The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the `wcfmmp_profile_settings()` REST handler exposed at `POST /mobile-builder/v1/wcfm-profile-settings`. This is due to a PHP loose-comparison logic flaw in the meta key allow-list check — `strpos( $key, 'mobile_builder' ) == 0` evaluates to `true` for any key that does *not* contain the substring `'mobile_builder'` because `strpos()` returns `false` on no match and `false == 0` is `true` in PHP — combined with a `permission_callback` (`user_permissions_check`) that grants access to any authenticated user by only verifying `$user->exists()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to pass an unsanitized `data` array via the `key` and `data` parameters directly to `update_user_meta()`, overwriting arbitrary user meta on their own account — including the `wp_capabilities` meta key — to grant themselves Administrator-level privileges.
CVE-2025-11229 is a privilege management vulnerability in WSO2 Identity Server that occurs when the 'authorize_all_scopes' configuration is enabled. This misconfiguration allows applications using the client credentials grant type to obtain all API scopes, including sensitive internal and console scopes, without explicit authorization. Exploiting this flaw can lead to privilege escalation, unauthorized administrative actions, access to confidential data, and potential full account takeover. The issue affects multiple versions of WSO2 Identity Server prior to their respective fixed releases.
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module post a forged callback request to another module's callback request queue. The receiving module's callback thread calls the function pointer in the request without checking that the Module Manager sent it, so the attacker's code runs with the receiving module's privilege; when that module runs in privileged mode, a user-mode module gains privileged execution.
Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `execlist.txt` command manifest that is processed during application updates.
Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege.
Improper Privilege Management vulnerability in Apache Syncope.
AuthProfile self-updates allow non-admin users to configure impersonation for WA surrogate authentication.
This issue affects Apache Syncope: from 3.0.12 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.
Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.
Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 through 0.20.2 the launcher starts Deno with unrestricted --allow-read, --allow-write, and --allow-net, and the runner leaves the Deno API on the JavaScript global object. Pyodide's js module proxies that global, so the Python can call Deno.readTextFileSync and Deno.writeTextFileSync. A caller who can supply the code can read and write files as the server OS user, and can persist code execution by writing a .pth file into the server virtualenv's site-packages. The usual remote path is FastMCP's GenerativeUI provider, which registers the MCP tool generate_prefab_ui and forwards that tool's code argument into this sandbox. On a FastMCP server with no authentication configured, any client who can reach the server can call the tool. With authentication, any client allowed to call tools can. Generative UI is opt-in, and the host must have Deno installed. Confirmed on prefab-ui 0.20.2. Fixed in 0.21.0: after the runtime and Prefab sources load, the runner revokes Deno read, write, and network permission before it accepts code, the process is started with --no-prompt so a permission request cannot grant them again, and bootstrap network access is limited to cdn.jsdelivr.net. The fix is commit 030f074 (pull request 538).
Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAH_ISOLATION=chroot, and no buildah invocation passes --isolation, so the step only changes its filesystem root. It keeps the worker pod's PID, network, IPC, and user namespaces, runs as uid 0, and holds CAP_DAC_OVERRIDE. PID 1 in that procfs is the worker entrypoint, so /proc/1/root is the worker container's filesystem and is writable. That filesystem contains the runc, buildah, and runsc binaries the worker uses to start tenant containers, the worker's Kubernetes service account token, and the host directories mounted into the pod. Worker pods are privileged. Clip v2 layered builds are the default, so a tenant with a workspace token reaches this by submitting one image build. The read-only proof confirmed the shared namespaces, CAP_DAC_OVERRIDE, and that the worker's runc binary is visible at /proc/1/root. Fixed in worker 0.1.756: Buildah RUN steps, including the WORKDIR mkdir, use OCI isolation with private PID, IPC, and network namespaces, and tenant ARG values are passed only into the build container.
A privilege escalation vulnerability exists in the User Frontend plugin for WordPress versions up to 4.3.13. Authenticated users with Subscriber-level access or higher can exploit this flaw by injecting a specially crafted shortcode into a published post, enabling them to create Editor-level accounts with active sessions. This occurs due to inconsistent sanitization of the post_content parameter, allowing bypass of shortcode blocklist checks and rendering of a live registration form on the frontend.
The Rox Appointment Booking plugin for WordPress versions up to 1.3.1 contains a privilege escalation vulnerability via mass assignment. An unauthenticated attacker can exploit a public REST endpoint to inject an arbitrary WordPress user ID into a customer record without authorization. If an administrator later opens and updates this poisoned record, the attacker's supplied user ID and email are used to update the administrator's account, enabling full account takeover through password reset. Exploitation requires the attacker to know or guess a valid administrator user ID and for the administrator to interact with the malicious record.
