A Missing Authorization vulnerability (CWE-862) exists in Web Impian Bayarcash WooCommerce bayarcash-wc through version 4.4.2. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions that impact data integrity. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Confidentiality is not impacted, but integrity is compromised, and availability remains unaffected.
Immich versions up to 3.3.1 have a missing authorization vulnerability in the partner synchronization stream. Authenticated partners can access metadata of Locked Folder assets because synchronization queries do not exclude assets with Locked visibility. This allows attackers with an active partner relationship to retrieve sensitive metadata such as GPS coordinates, capture times, descriptions, and camera details via specific API calls.
The AutomatorWP plugin for WordPress, up to and including version 5.8.4, contains an authorization bypass vulnerability. This flaw allows authenticated users with subscriber-level access or higher to enumerate all Fluent Forms records, including form IDs and titles, due to improper authorization checks. The vulnerability is tracked as CVE-2026-104728 and has a medium severity rating with a CVSS score of 4.3.
The WP CV Builder plugin for WordPress has a vulnerability allowing unauthenticated attackers to upload arbitrary PNG files due to missing authorization checks in the 'wp_save_signature_image' function. This affects all versions up to and including 1.3.1. The vulnerability can lead to unauthorized file uploads to the WordPress uploads directory.
The WP File Download plugin for WordPress contains an authorization bypass vulnerability (CWE-862) in all versions up to and including 6.3.9. This flaw allows authenticated users with subscriber-level access or higher to perform unauthorized actions such as permanently deleting files, emptying the trash, moving files between categories, and publishing or unpublishing files. The vulnerability does not affect confidentiality but impacts integrity and availability of the managed files.
The Fluent Forms plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 6.2.5. This flaw allows authenticated users with Custom-level access or higher to perform unauthorized actions such as reading private form submissions, changing submission statuses, deleting submissions permanently, and modifying global plugin settings.
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7's status metadata onto arbitrary posts.
The AI Puffer – AI Chatbot, AI Writer & Automation WordPress plugin (formerly AI Power) contains an authorization bypass vulnerability in all versions up to and including 2.4.89. Authenticated users with subscriber-level access or higher can modify global semantic search settings if an administrator has granted their role access to the Knowledge Base module via the Role Manager. This vulnerability does not allow direct administrative access but permits changes to settings normally restricted to administrators.
The AI Puffer – AI Chatbot, AI Writer & Automation WordPress plugin (formerly AI Power) contains an authorization bypass vulnerability in all versions up to and including 2.4.89. This flaw allows authenticated users with subscriber-level access or higher to modify global plugin configuration settings related to indexing and vector search. Exploitation requires that an administrator has granted 'sources' module access to a lower-privileged role via the plugin's Role Manager. The vulnerability has a low CVSS score and does not impact confidentiality or availability but can affect the integrity of plugin settings.
CVE-2026-89301 is a high-severity vulnerability in the rtMedia plugin for WordPress, BuddyPress, and bbPress. It affects all versions up to and including 4.7.13. The flaw involves missing authorization checks that allow unauthenticated attackers to delete arbitrary safe files on the server by exploiting insufficient file path validation. Additionally, a public nonce used for uploads is exposed in frontend JavaScript, making it accessible to unauthenticated visitors.
The Hello Plus plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 1.7.7. This flaw allows authenticated users with Contributor-level access or higher to publish their own header/footer templates and draft templates owned by users with higher privileges. The vulnerability arises from improper verification of user authorization when performing certain actions within the plugin.
The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning WordPress plugin contains an authorization bypass vulnerability in all versions up to and including 4.0.3. Authenticated users with custom-level access or higher, registered as instructors for at least one course, can exploit this flaw to delete lesson comments and replies authored by any user, including administrators, across courses they do not instruct. This occurs because the plugin fails to properly verify user authorization for the delete action.
## Summary
Incomplete fix of GHSA-5v7c-xpfp-p65m: the secure-session (OTP step-up) requirement added to the nginx, cert, dns, backup, site, and stream mutation routers was not applied to the parallel api/cluster router, so cluster node management and cluster-wide nginx reload/restart run with only a JWT and no step-up. An authenticated user whose JWT is stolen or persisted, but who does not hold a fresh secure-session, can perform cluster node CRUD (including reading and rewriting a node token secret) and trigger cluster-wide nginx reload/restart. Confirmed at HEAD 2cb7ee9102c9d87274de2fa104db804841d140a0.
## The defect
GHSA-5v7c-xpfp-p65m required a fresh secure session (an OTP step-up beyond the JWT) for sensitive mutation routes. The fix wrapped the nginx, cert, dns, backup, site, and stream mutation handlers in middleware.RequireSecureSession() and added reload/restart to the MCP sensitive-tool list. It did not touch the physically separate api/cluster package, whose router registers the same class of sensitive operations on the bare authenticated group.
