The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning derived data, allowing users with contributor privileges to disclose data from private or draft posts they do not own.
The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to the requesting user before deleting it, allowing any authenticated user such as a Subscriber to delete other users' notifications by enumerating notification identifiers.
The FluentBoards WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to access, allowing any authenticated user with member access to a single board to copy and read the stages and tasks (including titles, descriptions and file attachments) of any other board on the site.
The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the `enqueue_paypal_insights_script_on_order_received()` function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to obtain sensitive order information including order keys, which can then be leveraged to access full customer billing details (name, email, phone, address) via the WooCommerce Store API within a 10-minute grace period after order creation.
The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with contributor-level access and above to overwrite the seating layout, ticket inventory, and attendee seat assignments of events they do not own.
The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Contributor role or higher to read the content of arbitrary posts, including other users' private, pending, and draft posts.
The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted support agent to change the assigned customer of any ticket in the system, including tickets outside their granted scope.
/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone(), which copies every column from the source row, including user_id, shared, shared_username, and the stored credential fields password, save_password, and tunnel_password. When a non-owner triggered an adhoc connect against another user's (in practice, typically an administrator's) shared server, the clone inherited that user's ownership, shared flag, and stored database credentials verbatim. pgAdmin persisted this cross-tenant, credential-bearing server row before the connection was even attempted, so it survived even when the connection subsequently failed. The non-owner could then open the newly-owned clone and pgAdmin would connect using the source user's stored database password on the non-owner's behalf, granting the non-owner use of database credentials -- and whatever database privileges they confer -- that were never their own.
Fix forces the cloned adhoc record's ownership fields (user_id, shared, shared_username) and stored credential fields (password, save_password, tunnel_password) to belong to the calling user and be cleared/private before committing, regardless of the source server's ownership, sharing state, or stored credentials. A regression test asserts that an adhoc connect triggered by a non-owner against another user's shared server persists a row owned by the caller, not shared, and without the source's stored credentials.
This issue affects pgAdmin 4: from 9.0 before 9.17.
The Fluent Forms WordPress plugin up to version 6.2.8 contains an authorization bypass vulnerability via the 'transaction' parameter. This flaw allows unauthenticated attackers to brute-force transaction hashes and access sensitive payment receipt data of other users, including personal and payment details. The vulnerability arises from missing validation on a user-controlled key, enabling insecure direct object reference attacks. The brute-force attack is practical due to a limited candidate space of about 900 possibilities per second per submission and form pair.
A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remove essential child roles from built-in admin roles, potentially disrupting administrative functions within a realm.
CVE-2026-12697 is a medium severity vulnerability in the wpForo Forum WordPress plugin before version 3.1.2. It allows subscriber-level users to delete AI chat message histories of other users without proper authorization verification. This occurs because the plugin does not confirm that the AI chat conversation being deleted belongs to the requesting user.
The Academy LMS WordPress plugin up to version 3.8.2 contains an authorization bypass vulnerability that allows any authenticated user with subscriber-level access or higher to view quiz attempt records of all users on the site. This includes sensitive personal data such as IP addresses, names, registration dates, and quiz results. The vulnerability arises because the plugin does not restrict access to quiz attempt records to their respective owners.
CVE-2026-8155 is a medium severity vulnerability in the BuddyPress WordPress plugin before version 14.5.0. It allows any authenticated user with Subscriber or higher privileges to bypass authorization controls on private messaging endpoints. This flaw enables unauthorized reading, modification, or deletion of other users' private messages.
A vulnerability in the JS Help Desk WordPress plugin before version 3.1.5 allows a low-privileged authenticated user to access another user's ticket by supplying the ticket ID. This flaw results from missing verification that the requesting user owns the ticket being loaded, exposing sensitive information such as personally identifiable information (PII) and message contents.
A vulnerability in the FluentCart A New Era of eCommerce WordPress plugin before version 1.5.3 allows unauthenticated visitors to access customer order documents without authorization checks. This flaw enables enumeration and disclosure of customer personal data including names, email addresses, billing and shipping addresses, and order details. The vulnerability is due to missing authorization or ownership verification when rendering order documents keyed by a sequential numeric identifier.
A vulnerability in the Paid Membership Subscriptions WordPress plugin before version 3.0.7 allows any authenticated user with Subscriber-level access or higher to disclose payment details of any member. This occurs because the plugin does not perform capability or nonce checks on one of its payment-related AJAX actions, enabling authorization bypass via user-controlled keys.
The Events Made Easy WordPress plugin before version 3.1.4 contains an authorization bypass vulnerability. It does not verify that the requester is authorized to modify a targeted record when processing unauthenticated data-change requests. The plugin relies solely on a public nonce without per-record tokens or ownership checks, allowing unauthenticated attackers to overwrite personal data of any person record. This vulnerability has a medium severity rating with a CVSS score of 5.3.
Sylius Mollie Plugin versions prior to 2.2.8, 3.2.4, and 3.3.1 contain an authorization bypass vulnerability. The plugin's endpoints for order redirection and QR code retrieval do not verify ownership or session, allowing unauthorized access to order token values. These tokens can be used to view customer personal information such as first name, last name, and email. The issue is addressed in versions 2.2.8, 3.2.4, and 3.3.1.
Sylius Mollie Plugin versions prior to 2.2.8, 3.2.4, and 3.3.1 contain an authorization bypass vulnerability in the payment webhook endpoint. The POST /{_locale}/update-payment endpoint accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the referenced Sylius order. This allows an unauthenticated attacker with any valid paid Mollie payment ID to mark a victim order as paid without transferring funds. The issue is fixed in versions 2.2.8, 3.2.4, and 3.3.1.
IBM Langflow OSS versions 1.0.0 through 1.8.4 have broken access control vulnerabilities in their file handling API. The /api/v1/files/images/{flow_id}/{file_name} endpoint allows unauthenticated attackers to retrieve image files without authentication or authorization. The /api/v1/files/download/{flow_id}/{file_name} endpoint requires authentication but does not properly verify file ownership, enabling authenticated users to access files belonging to others. These issues can lead to unauthorized disclosure of sensitive files and break tenant isolation in multi-user environments.