CVE-2026-17020: Authorization Bypass Through User-Controlled Key

The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user including a Subscriber or self-registered customer account to disclose...

CVE-2026-17018: Authorization Bypass Through User-Controlled Key

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

CVE-2026-16257: Improper Authentication

The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthenticated users through type juggling when the Arvow AI SEO Writer WordPress plugin before 1.5.4 has not been configured, allowi...

CVE-2026-15237: Missing Authorization

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid...

CVE-2026-14238: Improper Neutralization of Special Elements used in an SQL Command

The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection...

CVE-2026-18786: Improper Authentication

The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible f...

CVE-2026-17541: Exposure of Sensitive Information to an Unauthorized Actor

The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them...

Splunk Enterprise REST API Unauthenticated Access Code Execution

The vulnerability of the REST API interface implementation of the Splunk Enterprise platform for operational analysis is related to an incorrect limitation on the path name to the $SPLUNKHOME/etc/ directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access t...

Splunk Enterprise REST API Disclosure

The vulnerability of the REST API implementation of the Splunk Enterprise platform for operational analysis is related to insufficient protection of sensitive data when the |rest command is executed. Exploiting this vulnerability allows a malicious actor to disclose sensitive information by sendi...

PT-2026-69349

Name of the Vulnerable Software and Affected Versions MotoPress Hotel Booking WordPress plugin versions prior to 6.2.3 Description An issue exists where the software fails to perform authorization or ownership checks on a REST endpoint used to create payment records. This allows unauthenticated...

PT-2026-69374

Name of the Vulnerable Software and Affected Versions CheckView versions prior to 2.3.2 Description The plugin fails to restrict its REST API authentication filter to its own routes. It unconditionally discards authentication errors for any request where the URI contains a specific string related...

CVE-2026-17014

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing unauthenticated users to delete the generated album export ZIP archives it stores...

CVE-2026-16992

The Create WordPress plugin before 2.5.4 does not perform an authorization check before returning content over one of its REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to make it...

CVE-2026-17011

The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacement, content hiding, and UI redressing...

CVE-2026-18037 Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication

The Create WordPress plugin before 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to mak...

CVE-2026-18037 Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication

The Create WordPress plugin before 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to mak...

EUVD-2026-54876

The Create WordPress plugin before 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to mak...

CVE-2026-18037

The Create WordPress plugin (by Mediavine) versions prior to 2.5.4 is vulnerable to an authorization bypass. The root cause is a missing authorization check on a public REST API route , which allows unauthenticated attackers to read unpublished content . Furthermore, accessing this route triggers...

CVE-2026-17011 Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection

The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacement, content hiding, and UI redressing...

CVE-2026-16992 Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication

The Create WordPress plugin before 2.5.4 does not perform an authorization check before returning content over one of its REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to make it...