CVE-2026-59797 is a critical Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl module, specifically involving SSLRequire and file-related expressions. It affects versions from 2.4.0 through 2.4.68. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability if exploited.
The WPC Shop as a Customer for WooCommerce WordPress plugin contains a privilege escalation vulnerability allowing authenticated users to impersonate any Administrator without needing their password. This affects all versions up to and including 2.0.0. The flaw arises from improper validation of the target user's role before issuing a new authentication session, enabling session takeover and full Administrator access.
ByteCoreStack – MCP Connector for AI Tools plugin for WordPress versions up to 1.2.3 contains a privilege escalation vulnerability. Authenticated users with Subscriber-level access or higher can exploit improper privilege management in the wp_update_user_meta MCP tool to elevate their privileges to Administrator by modifying unprotected meta keys such as wp_capabilities. This vulnerability arises from insufficient gating of meta key writes and an incomplete meta key blocklist.
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function whitelisting the client-submitted 'role' key and copying it into the user-data array that is passed directly to wp_insert_user(), without validating the submitted role against the administrator-configured register_user_role, without an allow-list, and without any current_user_can() capability check. This makes it possible for unauthenticated attackers to register a new account with the Administrator role by injecting role=administrator into the data submitted to any published Super Forms registration form (register_login_action='register').
An improper privilege management vulnerability in Genian SSL PNS allows an attacker to escalate to super administrator privileges and force the creation of an OS account by manipulating the permission column during CSV bulk user registration
CVE-2026-102112 is a privilege escalation vulnerability in Kiteworks Core that allows an attacker with existing code execution as an unprivileged backend service account to escalate privileges to root and execute arbitrary commands with highest privileges. Exploitation requires local access to the service account. The vulnerability is due to improper neutralization of special elements used in OS commands (CWE-78).
CVE-2026-102113 is a privilege escalation vulnerability in Kiteworks Core that allows an attacker with local access as an unprivileged backend service account to escalate privileges to root. The issue arises from improper handling of filesystem paths by a privileged routine, enabling arbitrary command execution with root privileges. Exploitation requires prior code execution under the lower-privileged service account. The vulnerability affects Kiteworks Core versions prior to 9.5.0.
CVE-2026-102120 is a high-severity OS command injection vulnerability in Kiteworks Core affecting versions before 9.5.1. It allows an attacker with existing code execution on one cluster node to escalate privileges and execute OS commands on other nodes within the same cluster. The flaw arises from insufficient input validation in an internal cluster management function, which is not accessible externally and requires prior node access.
CVE-2026-102141 is a vulnerability in Kiteworks Core cluster-management operations where file paths supplied were not validated. This allows an attacker with root access on one cluster node to write files as root onto another node, potentially causing execution there. Exploitation requires high privileges (root) on a backend node and the presence of a pending software patch on the target node. The vulnerability affects Kiteworks Core versions prior to 9.5.1.
Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-management permissions to elevate another user to full system-administrator privileges beyond those the administrative user was authorized to grant.
Reachy Mini Wireless OS images prior to version 0.2.4 contain a local privilege escalation vulnerability due to an overly broad sudoers entry. The pollen daemon user (uid 1000) has passwordless sudo access to /usr/bin/systemctl without restrictions, allowing any process running as pollen to gain full root privileges. This issue has been patched in version 0.2.4.
CVE-2026-75823 is a high-severity vulnerability in the User Frontend WordPress plugin before version 4.3.12. It allows unauthenticated users to manipulate the role assigned during registration, enabling them to gain elevated privileges such as the Editor role. This issue occurs only when the PHP sodium extension is unavailable and a registration page is configured. The Administrator role cannot be obtained through this vulnerability.
CVE-2026-86556 is an information disclosure vulnerability in the ZTE U30 Air device caused by improper privilege management. This flaw allows attackers to obtain sensitive information due to insufficient permission controls. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity level. No specific affected versions or patches are currently identified. There is no evidence of exploitation in the wild at this time.
CVE-2026-102710 is a high-severity vulnerability in Eclipse ThreadX versions 6.0.1 through 6.5.2.202603 when built with TX_ENABLE_EVENT_TRACE. It allows a user-mode, memory-protected module to register an arbitrary function pointer as the kernel's trace-buffer-full callback. This callback is invoked by privileged kernel code when the trace buffer wraps, enabling a malicious module to execute code with kernel privileges or cause a kernel fault by using an invalid pointer. This defeats module isolation and compromises system integrity.
Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially execute commands as root on the DDI Central host.
CVE-2026-89001 is a vulnerability in the WPeMatico RSS Feed Fetcher WordPress plugin prior to version 2.8.27. It allows users with contributor-level access or higher to publish posts live and assign any registered user, including administrators, as the post author without proper permission checks. This improper privilege management can lead to unauthorized content publication and misattribution of posts.
The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.6.0. This is due to the groups_join() function deriving group-join eligibility from the ambient post's author capabilities via the global $post->post_author rather than from the currently authenticated user's own capabilities, while simultaneously minting and returning a valid groups-join-data hash and WordPress nonce for the caller in the same response — eliminating all authorization barriers to self-enrollment. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enroll themselves into any group including privileged groups carrying the groups_admin_groups capability, and to subsequently create and join a group containing every registered WordPress capability, effectively escalating their privileges to Administrator. Exploitation requires the attacker to supply an Administrator-authored post ID via the post_ID parameter of the authenticated wp_ajax_parse_media_shortcode handler in order to establish the privileged ambient post context used by the flawed authorization check.
Capgo CLI versions up to 7.98.2 have an improper privilege management vulnerability in the Android onboarding flow. The CLI assigns a Google Play service account overly broad permissions (CAN_MANAGE_DRAFT_APPS_GLOBAL) at the developer account level instead of restricting it to a single app with release-only permissions. This discrepancy allows anyone with access to the service account key to manage draft apps across the entire Google Play developer account. No patch was available at the time of publication.