulnerability in the Zyxel WAX650S firmware affecting versions up to 7.10(ABRM.4)C0. The flaw exists in the social_login.cgi CGI program and could allow an attacker connected to the WLAN to bypass captive portal authentication. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No official patch or remediation guidance has been provided by Zyxel as of the publication date. There are no known exploits in the wild. The vulnerability impacts confidentiality but does not affect integrity or availability.
The SoftMarket — Digital Marketplace WordPress plugin through 1.0.0 does not properly validate an authentication token in one branch of its email-verification flow, allowing unauthenticated attackers to obtain a valid session as any verified user by supplying only that user's ID.
The login-social WordPress plugin versions up to 1.0.4 contains an improper authentication vulnerability. It fails to validate password-reset requests against a reset key or verify the requester's identity. This flaw allows unauthenticated attackers to reset any user's password or log in as any existing user, including administrators, potentially leading to full site takeover.