CVE-2026-86832

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API...

CVE-2026-86832 MetForm < 4.3.1 - Unauthenticated Form Entry Data Disclosure via REST API

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API...

CVE-2026-86832 MetForm < 4.3.1 - Unauthenticated Form Entry Data Disclosure via REST API

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API...

CVE-2026-86832

The MetForm WordPress plugin, specifically versions before 4.3.1 , contains a vulnerability where it fails to properly restrict access to form submission data. This flaw allows unauthenticated attackers to view sensitive submitter information via the REST API . Exploitation details are not provid...

EUVD-2026-91939

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API...

[SECURITY] Fedora 45 Update: rest-0.10.2-13.fc45

This library was designed to make it easier to access web services that claim to be "RESTful". A RESTful service should have urls that represent remote objects, which methods can then be called on. The majority of services don't actually adhere to this strict definition. Instead, their RESTful en...

PT-2026-104525

Name of the Vulnerable Software and Affected Versions MetForm WordPress plugin versions prior to 4.3.1 Description Insufficient access restrictions to form submission data allow unauthenticated attackers to view submitter information via the REST API. Recommendations Update MetForm WordPress plug...

PT-2026-104581

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description An authorization bypass exists in the sessions REST endpoint query operation. This issue allows users with delegated RealmAdmin privileges to list sessions across different realms by supplying a...

CVE-2026-86832: Exposure of Sensitive Information to an Unauthorized Actor

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API...

CVE-2026-105120: Exposure of Sensitive Information to an Unauthorized Actor

OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessions of every realm. Attackers holding delegated RealmAdmin privileges can supply a queryFilter naming another realm to disclose usernames...

CVE-2026-104991

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints singleget, singlecomments, singlecommentspost that allows authenticated API key holders to bypass the security.restrictaccess confidentiality control by never invoking the allowAcces...

EUVD-2026-91776

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints singleget, singlecomments, singlecommentspost that allows authenticated API key holders to bypass the security.restrictaccess confidentiality control by never invoking the allowAcces...

CVE-2026-104991

Phproject versions prior to 1.8.7 are affected by a missing object-level authorization vulnerability within the REST API issue endpoints, specifically single_get, single_comments, and single_comments_post. The root cause is the failure to invoke the allowAccess() authorization routine, allowing a...

CVE-2026-104991 Phproject < 1.8.7 Missing Authorization via Issues REST API

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints singleget, singlecomments, singlecommentspost that allows authenticated API key holders to bypass the security.restrictaccess confidentiality control by never invoking the allowAcces...

CVE-2026-104991 Phproject < 1.8.7 Missing Authorization via Issues REST API

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints singleget, singlecomments, singlecommentspost that allows authenticated API key holders to bypass the security.restrictaccess confidentiality control by never invoking the allowAcces...

CVE-2026-104991 Phproject < 1.8.7 Missing Authorization via Issues REST API

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints singleget, singlecomments, singlecommentspost that allows authenticated API key holders to bypass the security.restrictaccess confidentiality control by never invoking the allowAcces...

wp2shell-PoC

wp2shell-PoC ⚠ This tool is created solely for educational or bug bounty purpose only. Unauthorized use outside of controlled environments is strictly prohibited. Overview Proof-of-concept for the wp2shell vulnerability chain affecting WordPress Core, combining CVE-2026-63030 and CVE-2026-60137...

CVE-2026-90952

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide...

CVE-2026-90952

The WP Edit Password Protected WordPress plugin, versions 2.0.0 through 2.0.6 , contains a vulnerability where it fails to enforce site-wide access restrictions on the WordPress REST API . This flaw allows unauthenticated users to read the content of published posts and pages that were specifical...

EUVD-2026-91212

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide...