Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, contain an authorization flaw in forest-management operations. This flaw allows a remote attacker with forest-management privileges to create a persistent unauthorized administrator account, potentially gaining full administrative control of the server. The vulnerability is rated critical with a CVSS score of 9.9.
CVE-2026-21123 is a medium severity vulnerability in Samsung Mobile Devices involving improper privilege management in the Locksettings component. It affects devices prior to the SMR Oct-2026 Release 1. Local attackers with root privileges can access data of the tied profile before the device's first unlock. The vulnerability does not require user interaction and has a low attack complexity. No known exploits are reported in the wild.
The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, leading to a full site takeover.
The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site.
The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress plugin before 1.16.2 code before processing its setup-wizard Envira Gallery WordPress plugin before 1.16.2-installation request, and does not restrict the installation to its own curated list, allowing a Multisite subsite Administrator to install an arbitrary WordPress.org-published Envira Gallery WordPress plugin before 1.16.2 into the network-shared Envira Gallery WordPress plugin before 1.16.2 directory, a privilege Multisite reserves for the network Super Admin.
The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role.
CVE-2026-108506 is a medium severity vulnerability in the ZTE Z80 Ultra device involving improper privilege management. The system interfaces lack robust authentication and have inadequate access control, allowing third-party applications to invoke these interfaces via reflection and potentially retrieve sensitive information. There is no indication of a patch or fix available at this time.
ZTE Z80 Ultra contains a local information disclosure vulnerability due to improper privilege management. This flaw allows third-party applications to capture data returned by system interfaces, potentially exposing device-related information. The vulnerability has a low severity rating and does not impact integrity or availability.
CVE-2026-108504 is an unauthorized information disclosure vulnerability in the ZTE Z80 Ultra device. The issue arises from insufficient access control on methods within the device's framework, allowing an attacker to read sensitive device-related information. The vulnerability has a medium severity with a CVSS score of 5.5. No specific affected versions or patches are currently documented.
ZTE Z80 Ultra has an information disclosure vulnerability due to improper privilege management. This flaw allows third-party applications to read sensitive information by hooking system APIs. The vulnerability has a low severity score and does not affect system integrity or availability.
A privilege management vulnerability exists in the SMS Alert WordPress plugin versions 3.9.6 up to but not including 4.0.3. The flaw allows unauthenticated attackers to reset the password of any account, including administrators, by verifying a one-time password (OTP) sent to a phone number they control, without properly binding the account to the verified phone number.
Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress versions up to 4.8.3 contains a privilege escalation vulnerability via the create_support_user() function. This flaw allows an attacker who controls an account with specific hardcoded credentials to be silently promoted to administrator or super admin on multisite setups. Exploitation requires that an attacker first obtain or create such an account, then a legitimate administrator must trigger the support-access feature to activate the privilege escalation.
The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress contains a privilege escalation vulnerability affecting all versions up to and including 1.43.0. The flaw allows authenticated users with Cashier-level access or higher to change arbitrary users' email addresses without proper identity validation. This can lead to account takeover by resetting passwords of targeted users, including administrators.
Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress versions up to and including 4.9 contains a privilege escalation vulnerability. Authenticated users with the edit_contacts capability can reassign contact records to arbitrary WordPress user IDs without requiring higher privileges. This allows attackers with sales_rep-level access to escalate to administrator by exploiting the auto-login link feature tied to contact notes.
The Appointment Booking Plugin – LatePoint for WordPress suffers from an improper privilege management vulnerability allowing privilege escalation. Authenticated users with the 'settings__edit' capability can manipulate the default WordPress role assigned to new customers, potentially setting it to 'administrator'. This enables newly registered LatePoint customer accounts to gain full administrator privileges. The issue affects all versions up to and including 5.7.3. Exploitation requires prior capability assignment by a WordPress administrator and subsequent new customer registration through LatePoint.
CVE-2026-108501 is a medium severity vulnerability in the ZTE Z80 Ultra device involving improper privilege management. The system interface lacks necessary permission verification, allowing reflective invocation to read sensitive information without proper access control. This vulnerability does not impact integrity or availability but can lead to unauthorized disclosure of confidential data.
The Blocksy Companion WordPress plugin contains a critical privilege escalation vulnerability in versions up to and including 2.1.58. This flaw allows unauthenticated attackers to bypass Dokan's vendor-registration nonce check and specify arbitrary roles during user registration, enabling them to escalate privileges to a Dokan 'seller' (vendor) account. The vulnerability also automatically authenticates the attacker into the elevated account, granting publishing capabilities beyond those of a normal customer.
The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning WordPress plugin up to version 4.0.3 contains a privilege escalation vulnerability. Authenticated users with the 'academy_guardian' role or higher can exploit improper privilege management to elevate any existing WordPress account to the 'academy_student' role. This role grants additional capabilities such as 'edit_posts' and, if enabled, 'upload_files'. The vulnerability arises because the plugin assigns the 'academy_student' role before validating the guardian-ward relationship and does not revert this assignment if validation fails.
Vikunja version 2.3.0 contains an improper privilege management vulnerability where a scoped API token limited to the oauth.authorize permission can be used to obtain a bearer JWT and refresh token without scope restrictions. This allows access to API routes beyond the token's original permissions. The issue is fixed in version 2.4.0.