The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacement, content hiding, and UI redressing.
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, header signature verification counts the unused padding bits of the PubKeysBitmap toward the two-thirds validator quorum. These padding bits do not correspond to any validator and are ignored by the actual BLS aggregate-signature check, so a malicious or compromised block producer can set them to reach the required quorum while gathering fewer genuine validator signatures than the protocol demands. As a result, nodes that import or intercept the header accept it as correctly signed without a real two-thirds quorum, weakening consensus safety and undermining finality. This issue is fixed in version 1.7.20.
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, the `$import-pnp` operation in Pathling Server accepts a caller-supplied `exportUrl` and uses it as the remote FHIR Bulk Export endpoint without constraining it to a trusted source. When PNP credentials are configured, Pathling builds a credentialed bulk-export client targeting the caller-chosen host, downloads manifest-selected files, and then reclassifies those staged files as trusted local `file://` imports - bypassing the configured `allowableSources` allowlist that protects the ordinary `$import` operation. This is fixed in Pathling Server 2.0.0. As a workaround, disable the `$import-pnp` operation (`pathling.operations.importPnpEnabled=false`) or do not configure PNP credentials.
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin versions prior to 1.42.0 contains a vulnerability where its Turnstile validation cache is not properly bound to the single-use challenge token. This allows unauthenticated attackers to solve one CAPTCHA challenge and then replay token-less form submissions within a short time window, bypassing the anti-abuse protection. The vulnerability is identified as CWE-345: Insufficient Verification of Data Authenticity. A patch is available to address this issue.
CVE-2026-15211 is a medium severity vulnerability in the Subscriptions for WooCommerce WordPress plugin before version 2.0.1. The plugin fails to validate the payment amount or bind the PayPal order token to the specific WooCommerce order during the order completion process. This flaw allows an unauthenticated attacker, when guest checkout is enabled, to substitute an approved but uncaptured PayPal order token and have an expensive order marked as paid without actually paying the required amount.
WP Events Manager plugin versions before 2.2.5 contain a vulnerability where payment notifications are not properly verified. This allows unauthenticated users to mark bookings as paid without actual payment, including bookings of other users. The flaw is due to insufficient verification of data authenticity in payment notifications.
RegistrationMagic WordPress plugin versions before 6.0.9.5 have a vulnerability where the server-side verification of PayPal payment captures only checks if the capture status is COMPLETED. It does not verify the amount, currency, payee, or whether the capture has been previously used. This allows an unauthenticated attacker to finalize paid registrations using low-value completed captures and replay a single capture across multiple registrations.
The Five Star Restaurant Reservations WordPress plugin before version 2.7.23 has a vulnerability where it does not verify the authenticity of incoming payment notifications. This flaw allows unauthenticated attackers to mark arbitrary pending reservations as paid and confirmed without validating the payment recipient, amount, status, or binding the notification to the intended booking.
A vulnerability in the Simple Membership WordPress plugin before version 4.7.7 allows unauthenticated users to activate or extend memberships by exploiting insufficient verification of PayPal payment notifications. The plugin does not confirm that the payment notification was sent to the site's configured merchant account, enabling attackers to use payments made to arbitrary PayPal accounts they control.
CVE-2026-19127 is a medium severity vulnerability in GitroomHQ's postiz-app affecting the billing and license activation subsystem. It allows remote attackers to bypass payment authorization by exploiting weak cryptographic validation or missing server-side state checks on promotional or lifetime-deal redemption codes. This enables unauthenticated attackers to forge or replay redemption tokens to activate the highest-tier paid subscriptions without payment.
A vulnerability in the GetPaid WordPress plugin before version 2.8.55 allows unauthenticated attackers to forge Worldpay payment notifications. This flaw results from insufficient verification of data authenticity, enabling attackers to mark pending invoices as paid without actual payment.
WP Travel Engine WordPress plugin versions before 6.8.2 contain a vulnerability where PayPal payment notifications are not properly verified. This allows attackers to mark bookings as paid by sending payment notifications to an attacker-controlled account without authenticating the payment or verifying the amount.
CVE-2026-15152 is a vulnerability in the WP Hotel Booking WordPress plugin before version 2.3.2. The plugin fails to verify that payment notifications correspond to payments made to the site's own merchant account and does not confirm that the paid amount matches the booking total. This flaw allows unauthenticated users to have their bookings marked as fully paid without any actual payment reaching the site owner.
The Payment Gateway for Redsys & WooCommerce Lite WordPress plugin versions before 7.0.2 contains a vulnerability where it does not verify the authenticity of incoming payment-provider notifications. This flaw allows unauthenticated attackers to forge payment-confirmation callbacks and mark orders as paid without actual payment. The vulnerability is identified as CWE-345 (Insufficient Verification of Data Authenticity) and has a CVSS 3.1 score of 7.5, indicating high severity.
CVE-2026-11361 is a vulnerability in the Formidable Forms WordPress plugin prior to version 6.32.1. It allows unauthenticated users to bypass payment verification for PayPal subscription payments, enabling them to trigger paid form actions such as accessing digital content, receiving licenses, or activating memberships without completing payment.
The Integrate PhonePe with WooCommerce WordPress plugin up to version 1.2.1 contains an authorization bypass vulnerability. It fails to verify that a payment transaction belongs to the order being marked as paid and does not authenticate payment-completion requests. This allows unauthenticated attackers to reuse a valid transaction to mark arbitrary orders as paid, bypassing payment requirements.
The RealHomes Memberships WordPress plugin versions before 3.1.0 contain a vulnerability where the plugin does not verify that a membership payment has actually completed, nor does it check a nonce or the user's capability before granting paid membership packages. This allows any authenticated user, including those with low privileges such as Subscribers, to obtain paid membership packages without payment.
Apache CXF contains a vulnerability in its JwtRequestCodeFilter where security-sensitive parameters from a signed JWT are copied into the authorization parameter map without proper exclusion. This allows an attacker who can produce a validly-signed JWT (for example, if the client_secret is compromised) to substitute critical parameters such as code_challenge, code_challenge_method, nonce, and state, undermining PKCE integrity and OpenID Connect replay protection. Fixed versions 4.2.3, 4.1.8, and 3.6.12 address this issue.
Apache CXF versions prior to 4.2.3, 4.1.8, and 3.6.12 contain a vulnerability in the OIDC relying-party token validation process. This flaw allows acceptance of self-issued ID tokens without enforcing critical claim checks such as issuer, subject, audience, time, and sub_jwk binding, potentially enabling authentication bypass with crafted tokens. By default, self-issued ID tokens are not accepted, mitigating some risk. Upgrading to versions 4.2.3, 4.1.8, or 3.6.12 addresses this issue.
CVE-2026-11836 is a low-severity vulnerability in Caliptra Core ROM and Core Firmware that involves insufficient verification of data authenticity in the validate_debug_unlock_token() function. An attacker with access to the integrator's debug unlock signing service can unlock production debug on unintended devices within a set sharing the same debug unlock key hash. The vulnerability does not allow unlocking devices outside this set due to a 384-bit challenge nonce that prevents replay attacks. Affected versions include Core ROM 2.0.0 through 2.0.2 and 2.1.0 through 2.1.1, and Core Firmware 2.0.0 through 2.0.1 and 2.1.0. No patch or official remediation is currently documented.