The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function in versions up to, and including, 3.8.0. The handler is registered for both wp_ajax and wp_ajax_nopriv and is gated solely by the 'file_handling_nonce' nonce, which is emitted inside the public checkout page markup (data-nonce attribute) whenever a File Upload checkout field is configured. This makes it possible for unauthenticated attackers to delete arbitrary attachments (including those belonging to other users or posts) by submitting a crafted attachment_id, which can lead to loss of important media and potential denial of service.
The Naimur Email OTP Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.0. This is due to the plugin's password-reset finalization endpoint (the wp_ajax_nopriv_ceovw_update_new_password action handled by CEOVW_AJAX::update_new_password()) authorizing the reset solely by the presence of a database row marking an email as 'VERIFIED', with no timestamp check, no session binding, and no per-reset token — combined with mark_otp_as_verified_for_reset() leaving the row in that state after a user enters their code (abandoning the flow leaves the row behind), and a scheduled 'ceovw_cleanup_expired_otps_event' cron that has no add_action() handler anywhere in the plugin so cleanup never runs. This makes it possible for unauthenticated attackers to take over any account whose owner previously requested and verified a password-reset code and did not immediately finish choosing a new password — the attacker needs only the victim's email address and a nonce that the plugin itself localizes publicly into the CEOVW_APP global on the WooCommerce account page for logged-out visitors, after which they call the endpoint, overwrite the victim's password, and are returned a live wordpress_logged_in_ session cookie for that user (full site takeover if the account is an administrator).
The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validate_checkout_fields() function in versions up to, and including, 1.1.4 The My Account registration path (validate_fields()) validates a submitted 'tgwcfb/user-roles' value against the form's configured allowed roles, but the checkout registration path (validate_checkout_fields(), hooked to woocommerce_after_checkout_validation) stores the raw $_POST['user_roles'] value in $this->valid_data without any allow-list enforcement, and add_user_data() then injects that value into woocommerce_new_customer_data as the new account's role. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by supplying a user_roles=administrator parameter when creating an account during checkout, resulting in full site takeover.
The Appointment Booking Plugin – LatePoint for WordPress versions up to 5.7.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to take over user accounts. The flaw arises from improper handling of SQL query parameters in the password reset functionality, enabling attackers to reset passwords of other users and gain full access to their bookings, orders, and personal information. When the wp_users_as_customers option is enabled, attackers can also take over linked WordPress user accounts.
CVE-2026-123961 is a critical buffer overflow vulnerability in TOTOLINK CA300-PoE version 6.2c.884. The flaw exists in the setWiFiBasicConfig function within the /cgi-bin/cstecgi.cgi file, where improper handling of the KeyStr argument allows remote attackers to trigger a buffer overflow. Public exploit code has been disclosed, increasing the risk of exploitation.
CVE-2026-123960 is a critical buffer overflow vulnerability in TOTOLINK CA300-PoE version 6.2c.884. The flaw exists in the setWanConfig function of the /cgi-bin/cstecgi.cgi file, where manipulation of the pppoeUser, priDns, or secDns arguments can trigger the overflow. This vulnerability can be exploited remotely without user interaction. Public exploit code is available, increasing the risk of attacks.
CVE-2026-123959 is a critical buffer overflow vulnerability in TOTOLINK CA300-PoE version 6.2c.884. The flaw exists in the setLanguageCfg function within the /cgi-bin/cstecgi.cgi file, where manipulation of the langType argument can cause a buffer overflow. This vulnerability can be exploited remotely without user interaction. Public exploit code has been released, increasing the risk of attacks.
CVE-2026-123958 is a critical buffer overflow vulnerability in TOTOLINK CA300-PoE version 6.2c.884. The flaw exists in the setLanConfig function of the /cgi-bin/cstecgi.cgi file, where manipulation of the lanDns, lanSecDns, or langType arguments can trigger the overflow. This vulnerability can be exploited remotely without user interaction. Public exploit code is available, increasing the risk of exploitation.
CVE-2026-123957 is a critical buffer overflow vulnerability in TOTOLINK CA300-PoE version 6.2c.884. The flaw exists in the setIpQosRules function within the /cgi-bin/cstecgi.cgi file, where manipulation of the ipStart argument can cause a buffer overflow. This vulnerability can be exploited remotely without user interaction. Public exploit code has been disclosed, increasing the risk of exploitation.
The Fiber Admin WordPress plugin versions before 4.0.1 contains a vulnerability where it does not validate or escape a request header before writing it into a PHP file during an unprotected admin hook. This flaw allows unauthenticated attackers to execute arbitrary code if the plugin's custom database error page is enabled and the attacker can win a race condition against an administrator saving settings.
The Tournamatch WordPress plugin versions prior to 4.7.1 contain a vulnerability where the plugin does not validate or restrict the path of a previously stored profile or team image before deleting it during a new image upload. This flaw allows users with minimal privileges, such as Subscribers, to delete arbitrary files on the server, including critical files like wp-config.php, potentially leading to a full site takeover.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a critical vulnerability that allows remote attackers to execute arbitrary code. This is due to improper neutralization of special elements in operating system commands, leading to command injection risks.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary OS commands. This is due to improper neutralization of user-supplied input before it is passed to the operating system, leading to command injection.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authentication vulnerability that could allow a remote attacker to obtain sensitive information and modify API configurations. The flaw arises from insufficient verification of identity information in requests, enabling impersonation of other users.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability due to the use of hard-coded credentials. This flaw could allow a remote attacker to gain full administrative control of the affected systems. The vulnerability is rated critical with a CVSS score of 9.0, indicating high impact on confidentiality, integrity, and availability.