Threat database

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting post_id to valid post types. Authenticated attackers, including unprivileged Subscribers, can supply an arbitrary post_id for any course, lesson, or quiz to create a private message addressed to that post's author, bypassing the enrollment checks enforced by the newer REST send-message controller.

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_object_terms against courses owned by other teachers or administrators, enabling unauthorized modification of course content they do not own.

CVE-2026-40808 is a medium severity vulnerability in Automattic Jetpack VideoPress versions up to 3.6. It involves missing authorization controls, classified as CWE-862, which can lead to broken access control allowing unauthorized actions that impact integrity but not confidentiality or availability.

CVE-2026-106608 is a high-severity vulnerability in Automattic WooCommerce versions from 9.8.0 up to but not including 11.2.0. It involves incorrect privilege assignment that allows privilege escalation. The vulnerability has a CVSS 3.1 score of 7.2, indicating a significant impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. Patch status is not confirmed as no patch or vendor advisory is provided.

Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2.

CVE-2026-106602 is an authentication bypass vulnerability in Automattic Jetpack that allows password recovery exploitation. It affects Jetpack versions from initial releases up to, but not including, 16.3. The vulnerability has a medium severity rating with a CVSS score of 4.8. No known exploits are reported in the wild, and no official patch or vendor advisory is provided in the available data.

CVE-2026-66666 is a vulnerability in Automattic WordPress that allows insertion of sensitive information into sent data, potentially exposing embedded sensitive data. It affects multiple WordPress versions from 6.6 through 7.1.2. The vulnerability has a medium severity with a CVSS score of 6.9. No official patch or remediation details are provided in the available data.

CVE-2026-93485 is a high-severity cross-site scripting (XSS) vulnerability in Automattic WordPress that allows improper neutralization of input during web page generation, specifically a DOM-based XSS. It affects multiple WordPress versions up to and including 7.1. The vulnerability can lead to partial confidentiality, integrity, and availability impacts. No explicit patch or remediation details are provided in the input data.

Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS. This issue affects WooCommerce: from n/a before 11.1.0.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooCommerce allows Blind SQL Injection. This issue affects WooCommerce: from n/a before 11.0.

A prototype pollution vulnerability exists in Automattic's mongoose before versions 6.13.10, 7.8.10, 8.24.1, and 9.7.2. The issue arises when user-controlled updates with a __proto__.x dotted path under $set are passed to update functions, allowing modification of Object.prototype properties. This can affect application integrity and availability. The vulnerability has a CVSS score of 6.5 (medium severity).

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), and arrays do not trigger hasDollarKeys(), malicious operators such as $ne, $gt, or $regex could be injected inside a $nor clause without being sanitized. This vulnerability is fixed in 6.13.9, 7.8.9, 8.22.1, and 9.1.6.

The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Automattic Jetpack CRM zero-bs-crm allows PHP Local File Inclusion.This issue affects Jetpack CRM: from n/a through <= 6.7.0.

Missing Authorization vulnerability in Automattic WP Job Manager wp-job-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Manager: from n/a through <= 2.4.0.

Missing Authorization vulnerability in Automattic Crowdsignal Forms crowdsignal-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crowdsignal Forms: from n/a through <= 1.7.2.

A vulnerability in WooCommerce 8.1 to 10.4.2 can allow logged-in customers to access order data of guest customers on sites with a certain configuration. This has been fixed in WooCommerce 10.4.3, as well as all the previously affected versions through point releases, starting from 8.1, where it has been fixed in 8.1.3. It does not affect WooCommerce 8.0 or earlier.

CVE-2023-7320 is a medium-severity vulnerability in the WooCommerce plugin for WordPress, affecting all versions up to 7.8.2. It arises from improper Cross-Origin Resource Sharing (CORS) configuration on the Store API's REST endpoints, allowing unauthenticated external actors to access sensitive user information, including personally identifiable information (PII). The vulnerability does not require authentication or user interaction and can be exploited remotely over the network. Although no known exploits are currently reported in the wild, the exposure of sensitive data poses privacy risks and potential regulatory compliance issues, especially under GDPR in Europe. Organizations using WooCommerce should prioritize patching or mitigating this issue to prevent unauthorized data disclosure. Countries with high WooCommerce adoption and strict data protection laws are most at risk. Practical mitigations include restricting CORS policies, monitoring API access logs, and applying updates once available.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce woocommerce allows Stored XSS.This issue affects WooCommerce: from n/a through <= 10.0.2.