The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names and email addresses of students enrolled in other instructors' courses.
The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and through a follow-on cleanup delete, arbitrary appointments.
The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order.
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.
After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the set_customer_object due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate arbitrary customer records and disclose personally identifiable information - including first name, last name, email address, and phone number - by iterating the customer[id] parameter. This issue is exploitable only when the site is configured with customer authentication disabled (guest checkout enabled).
CVE-2026-54671 is an authorization bypass vulnerability in LabRedesCefetRJ's WeGIA web manager for charitable institutions. Versions prior to 3.8.5 improperly map an internal control resource to an empty array, which the system treats as granting unconditional access to authenticated users. This flaw allows low-privileged users to read, modify, or delete other users' sensitive personal and medical records without verifying ownership. The issue is fixed in version 3.8.5.
CVE-2026-54239 is a high-severity vulnerability in the FaustWP WordPress plugin, part of the Faust.js headless WordPress toolkit. Versions prior to 1.8.11 improperly authenticate token data by excluding the initialization vector from the HMAC, allowing a logged-in non-administrator to manipulate tokens. This manipulation can escalate privileges to administrator level, enabling full REST API access, administrator account creation, plugin installation, and arbitrary code execution. The issue is fixed in version 1.8.11.
Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, and so take over that account. A confirmation token issued to one user is accepted on any other user's record.
AshAuthentication.AddOn.Confirmation.ConfirmChange verifies the token's signature and its act claim, then applies the changes stored against that token to whichever record the changeset targets, never comparing the sub claim against changeset.data. An attacker who registers an account and changes their own email replays the resulting token against a victim's record id, writing in their own address with force_change_attributes/2 and stamping confirmed_at, after which an ordinary password reset yields the account. The library's own confirmation flow is unaffected, because AshAuthentication.AddOn.Confirmation.Actions.confirm/3 resolves sub to a user and targets that record.
This issue affects ash_authentication: from 0.5.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users.
The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowing unauthenticated attackers to read any author's draft, pending and private car listings - including titles, prices, media URLs and seller notes - by supplying only the target's numeric user id.
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information (full name, email address, phone number, and custom registration fields) by supplying an enumerable booking reference. Exploitation is limited to sites configured to use the Event Booking Manager for WooCommerce WordPress plugin before 5.3.8's native (non-WooCommerce) checkout, which is not the default.
CVE-2026-61589 affects djust versions prior to 1.0.7 and involves incorrect tenant resolution due to the use of a less trusted source for the HTTP host in WebSocket request reconstruction. This causes tenant-scoped data managers to either return unscoped data (cross-tenant data disclosure) when STRICT_MODE is false or empty querysets when STRICT_MODE is true. The issue is fixed in version 1.0.7 by properly extracting and validating the Host header from the ASGI scope against ALLOWED_HOSTS.
CVE-2026-61596 is an authorization bypass vulnerability in djust prior to version 1.0.7. The flaw allows authenticated users to view or act on objects they are not authorized for via certain render entry points that did not enforce per-object authorization. This includes the initial HTTP GET render, SPA url_change navigation, and embedded child views using {% live_render %}. The issue is fixed in version 1.0.7 by routing all render entry points through a shared permission enforcement chokepoint. No reliable workaround exists other than upgrading.
CVE-2026-61592 is a session fixation vulnerability in djust versions prior to 1.0.7. The issue arises because SSE sessions were keyed solely by a client-chosen session_id without binding to the authenticated user, allowing an attacker who obtains a valid session_id to impersonate the victim. This vulnerability is fixed in version 1.0.7 by binding SSE sessions to the owning principal and rejecting cross-principal access. A workaround is to disable the SSE transport.
CVE-2026-86465 is an authorization bypass vulnerability in the Apache Airflow Akeyless provider affecting multi-team deployments using the Akeyless secrets backend. A Dag author scoped to one team can supply a specially crafted Variable key containing a path separator, causing the backend to resolve secrets belonging to a different team. Single-team deployments are not affected. The issue is fixed in version 0.3.1 of apache-airflow-providers-akeyless.
CVE-2026-88910 is a medium severity vulnerability in the kboard WordPress plugin before version 6.7. It allows unauthenticated attackers to delete uploaded media files and their database records without verifying ownership or context. This authorization bypass occurs through user-controlled keys when deleting board media.