The fixed sibling, api/nginx/router.go:
```go
o := r.Group("", middleware.RequireSecureSession()) // line 28
{
o.POST("nginx/reload", Reload) // line 30
o.POST("nginx/restart", Restart) // line 31
}
```
The missed router, api/cluster/router.go, registers every sensitive operation directly on r with no RequireSecureSession wrapper:
```go
nodeGroup := r.Group("nodes") // line 9, no step-up
{
nodeGroup.POST("", AddNode) // line 12
nodeGroup.POST("/:id", EditNode) // line 13
nodeGroup.DELETE("/:id", DeleteNode) // line 14
}
r.POST("nodes/reload_nginx", ReloadNginx) // line 17
r.POST("nodes/restart_nginx", RestartNginx) // line 18
r.POST("namespaces", AddNamespace) // line 22
r.POST("namespaces/:id", ModifyNamespace) // line 23
r.DELETE("namespaces/:id", DeleteNamespace) // line 24
```
Both routers mount on the same group in router/routers.go: `g := root.Group("/", middleware.AuthRequired(), middleware.Proxy())` (line 87); nginx.InitRouter(g) creates its own RequireSecureSession subgroup, cluster.InitRouter(g) does not. So the cluster routes inherit only AuthRequired and Proxy, exactly the pre-fix posture the advisory closed for the nginx routes. AuthRequired has no role gate, so any authenticated user reaches them.
## Attacker model and impact
An authenticated, OTP-enabled user who does not present a fresh X-Secure-Session-ID (the parent advisory's model: a stolen or persisted JWT used without the step-up). Such a user can: add/edit/delete cluster nodes (AddNode/EditNode store an AES-serialized node token, the secret used to control a remote node, so this reads back and rewrites a cross-node credential); trigger nodes/reload_nginx and nodes/restart_nginx across the cluster (the exact reload/restart action class the fix protected on the single-node path); and add/modify/delete/reorder namespaces.
Proof of concept: with a valid JWT but no fresh secure session, call POST /api/nodes (AddNode) or POST /api/nodes/reload_nginx. The nginx equivalent POST /api/nginx/reload returns the secure-session challenge; the cluster route succeeds.
## Verification
Source-verified at HEAD: the nginx router wraps reload/restart in RequireSecureSession, the cluster router registers node/namespace/reload/restart directly on the group with no such wrapper, and both mount on the AuthRequired+Proxy-only group. I did not stand up a live nginx-ui.
## Suggested fix
Wrap the cluster router's mutation handlers (node CRUD, nodes/reload_nginx, nodes/restart_nginx, namespace CRUD) in middleware.RequireSecureSession(), mirroring api/nginx/router.go. Secondary lower-confidence items worth checking in the same pass: the system/restart handler, the core-upgrade websocket, and the upstream socket PUT also appear to run without the step-up (I did not fully trace these).
A vulnerability in 0xJacky's nginx-ui versions 2.0.0 through 2.4.x allows authenticated users to access sensitive node tokens via specific API endpoints. These tokens can be used to bypass cross-node authentication, enabling impersonation of trusted nodes within the cluster. This can expose sensitive management operations such as configuration synchronization and service restart. The issue is resolved in version 2.5.0.
A missing authorization check in the illumos zones statistics daemon (zonestatd) allows a local user in any zone to disrupt zonestat in other zones and to determine which zones are running. The zonestatd door server procedure, zsd_server() in usr/src/cmd/zonestat/zonestatd/zonestatd.c, handles the ZSD_CMD_NEW_ZONE command, which is intended to be sent by zoneadmd, without checking the caller's credentials. Because the zonestatd door is accessible to all users in every zone, an unprivileged user can send this command with an arbitrary zone ID, causing zonestatd to re-create its door file in that zone, so that new zonestat requests in that zone can fail while the file is replaced. The time taken to handle the command also reveals whether a given zone ID belongs to a running zone. The flaw has existed since 2010 (illumos-gate commit efd4c9b6), and affects any illumos distribution prior to illumos-gate commit 865b58d2.
A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent IP multipathing (IPMP) configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c does not require the solaris.network.interface.config authorization for the IPMGMT_CMD_IPMP_UPDATE command, although its handler, ipmgmt_ipmp_update_handler(), writes to the persistent ipadm configuration when the IPMGMT_PERSIST flag is set. An unprivileged local user can therefore add interfaces to, or remove them from, existing IPMP groups in the stored configuration. The running configuration is not changed; the modification takes effect when the stored configuration is next applied, such as at boot, and may disrupt network connectivity. The flaw has existed since 2021 (illumos-gate commit a73be61a), and affects any illumos distribution prior to illumos-gate commit e8d3efa1.
The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and recover their order keys.
The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's waybill-deletion request for those orders using the store's own stored API credentials.
CVE-2026-95597 is a Missing Authorization vulnerability in the 워드프레스 결제 심플페이 plugin for WooCommerce. It affects versions from 0 up to 5.5.17 and allows exploitation due to incorrectly configured access control security levels. The vulnerability can lead to integrity and availability impacts without requiring user interaction or privileges.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 have a missing authorization vulnerability (CWE-862) that allows a low privileged remote attacker to potentially elevate privileges. The vulnerability has a medium severity with a CVSS score of 4.3. No patch or remediation details are provided in the available data.