CVE-2026-87907 is a medium severity information exposure vulnerability in the Rox Appointment Booking WordPress plugin versions before 1.2.8. The plugin fails to perform authorization checks on endpoints that return booking service and category records, allowing unauthenticated attackers to access private internal notes stored on these records.
CVE-2026-87896 is an information exposure vulnerability in the Rox Appointment Booking WordPress plugin versions before 1.2.8. The plugin fails to perform authorization checks on an endpoint that returns booking agent records, allowing unauthenticated attackers to access sensitive information such as staff email addresses, phone numbers, private internal notes, and linked WordPress account names.
CVE-2026-87854 is an information exposure vulnerability in the Subscriptions for WooCommerce WordPress plugin versions before 2.0.3. The plugin fails to properly validate the shared secret for a REST endpoint, allowing unauthenticated users to access the full list of store subscriptions. Exposed data includes customer usernames, product names, recurring amounts, and payment dates.
LearnPress WordPress plugin versions from 4.2.7.1 up to but not including 4.4.7 contain an information exposure vulnerability. This flaw allows unauthenticated attackers to use a REST API route to list courses in non-published states such as draft, pending, private, scheduled, and trashed. The issue arises because the plugin does not verify user capabilities before applying a user-supplied post status filter.
LearnPress WordPress plugin versions from 4.3.2.8 up to but not including 4.4.7 have an information exposure vulnerability. The plugin does not verify authentication, capability, or nonce before serving previously generated order export files. This allows unauthenticated attackers who can guess or determine the file identifier to download sensitive customer information such as names, purchases, amounts, and guest email addresses.
LearnPress WordPress plugin versions 4.4.6 up to but not including 4.4.7 contain an information exposure vulnerability. This flaw allows unauthenticated attackers to list enrolled students' display names and user identifiers for courses and retrieve their email addresses via an administrative course tool that lacks proper capability checks.
LearnPress WordPress plugin versions from 4.2.9 up to but not including 4.4.7 have an information exposure vulnerability. This flaw allows unauthenticated attackers to access non-public content, specifically the text, identifier, and type of every published quiz question, via an administrative template handler that does not properly check user capabilities.
CVE-2026-85572 is an information exposure vulnerability in the Tutor LMS WordPress plugin versions 4.0.0 up to but not including 4.0.8. The plugin fails to verify user access rights before returning lesson discussion content, allowing any authenticated user, such as a subscriber, to view comments from courses they are not enrolled in, including those pending moderation. This vulnerability has a medium severity with a CVSS score of 4.3.
CVE-2026-85349 is an information exposure vulnerability in the FluentBoards WordPress plugin before version 2.0.15. The plugin fails to properly verify authorization when returning the list of boards a user belongs to. This allows any authenticated user, including those with minimal privileges such as Subscribers, to disclose private board memberships of other users by referencing their user ID.
The Schema & Structured Data for WP & AMP WordPress plugin versions before 1.66 does not verify if a post is password protected before including its content in structured data. This flaw allows unauthenticated users to access the content of password-protected posts through multiple public output routes. The vulnerability is classified as an information exposure issue (CWE-200) with a medium severity rating and a CVSS score of 5.3.
CVE-2026-78474 is a medium severity information exposure vulnerability in the Ni WooCommerce Sales Report WordPress plugin versions before 4.2.0. The flaw allows unauthenticated users to access WooCommerce order details and customer contact information without any authentication or authorization checks. Attackers can retrieve individual orders and search orders by customer name or email address.
A Broken Access Control vulnerability in NIAEFEUP's tts-be backend prior to version 2.1.0 allows remote attackers to bypass authorization checks by chaining unauthenticated API endpoints. This enables enumeration and extraction of sensitive Personally Identifiable Information (PII) including full names, student IDs, class schedules, and photos. The issue was fixed in version 2.1.0.
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the web_url_read URL policy in src/url-reader.ts can be bypassed while MCP_HTTP_HARDEN is enabled and MCP_HTTP_ALLOW_PRIVATE_URLS is not enabled because redirect targets are not revalidated, 0.0.0.0 is not classified as an internal address, and IPv4-mapped IPv6 literals canonicalized to hexadecimal form are not recognized. These inputs allow an attacker-influenced tool call to make the MCP server fetch loopback or internal HTTP resources and return content from local services, private APIs, service-mesh endpoints, or cloud metadata endpoints. The separate hostname-to-private-address case addressed by the earlier partial fix is not part of these residual bypasses. This issue is fixed in version 1.2.0.
The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsi_pdf_generator and dsi_csv_generator functions, allowing an unauthenticated attacker to access restricted "Circolare" content and registered users' data. An unauthenticated RSS feed at /circolare/feed/ further facilitates exploitation.
GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize only the resource named in the request URL and fail to re-authorize a second caller-influenced dataset reached through a relationship, map layer, VRT source, externalId lookup, or request body. When a public map references a private dataset, anonymous callers can use GET /maps/{id} and GET /maps/{id}/style.json to obtain the private layer's metadata, sampled values, or vector tiles. The style response can expose a replayable HMAC tile URL that is bound to neither a user nor a map. When a public source dataset has a relationship to a private target dataset, anonymous callers can use the dataset relationship APIs to enumerate the relationship and read rows from the private target's backing table. Anonymous callers can also use GET /collections/datasets/items with an externalId dataset UUID to obtain metadata for any private, restricted, or unpublished dataset because that lookup performs no visibility check. Authenticated users with the default editor role can mosaic another user's private raster into an owned VRT and read its pixels, and POST /ai/metadata/{summary,keywords,lineage,quality-statement} accepts a body-controlled dataset_id without a visibility check and returns private metadata and sample values. Pre-existing vrt_source_links also expose unauthorized member metadata and health unless each member is filtered at read time. These paths can disclose vector geometries and attributes, raster pixels, table rows, table names, column schemas, feature counts, extents, source URLs and filenames, contacts, and sampled row values. This issue is fixed in version 1.2.3.
Dragonfly versions prior to 2.4.4 have an information exposure vulnerability where unauthenticated clients can access OAuth provider client secrets via unprotected API endpoints. This allows unauthorized retrieval of sensitive OAuth configuration data such as client secret, client identifier, and redirect URL. The issue is fixed in version 2.4.4.
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint does not enforce ownership or privilege checks when a low-privileged authenticated user queries session information in deployments using stateful session storage. A requester who knows a target identity identifier can retrieve another user's active session credentials, including credentials for a more privileged account, and use them to hijack that session. This issue is fixed in version 16.1.1.
The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users.
The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users.
The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.16.20 via the 'id' parameter. This makes it possible for unauthenticated attackers to extract sensitive data including the full metadata payload of password-protected flipbooks — including title, outline, props, and the serialized data blob containing the underlying PDF file's direct URL — bypassing WordPress post-password confidentiality. Flipbook post IDs can be pre-enumerated via the also-unauthenticated fb3d_send_posts AJAX action, requiring no prior knowledge to target specific flipbooks.