The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.12.5 via the 'member[ID]' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite any existing Welcart shop-member account's email address and password by supplying that member's numeric ID, then authenticate as that member to achieve full account takeover. The only authentication barrier is a wp_verify_nonce() check against a nonce printed to every unauthenticated visitor on the auto-published New Enrollment Form, meaning no existing account, no WordPress login, and no non-default configuration is required to exploit this vulnerability.
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to unauthorized account access via Use of Predictable Password in all versions up to, and including, 1.2.78 The vulnerability exists because `get_dummy_user_passowrd()` derives the shared password for all 25 built-in dummy user accounts as the first 15 characters of `substr(hash('SHA256', AUTH_KEY . site_url()), 0, 25)`, while the full 25-character value of that same hash is simultaneously embedded in the hidden `uwp_register_hash` field rendered on every registration form response — reachable without authentication via both the public `/register/` page and the `wp_ajax_nopriv_uwp_ajax_register_form` AJAX handler, even when user registration is disabled. This makes it possible for unauthenticated attackers to recover the dummy user password directly from a single HTTP request and use it to authenticate as any of the 25 built-in dummy accounts (such as antawn, chynna, or kiki) through `wp-login.php`, potentially achieving privilege escalation if any dummy account holds an elevated role. Exploitation requires that an administrator has previously created dummy users via the plugin's Tools page.
The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login, allowing an attacker who already knows a user's password to brute force the second factor and take over the account.
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolved the authenticated user by email alone using `kyselyUserFindByEmail`, without binding the lookup to the organization in `/saml/login/:orgId/callback`. An attacker who administers an organization and controls its SAML IdP signing key can submit an assertion for a victim email to another organization's callback when that target organization has registered the same signing certificate. The assertion verifies against the target certificate, and the email resolves to the target user, creating a session as that user and allowing full cross-tenant account takeover without privileges in the target organization. Exploitation requires the unusual configuration in which the target certificate matches a signing key controlled by the attacker. This issue is fixed in version 1.0.2.
In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an internal account and an LDAP account. After LDAP or Kerberos authenticated a user, pgAdmin chose the account to log in by username alone, or took the account Flask-Security's login form had looked up, without checking that it came from the source that authenticated the user. The session therefore belonged to another account, with its role, its servers and its saved database passwords:
- An LDAP or Kerberos user whose username matched an internal account was logged in as that internal account, including the administrator account created when pgAdmin is first set up.
- With internal authentication listed before LDAP or Kerberos in AUTHENTICATION_SOURCES, the login form's internal validation looks up the account whose email was typed and keeps it even though its password does not match. A Kerberos user could type another Kerberos user's principal and be logged in as that user, and an LDAP user could do the same with an LDAP account whose email is their username.
Exploitation requires valid credentials for an LDAP directory or Kerberos realm that pgAdmin is configured to use.
The fix looks the account up by the authenticated username and the source that authenticated it, and no longer uses the account the login form found for any source but internal authentication. Internal authentication logs in that account only if it is an internal account. Desktop mode is not affected.
This issue affects pgAdmin 4: before 9.19.
PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when `MCP_TRANSPORT=http` enables the opt-in HTTP server, `@sylphx/pdf-reader-mcp` reads `MCP_API_KEY` and logs that `X-API-Key` authentication is enabled but never validates the `X-API-Key` header on incoming requests. The `/mcp` endpoint consequently accepts unauthenticated clients. With the default bind address of `0.0.0.0`, any client able to reach the port can invoke every PDF tool and read any PDF the server process can open on the host, despite the misleading authentication-enabled startup log. URL-based sources additionally permit limited server-side request forgery; private and loopback destinations are blocked by default unless `--allow-private-ips` is set. The default `stdio` transport is unaffected. This issue is fixed in version 3.0.1.
CVE-2026-61739 is an improper authentication vulnerability in SOCFortress CoPilot prior to version 0.1.77. The issue allows attackers to create suppression rules without valid credentials due to missing role and tenant authorization checks in Velociraptor Sigma exclusion-management endpoints. Low-privilege users can enumerate and modify detection tuning data, potentially suppressing alerts platform-wide. The vulnerability is fixed in version 0.1.77.
Vvveb CMS versions prior to 1.0.8.7 contain an authentication bypass vulnerability in the password reset functionality. This flaw arises from insufficient validation of user and token parameters in GET requests, allowing attackers to bypass authentication controls. The issue has been fixed in version 1.0.8.7.
