Threat database

CVE-2026-42638 is a missing authorization vulnerability in Awesomemotive Easy Digital Downloads affecting versions before 3.7.1.1. It allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a high severity score of 7.5 and does not require user interaction or privileges to exploit. No official patch or vendor advisory is currently provided.

Envira Photo Gallery versions up to and including 1.12.5 contain a vulnerability classified as CWE-862 Missing Authorization. This flaw allows unauthenticated users to bypass access controls, potentially leading to unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 6.5. No official patch or remediation guidance has been provided by the vendor as of the publication date.

CVE-2026-48835 is a high-severity vulnerability in Contact Form by WPForms versions up to and including 1.10.0.4. It involves unauthenticated broken access control, classified as CWE-862 Missing Authorization, allowing unauthorized users to perform actions that should require authorization.

Easy Digital Downloads versions up to and including 3.6.5 contain a vulnerability classified as missing authorization (CWE-862) that allows unauthenticated users to bypass access controls. This vulnerability can lead to unauthorized actions that impact the integrity of the system. The issue is rated with a high severity and a CVSS score of 7.5. No official patch or remediation guidance has been provided yet by the vendor.

NextGEN Gallery version prior to 4.2.1 are vulnerable to authenticated SQL injection via the 'orderby' parameter on the REST API endpoints '/imagely/v1/galleries' and '/imagely/v1/albums'. The root cause is an insufficient sanitization function ('_clean_column()') in the data mapper layer that uses a character blacklist instead of a whitelist approach. This allows an authenticated attacker with the 'NextGEN Gallery overview' capability (assigned to the Administrator role by default) to inject arbitrary SQL into the 'ORDER BY' clause.