CWE-862: Missing Authorization vulnerabilities

The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing password-protected content or locking all posts behind an attacker-chosen password.

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role.

The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is written, allowing unauthenticated users to alter arbitrary site settings and to make the site unavailable.

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create and overwrite arbitrary WordPress options with request data, which can take the site offline and deactivate all of its Insurify WordPress plugin through 1.0.

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.

The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.

The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide.

The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can edit an arbitrary post they name rather than that they are allowed to create the Envira Gallery WordPress plugin before 1.16.2's own gallery content, allowing users with contributor-level access to create and publish gallery posts that the Envira Gallery WordPress plugin before 1.16.2's settings otherwise withhold from them.

The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail system, which can be abused to relay phishing carrying the site's identity and domain reputation.

CVE-2026-65459 is a high-severity vulnerability in WPMU DEV's Forminator plugin versions up to 1.57.3. It involves missing authorization controls allowing unauthenticated attackers to arbitrarily delete content. This flaw impacts availability but does not affect confidentiality or integrity. No patch information is provided, and no known exploits are reported in the wild.

CVE-2026-62118 is a high-severity vulnerability in Dmitry V.'s Barcode Scanner with Inventory & Order Manager software versions up to 1.13.1. It involves missing authorization controls, allowing unauthenticated users to bypass access restrictions. This flaw can lead to unauthorized information disclosure, modification, and availability impact.

CVE-2026-62035 is a medium severity vulnerability in the AWS S3 for WordPress Plugin – Upcasted affecting versions up to 3.1.0. It involves missing authorization controls (CWE-862), which could allow unauthorized access to subscriber-level functionality or data. The vulnerability has a CVSS 3.1 base score of 6.3, indicating a moderate impact on confidentiality, integrity, and availability. A patch is available to address this issue.

CVE-2026-62033 is a high-severity vulnerability in Stylemix uListing versions up to 2.2.0 that involves missing authorization controls. This flaw allows unauthorized changes to subscriber settings, potentially impacting confidentiality, integrity, and availability of the affected system.

CVE-2026-42706 is a high-severity vulnerability in ThemeGoods DK versions up to 3.2.1, involving missing authorization controls. This unauthenticated broken access control flaw allows unauthorized users to perform actions that should require authorization, potentially leading to integrity impacts. No patch information is provided, and no known exploits are reported in the wild.

CVE-2026-42705 is a high severity vulnerability in ThemeGoods Grand News versions up to 3.4 that involves missing authorization controls. This unauthenticated broken access control flaw allows an attacker to perform unauthorized actions that impact the integrity of the application. No patch information is currently provided, and no known exploits are reported in the wild.

CVE-2026-40808 is a medium severity vulnerability in Automattic Jetpack VideoPress versions up to 3.6. It involves missing authorization controls, classified as CWE-862, which can lead to broken access control allowing unauthorized actions that impact integrity but not confidentiality or availability.

CVE-2026-40802 is a Missing Authorization vulnerability in the Pubjet software up to version 5.4.8. This flaw allows attackers with limited privileges to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a high severity rating with a CVSS score of 7.6.

CVE-2026-40777 is a high-severity vulnerability in Rashid WPSection versions up to 1.5.1 that involves missing authorization controls. This broken access control flaw allows users with limited privileges to perform unauthorized actions, impacting the integrity and availability of the affected system. No specific affected versions beyond "<= 1.5.1" are detailed, and no patch or remediation information is provided.