The BeyondSEO WordPress plugin up to version 1.3.6 improperly grants elevated redirect management capabilities to the Contributor role. This allows authenticated users with Contributor-level access or higher to manage site-wide redirects without proper authorization checks, potentially hijacking arbitrary site paths including sensitive endpoints like /checkout and /wp-login.
The Mage Eventpress plugin for WordPress, used for event booking management in WooCommerce, contains a privilege escalation vulnerability in versions up to and including 5.7.8. The vulnerability arises from the mep_grant_shop_manager_access() function, which improperly grants the manage_options capability based on an attacker-controlled request parameter without proper validation. This allows authenticated users with Shop Manager-level access or higher to escalate their privileges to Administrator by appending a crafted query parameter to admin URLs.
CVE-2026-111577 is a high-severity vulnerability in the GoSMTP WordPress plugin before version 1.2.5. The plugin fails to perform proper authorization checks on its SMTP configuration page, allowing users with roles below administrator to modify outbound mail settings. This improper privilege management can lead to an administrator account takeover.
CVE-2026-58255 is a privilege escalation vulnerability in Cronicle task scheduler versions prior to 0.9.121. It allows a non-administrator user or scoped API key with certain privileges to inject arbitrary user and group IDs into event creation or update API calls. This injection leads to jobs running with elevated privileges, including root, bypassing intended access controls. The issue is fixed in version 0.9.121.
Nextcloud Server versions 32.0.0 through 34.0.0 contain a vulnerability where app passwords can bypass password confirmation on sensitive endpoints. This improper privilege management issue could allow unauthorized actions without additional user verification.
A race condition in the installation
process of TeamViewer Remote Management - Patch Management for Windows prior to
version 26.9.1 allows a local authenticated attacker with low privileges to
execute arbitrary code with elevated privileges by replacing the service
executable in an insufficiently protected temporary directory during Patch
Management activation.
Improper access control in the installer
staging directory used by TeamViewer Full Client and Host prior to version
15.82 for Windows during installation of Advanced Asset Management allows a
local authenticated user with low privileges to execute arbitrary commands as
SYSTEM. An attacker can place a crafted installer options file that is
processed by the Advanced Asset Management installer during service activation.
A DLL loading vulnerability in the
TeamViewer Remote Management Monitoring installer for Windows prior to version 26.10.1
allows a local authenticated attacker with low privileges to execute arbitrary
code with elevated privileges. Exploitation requires user interaction.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7, including specific LTS releases, contain an improper privilege management vulnerability. This flaw allows a high privileged attacker with local access to potentially elevate their privileges. The vulnerability is identified as CWE-269 and has a CVSS 3.1 score of 6.3, indicating a medium severity level. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 or later.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 and several LTS releases contain an improper privilege management vulnerability (CWE-269). A high privileged attacker with remote access could exploit this flaw to elevate privileges. The vulnerability has a CVSS score of 6.7, indicating a medium severity level. Fixed versions are available starting from 8.9.0.0, 8.6.1.30, 8.3.1.50, and 7.13.1.90 depending on the release branch.
CVE-2026-117466 is a high-severity vulnerability in Octopus Deploy's Octopus Server where users with the System Manager role can escalate their privileges to full system Administrator. This improper privilege management flaw affects specific versions prior to fixed releases in 2026. The vulnerability allows unauthorized privilege escalation without user interaction and with low attack complexity.
CVE-2026-65220 is a high-severity vulnerability in the SMCI MBD-X12SPI product involving a logic flaw in the BMC IPMI implementation. This flaw allows an attacker with limited privileges to send specially crafted RAKP+ messages to escalate their account to administrator privileges, potentially leading to full control over the system.
Psono Server versions 5.3.5 through 7.2.3 contain an improper privilege management vulnerability where an authenticated attacker with a restricted API key-derived session can claim a device code and escalate to a full read-write session valid for up to 365 days. This bypasses the original token's scope and lifetime restrictions but does not bypass two-factor authentication or disclose plaintext secrets.
CVE-2026-115251 is a privilege management vulnerability in the Duplicator WordPress plugin before version 5.0.0. The plugin's one-click upgrade routine is not properly restricted and is exposed without authentication. This allows an administrator of a multisite child site, who is not a network administrator, to execute arbitrary PHP code in the network-wide shared plugin directory.
The Datawiza Proxy Auth Plugin for WordPress versions 1.1.0 up to but not including 1.1.1 contains an improper privilege management vulnerability. This flaw allows unauthenticated attackers to bypass authentication by exploiting the plugin's failure to verify that user-identity and role HTTP headers originate from a trusted reverse proxy. Successful exploitation enables attackers to authenticate as WordPress administrators.
The aBlocks WordPress plugin up to version 2.17.0 contains a privilege escalation vulnerability via a REST endpoint that allows authenticated users with Contributor-level access or higher to elevate their role to Editor or other non-administrator roles. The flaw arises because the endpoint does not properly verify permissions and allows manipulation of the user role through crafted block attributes. The escalation is limited to roles below administrator level.
The User Profile Builder plugin for WordPress up to version 4.0.3 contains a privilege escalation vulnerability. Authenticated users with Author-level access or higher can exploit the Gutenberg Register block to assign themselves or others elevated roles such as Editor. This occurs because the Assigned Role attribute is passed without proper server-side authorization, and the role guard only restricts roles with manage_options or remove_users capabilities, leaving other privileged roles unprotected.
CVE-2026-25784 is a critical vulnerability in Hallo Welt! GmbH BlueSpice container images that allows privilege escalation. The issue arises from an insecure default initialization of the $mwsgTokenAuthenticatorServiceCIDR setting in LocalSettings.php, which disables IP restrictions when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED is not set. This flaw permits any user with read access, including anonymous users on publicly readable wikis, to obtain an application token via the REST API and escalate to sysop privileges. The vulnerability affects BlueSpice versions from 5.2.3 up to but not including 5.2.7. A fix is available in version 5.2.7.
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage that carries it out, which allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account and be issued a valid session for it. Exploitation requires the site to publish two separate front-end form configurations whose targets are mapped to visitor-submitted values.
A privilege management vulnerability in the User Profile Builder WordPress plugin before version 4.0.5 allows an Administrator of a Multisite subsite to edit any user's account email via the front-end Edit Profile form. This includes the ability to change a Network Super Admin's email and potentially take over that account through the password-reset process.