CWE-266 vulnerabilities

Unauthenticated Privilege Escalation in Support Board < 3.8.9 versions.

Customer Privilege Escalation in Dokan <= 5.0.2 versions.

Unauthenticated Privilege Escalation in Listdom <= 5.5.0 versions.

Subscriber Privilege Escalation in Amelia <= 2.3 versions.

Unauthenticated Privilege Escalation in WP BASE Booking <= 5.9.0 versions.

CVE-2026-39583 is a critical vulnerability in Datalogics Ecommerce Delivery versions up to and including 2.6.62 that allows unauthenticated privilege escalation. This means an attacker can gain elevated privileges without authentication, potentially leading to full system compromise. The vulnerability is categorized under CWE-266, indicating incorrect privilege assignment. No official patch or remediation guidance is currently available from the vendor.

Contributor Privilege Escalation in B Blocks <= 2.0.31 versions.

A high-severity privilege escalation vulnerability exists in Brainstorm Force WooCommerce Cart Abandonment Recovery versions prior to 2.1.0. This flaw allows shop managers to gain elevated privileges improperly due to incorrect privilege assignment. The vulnerability is tracked as CVE-2026-39470 and is categorized under CWE-266.

CVE-2026-34901 is a critical vulnerability in Paul iControlWP versions up to and including 5.5.3 that allows unauthenticated privilege escalation. This means an attacker can gain elevated privileges without authentication. The vulnerability is categorized under CWE-266, indicating incorrect privilege assignment. No official patch or remediation guidance is currently provided by the vendor.

CVE-2026-27407 is a high-severity vulnerability in Meow Apps AI Engine versions up to and including 3.4.9. It involves incorrect privilege assignment that allows an editor-level user to escalate privileges. This vulnerability can lead to full compromise of confidentiality, integrity, and availability of the affected system. No official patch or remediation guidance has been provided yet.

CVE-2026-49111 is an Incorrect Privilege Assignment vulnerability in ThemeGrill Masteriyo - LMS that allows privilege escalation. It affects all versions up to and including 2.2.0. The vulnerability has a high severity with a CVSS score of 8.8, indicating it can lead to complete confidentiality, integrity, and availability impact without user interaction. No official patch or remediation guidance is currently available from the vendor.

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.

Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows Privilege Escalation. This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.9.4.

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a user with Manage Server / ManageGuild, but without Manage Roles or Administrator, can configure the bot’s AutoRole feature to assign an arbitrary role to new members. If the selected role has Administrator and is below the bot’s highest role, the attacker can join with a controlled account and receive full server admin. This issue has been patched in version 1.0.3.

Improper authorization in .NET allows an authorized attacker to elevate privileges locally.

Incorrect Privilege Assignment vulnerability in Mojoomla School Management allows Privilege Escalation. This issue affects School Management: from n/a through 93.2.0.

Incorrect Privilege Assignment vulnerability in Themeisle Masteriyo LMS PRO allows Privilege Escalation. This issue affects Masteriyo LMS PRO: from n/a through 2.20.0.

Incorrect Privilege Assignment vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery Pro allows Privilege Escalation. This issue affects Contest Gallery Pro: from n/a through 29.0.1.

Incorrect Privilege Assignment vulnerability in Sergey AIWU allows Privilege Escalation. This issue affects AIWU: from n/a through 1.4.17.