A vulnerability in the Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before version 2.191 allows bypassing password verification during login when using two-factor authentication. An attacker who possesses a user's current authenticator app code can log in as that user, including administrators, without needing the password.
The Page and Post Restriction WordPress plugin (versions up to 1.6.1) contains an authentication bypass vulnerability. This flaw allows an attacker to bypass REST API authentication by exploiting how the plugin re-authenticates users from cookies without verifying REST nonces. Combined with WordPress's permissive CORS settings, this enables an attacker to read private and role-restricted content, user profile data, and authorized comments by tricking a logged-in user into visiting a malicious page that issues cross-origin REST API requests. No additional victim interaction beyond visiting the attacker-controlled page is required.
CVE-2026-90862 is an improper authentication vulnerability in the Web Transfer Module of Progress Software WS_FTP Server on Windows. It affects versions prior to 2024.0.7 and 2025.0.4. An attacker who has a user's password could access certain files associated with that account without completing multi-factor authentication. The vulnerability has a medium severity with a CVSS score of 4.3.
CVE-2026-84296 is a Multi-Factor Authentication (MFA) bypass vulnerability in the SSH component of Progress Software WS_FTP Server on Windows. It affects versions prior to 2024.0.6 and 2025.0.3. The flaw allows authenticated users to bypass MFA requirements due to improper association of authentication factors between accounts. This vulnerability has a CVSS score of 6.8 (medium severity).
CVE-2026-84295 is a critical improper authentication vulnerability in Progress Software WS_FTP Server on Windows. Versions prior to 2024.0.6 and 2025.0.3 are affected. This flaw could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.
IBM Langflow OSS versions 1.0.0 through 1.12.8 contain an improper authentication vulnerability that could allow a remote attacker to bypass security restrictions. This flaw enables unauthorized access with potentially full confidentiality, integrity, and availability impact. The vulnerability is classified as critical with a CVSS score of 9.8.
IBM Langflow OSS versions 1.0.0 through 1.12.4 contain an improper authentication vulnerability (CWE-287) that could allow a remote attacker to obtain sensitive information without authorization. The vulnerability has a high severity rating with a CVSS score of 7.5. No public exploits or patches are currently documented.
CVE-2026-111739 is a vulnerability in the Two Factor Authentication WordPress plugin (before 1.17.0) and the All-In-One Security (AIOS) WordPress plugin (before 5.5.0). The flaw allows an attacker who knows a victim's password and has their own two-factor-enabled account to bypass the victim's second-factor authentication by using their own two-factor code, thereby gaining unauthorized access to the victim's session.
CVE-2026-88928 is an improper authentication vulnerability in the PAYCOMET for WooCommerce WordPress plugin versions 5.36 up to but not including 5.46. The plugin fails to verify the cryptographic signature on its payment notification endpoint for tokenisation operations, which allows unauthenticated attackers to overwrite stored payment tokens linked to existing orders and delete saved card records. This vulnerability has a medium severity with a CVSS score of 6.5. The issue is fixed in version 5.46.
The Wild Apricot Login plugin for WordPress versions up to 1.0.18 contains an authentication bypass vulnerability. This flaw allows attackers who control a WildApricot contact with an email matching a WordPress administrator to authenticate as that administrator without proof of account ownership. The vulnerability arises from the plugin's fallback to a network-global email lookup and session cookie issuance without sufficient verification during SSO login. Exploitation requires attacker control of a matching WildApricot email and use of the SSO flow on any subsite where the plugin is active, granting network-wide administrator access.
SSL Wireless SMS Notification for WordPress versions up to 3.8.1 contains an authentication bypass vulnerability. The flaw allows attackers to bypass SMS OTP verification by exploiting the final_login_ajax_action handler, which improperly authenticates users based solely on attacker-controlled data and a phone number linked to the user account. This enables unauthenticated attackers who know a user's phone number to take over that user's account.
The Bot for Telegram on WooCommerce WordPress plugin versions up to 1.3.0 contains an authentication bypass vulnerability. An unauthenticated attacker can exploit a REST endpoint that lacks proper permission checks and signature verification to forge bot updates. This allows the attacker to impersonate any WordPress user by username and obtain a login token. The token can then be used to create an authenticated session without any capability checks or nonces, resulting in full account takeover, including administrator accounts.