The User Profile Builder WordPress plugin versions before 4.0.5 contain an authorization bypass vulnerability. This flaw allows an Administrator of a Multisite subsite to edit any user's account email via the front-end Edit Profile form without proper authorization checks. Exploiting this, an attacker can change the email of a Network Super Admin account and potentially take over that account through the password reset process.
CVE-2026-114612 is a critical improper privilege management vulnerability in BerriAI's LiteLLM proxy server versions from 1.87.0 up to certain patched releases. The flaw allows an authenticated internal user to forge administrator credentials by exploiting reuse of a cryptographic context for secrets and tokens. This enables escalation to administrative access and execution of arbitrary commands via the MCP stdio endpoint. The issue affects versions 1.87.0 through 1.100.4 and several subsequent minor versions, with fixes released in 1.100.4 and later.
The HIPAA Forms WordPress plugin versions before 3.3.2 contain a vulnerability where the plugin does not verify user capabilities when rebuilding its custom user role. This flaw allows users who already have that role to escalate their privileges by granting themselves administrator-level capabilities.
The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and immediately obtain a privileged administrator-equivalent role without completing the payment meant to gate it.
The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users in a low-privileged role to escalate their privileges and fully compromise the site.
CVE-2026-105453 is a high-severity vulnerability in IBM Sterling Connect Direct for Unix versions 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6. It involves improper privilege management that could allow a local attacker to gain elevated privileges. The vulnerability does not require user interaction and has a low attack complexity. Confidentiality and integrity impacts are high, while availability is not affected.
CVE-2026-110031 is a privilege escalation vulnerability in the Salon Booking System WordPress plugin versions from 10.17 up to but not including 10.31.11. It allows users with the custom salon staff role to assign arbitrary capabilities to other accounts when editing a customer, enabling escalation to administrator privileges and full site takeover.
Arcane versions prior to 2.6.0 contain an incorrect privilege assignment vulnerability in the UpdateUser function. This flaw allows a user with delegated users:update permission to change the global administrator's password without proper privilege checks, enabling complete takeover of the administrator account. The issue is resolved in version 2.6.0.
CVE-2026-17491 is a medium severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves improper privilege management where a remote authenticated attacker could bypass security restrictions due to incorrect enforcement of the ChrootDirectory configuration directive. The vulnerability has a CVSS score of 5.4, indicating a moderate impact on confidentiality and integrity without affecting availability.
IBM i versions 7.3, 7.4, 7.5, and 7.6 contain a vulnerability (CWE-269) that allows an authenticated attacker to elevate their privileges to QSECOFR/Root authority. This could enable the attacker to perform high-impact operations on the system without proper authorization. The vulnerability has a high severity with a CVSS score of 7.8.
The WP Compress – Instant Performance & Speed Optimization WordPress plugin contains a privilege escalation vulnerability in all versions up to and including 7.25.00. The flaw allows unauthenticated attackers to gain plugin-administrator-equivalent control by exploiting improper privilege management in the plugin's API key validation and settings update mechanism. Attackers can retrieve the API key without authentication via an exposed AJAX action and then use it to modify plugin settings arbitrarily, granting themselves elevated capabilities.
The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via `api_call('update_cc_details', ...)` before performing the local `username_exists()` collision check, and aborts without rolling back the remote rename when a collision is detected — leaving the remote ONTRAPORT contact renamed to an existing WordPress Administrator's login. On a subsequent login attempt, `user_login()` (hooked to `wp_authenticate`) authenticates against ONTRAPORT using the renamed login and the attacker's own password, resolves the local WordPress user row via `get_user_by('login', $username)` — which now selects the real Administrator's row — and calls `wp_set_password()` against that Administrator's user ID; because the `user_level != 10` guard only suppresses PilotPress's own cookie issuance rather than returning a `WP_Error` to core, WordPress proceeds to validate the newly-synchronized password and issues a full Administrator authentication cookie to the attacker. This makes it possible for authenticated attackers with Subscriber-level access and above — specifically any PilotPress member holding a valid ONTRAPORT contact and the Customer Center nonce — to fully take over an Administrator account.
The User Profile Builder plugin for WordPress versions up to 4.0.3 contains a privilege escalation vulnerability via the 'role' parameter in the user registration form. This flaw allows unauthenticated attackers to create a fully activated administrator account by submitting a crafted registration request with 'role=administrator' and confirming via email. Exploitation requires legacy form fields named 'role', email confirmation enabled, and open user registration. The vulnerability arises from insufficient validation of the role parameter in the activation handler.
The Theme My Login plugin for WordPress up to version 7.2.1 contains a critical privilege escalation vulnerability. This flaw allows unauthenticated attackers to change arbitrary users' passwords on multi-site setups due to improper validation of user identity before password updates. The vulnerability enables account takeover without requiring prior authentication.
The My Calendar – Accessible Event Manager WordPress plugin versions up to 3.8.7 contain a critical privilege escalation vulnerability. An unauthenticated attacker can inject a crafted shortcode via the public 'mcs' GET parameter, leading to arbitrary PHP function calls. This flaw allows overwriting the Administrator account credentials (user ID 1), granting full administrative access. The vulnerability is exploitable through the plugin's publicly accessible /my-calendar/ page by default upon activation.
The Nexter Extension plugin for WordPress up to version 4.7.11 contains a privilege escalation vulnerability. Authenticated users with Subscriber-level access or higher can exploit a flaw in the role switching feature to regain Administrator privileges if their account previously held that role and was demoted via a bulk role change. This occurs because the plugin does not verify nonces or capabilities in a specific handler and fails to clear stored administrator role metadata during bulk role changes.
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. WordPress plugin versions up to 1.2.78.6 contain a critical privilege escalation vulnerability. The flaw allows unauthenticated attackers to manipulate the subscribe_to_email_list endpoint by supplying crafted form_custom_field_mappings, enabling them to overwrite any WordPress user account password, including administrators. Exploitation requires a published WordPress User Registration opt-in form but no authentication or capability checks are needed to reach the vulnerable endpoint. This leads to full site compromise.
A privilege escalation vulnerability exists in the InstaWP Connect – 1-click WP Staging & Migration WordPress plugin in all versions up to and including 0.1.4.1. The flaw allows authenticated users with Subscriber-level access or higher to obtain the plaintext master API key due to improper privilege checks on the plugin's admin page. Using this key, attackers can generate a single-use login URL that grants administrator-level access, fully escalating their privileges. Exploitation requires the site to be connected to InstaWP and the attacker's role to be included in the plugin's Sync Tab Access list alongside the administrator role.
The Customer Email Verification for WooCommerce WordPress plugin (versions up to 3.3.0) contains a privilege escalation vulnerability when the 'Encoding method' is set to 'hashids'. This flaw allows unauthenticated attackers to brute-force a small activation code space to verify any unverified account, including administrators, by exploiting a weak token generation and lack of nonce or rate limiting in the verification handler.
CVE-2026-110724 is a vulnerability in Eclipse Connected Services Platform's api-gateway component up to version 1.7.3. The default rate-limit key resolver uses the leftmost element of the X-Forwarded-For header to identify clients, but this header value is not validated against trusted proxies. This allows an attacker to bypass rate limiting by supplying unique header values, effectively obtaining unlimited independent rate-limit buckets.