Threat Intelligence Database

The AutomatorWP plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 5.8.4. This flaw allows authenticated users with subscriber-level access or higher to retrieve the site's Campaign Monitor mailing list catalog, which should be restricted to users with manager capabilities. The vulnerability arises because the plugin does not properly verify user authorization and exposes a required nonce on all WordPress admin pages, enabling low-privilege users to exploit it without elevated access.

The AutomatorWP plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 5.8.4. Authenticated users with subscriber-level access or higher can exploit this flaw to retrieve ConvertKit form data intended only for plugin managers. The vulnerability arises because the plugin does not properly verify user authorization before allowing access to this data. The required nonce for verification is exposed on all admin pages, making it accessible to any authenticated user who can access the WordPress admin area.

Themify Builder plugin for WordPress up to version 7.8.0 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to modify styling data of arbitrary posts, including private and draft posts, by exploiting improper authorization checks. The vulnerability arises because a required nonce is exposed on all frontend pages, enabling attackers to obtain a valid nonce and bypass access controls.

The WPeMatico RSS Feed Fetcher plugin for WordPress contains a privilege escalation vulnerability due to a missing capability check in the wpematico_import_settings function. Authenticated users with subscriber-level access or higher can exploit this flaw to modify arbitrary site options, including changing the default user role to administrator and enabling user registration. This allows attackers to gain administrative access to the WordPress site. The vulnerability affects all versions up to and including 2.8.24. No official patch or remediation guidance has been provided yet.

Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys. The FETCH, EXISTS and DELETE methods throw an exception when on malformed regular expressions. Each method falls back to a regex match when the key is not already stored in the hash, compiling the caller's key with a bare qr// and no eval guard. A key that is not a valid regular expression pattern, such as a single unmatched bracket, dies. An application that looks up externally supplied strings in a tied hash will die on an invalid key.

ThreatFox IOCs for 2026-08-21

CVE-2026-73323 is a reserved CVE identifier that has been rejected and does not correspond to a confirmed vulnerability. There is no technical description, CVSS score, or remediation information available.

FORT Validator versions through 1.6.7 have an origin validation error in their RRDP processing that allows a delegated CA under the same Trust Anchor Locator to reference a victim CA’s RRDP URLs. This can cause the victim’s local snapshot to be deleted silently, removing validated route-origin data and potentially enabling route hijacking or loss of reachability. Version 1.6.8 includes a patch that rejects cross-origin RRDP snapshot and delta URLs. As a workaround, administrators can disable HTTP/RRDP while keeping rsync enabled, though this may cause data unavailability or staleness where rsync is unsupported.

CVE-2026-34949 is a vulnerability in Combodo iTop, a web-based IT service management tool. Prior to version 3.2.3, an unauthenticated user could delete the .readonly file, which is created during setup to prevent write actions. This deletion could allow unauthorized modification of the system. The issue has been fixed in version 3.2.3.

Combodo iTop versions prior to 3.2.3 have a vulnerability where only classes present in the SELECT clause are protected by the silos access check in OQL queries. This can lead to exposure of sensitive information to unauthorized actors. The issue is fixed in version 3.2.3.