Threat Intelligence Database

The ilGhera Reviso Exporter for WooCommerce plugin for WordPress has a vulnerability in versions up to and including 1.2.3 where a missing authorization check allows authenticated users with Subscriber-level access or higher to delete the stored Agreement Grant Token. This token is used to authenticate API calls between WooCommerce and the Reviso service. The vulnerability arises from the disconnect_callback() function, which lacks capability and nonce verification and is triggered via an AJAX action. Exploitation results in breaking the connection between WooCommerce and Reviso by removing the token.

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin versions up to 3.12.13 suffer from a missing authorization vulnerability. The plugin registers an AJAX action accessible to unauthenticated users without nonce verification or capability checks. This flaw allows attackers to add arbitrary WooCommerce products to a cart at discounted prices configured on any funnel step, enabling price manipulation and potential revenue loss.

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services WordPress plugin versions up to and including 8.7.3 contain a stored cross-site scripting (XSS) vulnerability via the 'conversation' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users access the affected pages. The nonce intended to protect this action is ineffective as it is localized into every public-facing page, failing to restrict unauthenticated access.

The Next-Cart Store to WooCommerce Migration WordPress plugin contains an authentication bypass vulnerability in all versions up to 3.9.8. This occurs because the plugin's REST API endpoint /wp-json/next_cart/v1/migration uses a permission callback that always returns true and relies on a hardcoded fallback token '__token__' if the token option is not set. This allows unauthenticated attackers to bypass authentication, execute arbitrary SQL commands including creating administrator accounts, and delete arbitrary files, potentially leading to full site takeover.

WP Recipe Maker plugin for WordPress up to version 10.8.0 contains an authorization bypass vulnerability. Authenticated users with contributor-level access or higher can take ownership of admin-authored recipes or unpublish them by exploiting improper authorization checks. Ownership transfer requires a specific plugin setting ('recipe_use_author' set to 'parent'), but unpublishing is possible regardless of this setting. The vulnerability has a medium severity rating with a CVSS score of 4.3.

The Awesome Support WordPress plugin up to version 6.3.9 has a missing authorization vulnerability (CWE-862) in the wpas_do_mr_deny_user() function. This flaw allows authenticated users with subscriber-level access or higher to set a denial flag on any user account, including administrators, without proper capability checks. This results in permanently blocking the targeted user's moderated activation and sending a denial notification email to them.

CVE-2026-87737 is a timing side-channel vulnerability in the mirage-crypto-ec package for OCaml, affecting versions before 2.4.0. The issue arises from the time required for a lookup during NIST elliptic-curve scalar multiplication depending on a secret value, potentially leaking sensitive information. The vulnerability has a medium severity with a CVSS score of 5.9.

CVE-2026-87736 is a medium severity vulnerability in the mirage-crypto-ec package for OCaml, affecting versions before 2.3.0. It involves an out-of-bounds read when processing compressed elliptic curve public keys. This flaw does not impact confidentiality or integrity but can cause availability issues such as application crashes.

CVE-2026-87735 is a medium severity vulnerability in the mirage-crypto-pk package for OCaml versions before 2.3.0. It involves an undocumented exception triggered by a small message during RSA encryption or decryption. This improper validation of the specified quantity in input may cause availability issues but does not impact confidentiality or integrity.

CVE-2026-87734 is a high-severity vulnerability in the OCaml utcp package before version 0.0.6. It involves improper restriction of communication channels, specifically out-of-order segment reassembly, which can be exploited remotely to cause a denial of service (DoS). No patch or official remediation has been confirmed yet. There are no known exploits in the wild at this time.