The Mail logging & Catcher plugin for WordPress up to version 2.2.0 contains a vulnerability that allows authenticated users with subscriber-level access or higher to extract administrator password-reset keys from email logs. This vulnerability arises when the plugin's default_view_role setting is configured to a low-privileged capability such as 'read', enabling privilege escalation to administrator by completing the password-reset flow. By default, the plugin restricts log access to administrators only, mitigating this risk on untouched installs.
A privilege management vulnerability exists in the Essential Addons for Elementor WordPress plugin versions 6.6.0 through 6.8.7. Authenticated users with Author-level access or higher can manipulate the role assigned to new accounts created via the plugin's registration form, potentially granting elevated roles such as Editor. This issue is a partial bypass of a previous fix (CVE-2026-5193) and was fully addressed in version 6.8.8.
CVE-2026-63339 is a high-severity vulnerability in IXP-Manager, a web application for managing Internet Exchange Points. Before version 7.3.0, authenticated users without administrative privileges could escalate their privileges to administrator level due to improper input validation. This flaw allows unauthorized access to administrative functions, increasing the risk of full system compromise. The issue is resolved in version 7.3.0.
CVE-2026-62990 is a high-severity cross-site scripting (XSS) vulnerability in shopperlabs shopper, a headless e-commerce admin panel. Versions 2.0.0 up to but not including 2.10.1, and prerelease versions 3.0.0-beta.1 and beta.2, allow authenticated back-office staff with content-upload permissions to upload executable media such as SVG or HTML files. These files are served inline without proper content security headers, enabling script execution in the administrator's session. Exploitation can lead to creation of attacker-controlled administrator accounts and unauthorized access to sensitive data. The issue is fixed in versions 2.10.1 and 3.0.0-beta.3.
CVE-2026-61850 is a critical improper privilege management vulnerability in akuity kargo affecting versions from 0.6.0 up to but not including 1.8.14, 1.9.9, and 1.10.8. It allows authenticated users with delegated permission to manage a Project's Roles or ServiceAccounts to escalate privileges beyond their own by creating or modifying roles and bindings improperly. This can lead to Project-administrator level access, disclosure of Project secrets and credentials, and modification or deletion of Project resources. The vulnerability is fixed in versions 1.8.14, 1.9.9, and 1.10.8.
The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine WordPress Theme, is vulnerable to Privilege Escalation in all versions up to, and including, 2.9.8. This is due to missing capability checks in the ajax_refresh_nonce and ak_admin_ajax handlers before passing attacker-controlled option names and values to update_option(). This makes it possible for unauthenticated attackers to update arbitrary WordPress options including users_can_register and default_role to escalate privileges to administrator by enabling user registration with administrator as the default role.
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.8.7 via the `page_id` parameter of the `register_user()` function. The vulnerability exists because the handler's post status deny-list rejects `future`, `draft`, and `pending` but admits `inherit` — the status carried by every WordPress revision — allowing an attacker to substitute a revision ID for a live page ID, while a flawed "last saved by administrator" check reads `post_author` on revisions (which reflects the editing administrator) rather than the `_edit_last` meta that is never copied to revisions, and the nonce gate is rendered ineffective because any unauthenticated visitor can freely obtain a valid nonce via the `wp_ajax_nopriv_eael_get_token` endpoint. This makes it possible for unauthenticated attackers to register an account with a role as high as Editor — gaining capabilities including `edit_others_posts`, `publish_pages`, `upload_files`, and `unfiltered_html` — by naming a revision whose `_elementor_data` contains an elevated role an administrator previously saved and later reverted on a page bearing the Login/Register widget. Successful exploitation requires that the site has "Anyone can register" enabled and that an administrator has at some point saved and then reverted a non-default "New User Role" on an affected page.
Dell OpenManage Enterprise versions prior to 4.8.0 contain an improper privilege management vulnerability (CWE-269) that allows a low privileged local attacker to elevate their privileges. This vulnerability has a high severity score of 7.8 and affects confidentiality, integrity, and availability. The issue is fixed in version 4.8.0 and later.
A critical vulnerability in the LogixFast Auth WordPress plugin versions before 1.0.4 allows unauthenticated attackers to reset any user's password by sending the password-reset code to an attacker-supplied email address instead of the legitimate user's email. This flaw enables account takeover, including administrator accounts.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and several LTS releases contain an improper privilege management vulnerability (CWE-269). This flaw allows a high privileged attacker with remote access to potentially elevate their privileges. The vulnerability has a CVSS score of 7.2, indicating high severity. Fixed versions are available starting from 8.9.0.0, 8.6.1.30, 8.3.1.50, and 7.13.1.90 depending on the release branch.