The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allowing authenticated users with a role as low as Subscriber to revert any attachment to its backup copy and to permanently delete that backup and the plugin's generated WebP derivatives, regardless of ownership.
Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.
CVE-2026-18799 is a missing authorization vulnerability in Mattermost affecting specific 11.x versions. It allows an authenticated attacker with team admin privileges to add existing Mattermost users to their team without proper system administrator authorization. This can lead to forged posts attributed to those users by exploiting Slack import functionality with crafted Slack exports containing target users' email addresses.
CVE-2026-18795 is a missing authorization vulnerability in Mattermost versions 11.7.x, 11.8.x, 11.9.x, and 11.10.x up to specified patch levels. The flaw allows an authenticated user to quarantine posts in direct message (DM) or group message (GM) channels via direct API calls without proper server-side permission checks.
The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status() and bulk() functions in the Maps_Controller REST controller in versions up to, and including, 3.0.0. The plugin's permission_callback (can_edit()) only verifies current_user_can('edit_posts') and performs no object-level ownership check or verification of publish-level capabilities, while the handlers pass the caller-controlled map ID directly to wp_update_post() (and wp_delete_post() in the bulk delete branch) to change post_status between publish and draft. This makes it possible for authenticated attackers, with Contributor-level access and above, to publish or unpublish (and bulk-delete) any wpmb_map post, including maps owned by administrators, which hides published maps from all public pages site-wide or forces draft maps to become publicly visible.
The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary media attachments via wp_delete_attachment and upload new attachments to the site, actions that require the upload_files or edit_others_posts capabilities. A Subscriber-level user can obtain their own wplr_auth_token directly from the profile.php page source, because the admin screen guard in Meow_WPLR_Sync_Admin::__construct() is commented out, causing wp_localize_script to leak the token into every admin page view; this token can then be used from a cookie-less HTTP session to invoke destructive actions on the /?wplr-sync-api endpoint.
The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment.
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability check or validate a nonce on its migration actions, allowing any authenticated user, such as a subscriber, to trigger a one-way migration that creates published records and permanently deletes a companion MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2's entire post-type and taxonomy configuration.
The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user (Subscriber and above) to alter the field structure of any form on the site, persistently breaking its public rendering.
The Modula Image Gallery – Photo Grid & Video Gallery WordPress plugin versions up to and including 3.0.11 have a vulnerability that allows unauthenticated attackers to access sensitive information. Specifically, the plugin's REST API endpoint /wp-json/wp/v2/modula-gallery/{id} does not properly redact password-protected gallery credentials, exposing plaintext usernames and passwords. This occurs because the core REST endpoint lacks the redaction applied in the plugin's own /wp-json/modula/v2/gallery/{id}/settings endpoint.
The Bulk Page Generator – LPagery WordPress plugin up to version 3.1.0 contains an authorization bypass vulnerability. Authenticated users with subscriber-level access or higher can create, modify, and delete pages and bulk page-generation processes without proper authorization checks. On fresh installations without Freemius opted in, the AES-256-CBC key used for Bearer token validation defaults to a publicly known value, making token forgery trivial for any authenticated user.
Klarna for WooCommerce plugin versions up to and including 4.13.3 contain an authorization bypass vulnerability. This flaw allows unauthenticated attackers to enumerate all store orders and access sensitive personal information such as names, emails, phone numbers, and addresses. The vulnerability arises because the plugin fails to verify user authorization before exposing order details via a JavaScript variable. WooCommerce's sequential order IDs facilitate trivial enumeration through GET requests without requiring authentication or order keys.
The FunnelKit – Funnel Builder Plugin for WooCommerce Checkout for WordPress contains an authorization bypass vulnerability in all versions up to and including 3.16.0.6. This flaw allows unauthenticated attackers to retrieve billing personally identifiable information (PII) such as full name, street address, email address, and phone number for any WooCommerce order by submitting sequential order IDs. Exploitation requires the presence of a FunnelKit thank-you page rendering specific shortcodes. The vulnerability has a high severity rating with a CVSS score of 7.5.
NotificationX plugin for WordPress versions up to 3.3.3 has a missing authorization vulnerability in its REST API endpoint /notificationx/v1/popup-submit. This flaw allows unauthenticated attackers to inject arbitrary forged social-proof entries into enabled non-popup NotificationX campaigns, such as WP Comments and WooCommerce sales notifications. The vulnerability arises because the permission callback always returns true, and the handler does not verify the type of campaign before copying its source data.
CVE-2026-109812 is a missing authorization vulnerability in the internal API `/api/v1/secrets/` of Moxa AIG-302 Series industrial computing products. It allows a low-privileged authenticated attacker with adjacent network access to potentially access sensitive information, including cryptographic key material. The vulnerability affects versions from 1.0.0 through 1.4.0. The CVSS 4.0 base score is 6.9, indicating a medium severity level.
A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges.
EnergizeLab station-middleware versions 1.6.5 through 1.8.2 contain a missing authorization vulnerability in administrative APIs. Authenticated users with low privileges can access sensitive operations such as retrieving AI provider keys and modifying configuration and object-store contents. This vulnerability allows unauthorized privilege escalation and data exposure.
CVE-2026-111235 is a critical authorization bypass vulnerability in the REST API of multiple versions of OpenNMS Meridian and Horizon. The issue arises from case-sensitive HTTP method checks in Spring Security filter chains, allowing requests with non-canonical (e.g., lowercase) HTTP methods to bypass authentication. This enables remote unauthenticated attackers to read monitored inventory and create, modify, or delete resources, including injecting events to manipulate alarms. The vulnerability is fixed by adding terminal deny rules to REST filter chains. Upgrading to Meridian 2024.3.14, 2025.0.11, 2026.0.1 or Horizon 36.0.5 or newer resolves the issue. These products are intended for private network use and should not be exposed directly to the Internet.
NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL resolvers are reachable without CommonGroundAuthentication and forward a caller-influenced URL through ObjectenApiService.getObjectByUrl to ObjectsApiClient.getObjectByUrl, which attaches the privileged Objecten-API token. The host-equality check restricts requests to the configured Objecten-API host but does not constrain the scheme, port, or path, allowing an unauthenticated caller to induce a token-bearing request to a chosen endpoint on that host. Standard deployments are not exposed to cross-host SSRF, token capture requires attacker-controlled routing on the configured host, and typed deserialization limits returned data to objects shaped like form definitions. The 3.0 release line is fixed in version 3.0.4. The advisory does not identify a fixed 3.1 release.
CVE-2026-97712 is a high-severity vulnerability in Sonatype Nexus Repository 3 that allows users with create or update role permissions to grant themselves roles and privileges they do not originally possess. This flaw can escalate their access up to full administrative rights, potentially compromising the repository's security.