The Bread plugin for WordPress is vulnerable to information exposure in versions up to and including 2.9.12. This is due to the lack of authentication and authorization checks on the settings export functionality (download_settings function) which is registered on the plugins_loaded hook and explicitly allows execution on non-admin (public) pages. The function exports all plugin configuration settings including the protection_password field, which is stored in plaintext. This makes it possible for unauthenticated attackers to retrieve the PDF protection password by accessing the /?export-meeting-list=1 endpoint.
The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_instant_indexing_settings() function in versions up to, and including, 2.6.23. This function is registered on the admin_init hook and only checks for the presence of $_POST['submit'] before writing attacker-supplied $_POST['metasync_post_types'] into the site-wide 'metasync_options_instant_indexing' option via update_option(); no current_user_can()/current_user_has_plugin_access() check and no nonce verification are performed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the site's Google Instant Indexing post-type configuration, controlling which post types are auto-submitted to Google's Instant Indexing service.
The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve invoice numbers, formatted invoice numbers, and creation timestamps for arbitrary WooCommerce orders by supplying any OrderNumber and InvoiceId values with a garbage nonce.
The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the license_activate_fleximp() and license_deactivate_fleximp() functions, hooked to the wp_ajax_license_activate_fleximp and wp_ajax_license_deactivate_fleximp AJAX actions, lacking both a capability check (current_user_can()) and nonce verification (the client-side script sends a 'wpnonce' value but the handlers never validate it). This makes it possible for authenticated attackers, with subscriber-level access and above, to activate an arbitrary/fraudulent license key (persisting it via update_option('fleximp_is_premium') and toggling validation, suspension, and bundle status options) or deactivate the site's legitimate license (deleting the stored key and setting fleximp_validation_status to false), thereby disrupting the plugin's premium functionality.
The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state change.
The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying.
The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover.
The same route also allows unauthenticated users to store arbitrary web scripts which are then executed on every page of the site's front end, as well as to move arbitrary posts to the trash.
The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from the site's own origin.
The Better Messages plugin for WordPress has an authorization bypass vulnerability in all versions up to and including 2.15.33. This flaw allows authenticated users with custom-level access or higher to access message transcripts, thread metadata, and user data of any chat-room thread without proper authorization. Exploitation requires the chat room setting 'only_joined_can_read' to be set to its default value of '0'.
Tutor LMS – eLearning and online course solution plugin for WordPress versions up to 4.0.8 contains an authorization bypass vulnerability. Authenticated users with subscriber-level access or higher can delete arbitrary WordPress posts, including pages, courses, quizzes, and WooCommerce products. The vulnerability arises from improper authorization checks before performing deletion actions. Exploitation requires a multi-step process involving profile photo upload and topic creation before deleting targeted posts.
The Divi Essential plugin for WordPress up to version 5.8.1 contains a missing authorization vulnerability. Authenticated users with Subscriber-level access or higher can exploit this flaw via AJAX actions to enumerate database tables and read sensitive data. The vulnerability arises because nonce verification is conditional and easily bypassed, and no capability checks are enforced. This allows exposure of sensitive information such as usernames, emails, hashed passwords, session tokens, secret keys, and privileged settings stored in the database.
The SEO Booster plugin for WordPress versions up to and including 7.4.7 has a missing authorization vulnerability. This flaw allows authenticated users with Subscriber-level access or higher to manipulate certain site options related to Google Search Console integration by exploiting a lack of capability checks in the handle_oauth_callback() function. Attackers can overwrite access tokens and email options, disrupting integration and injecting attacker-controlled data. The vulnerability has a medium severity rating with a CVSS score of 4.3.
Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service in src/plugins/terminal/plugin.xml without a binding permission, and src/plugins/terminal/src/android/TerminalService.java does not verify the caller. Any installed Android application can bind the service and send MSG_EXEC with an attacker-controlled cmd value, which the terminal implementation passes to ProcessBuilder with sh -c inside Acode's UID. This allows a zero-permission local application to execute commands with access to Acode private data, remote credentials, Storage Access Framework grants, and runtime permissions without additional interaction at attack time. This issue is fixed in version 1.12.7.
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, ShiroFilter configures /attachment/preview/{id} and /pic/preview/{id} as anonymous, and both routes call AttachmentService.getResource, which performs a bare primary-key lookup without ownership, organization, or permission checks. An unauthenticated caller who guesses or observes an id generated by IDGenerator.nextStr can download files uploaded by users in other organizations because the stored organization id is used only to locate the file rather than authorize the caller. This issue is fixed in version 1.7.4.
CVE-2026-61821 is a high-severity authorization bypass vulnerability in the pg_partman PostgreSQL extension prior to version 5.5.0. It allows a role with partman_user access to relocate retained child tables between schemas without proper CREATE privileges, exploiting the background worker's superuser-level privileges. This bypasses normal ALTER TABLE SET SCHEMA authorization checks. The issue is fixed in pg_partman version 5.5.0.
IBM Guardium Data Protection version 12.2 contains a missing authorization vulnerability in its REST API that could allow a remote authenticated attacker to gain elevated privileges. This flaw is identified as CWE-862 and has a high severity rating with a CVSS score of 8.8. The vulnerability enables an attacker with some level of access to escalate their privileges without proper authorization checks.
CVE-2026-93852 is a high-severity vulnerability in OpenStack Blazar before version 17.0.1. It involves missing authorization checks in the V2 lease listing API, allowing any authenticated user to enumerate leases across all projects without proper project scoping or admin-only restrictions. This exposure reveals sensitive lease-related identifiers and metadata, which can be leveraged to bypass object-level authorization controls and modify or delete leases.
CVE-2026-11545 is a vulnerability in IBM WebSphere Application Server versions 8.5 and 9.0 where missing authorization checks in the administrative console could allow a remote attacker to obtain sensitive information. The vulnerability has a low severity rating with a CVSS score of 3.7 and does not impact integrity or availability.
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers without invoking the authorizator.canWrite check used by normal PUBLISH paths. When anonymous access is enabled and topic ACLs restrict writes, a remote client can set an ACL-protected topic as the Last Will Topic during CONNECT and perform an abnormal client disconnect, causing the broker to inject attacker-controlled messages into a topic for which the client lacks write permission. This issue is fixed in version 0.18.1.