CVE-2026-77003

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...

CVE-2026-14853 WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing Authorization

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...

CVE-2026-14853

WooCommerce Bookings (WordPress plugin) versions before 3.9.0 contain an authorization flaw: one of its AJAX actions lacks a capability check , and the associated nonce check can be bypassed by simply omitting the token. This allows any authenticated user with Subscriber-level access or above to ...

EUVD-2026-64605

The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the restendpoints filter via secureuserendpoints and...

CVE-2026-16149

The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the restendpoints filter via secureuserendpoints and...

SUSE CVE-2026-74595

In the Linux kernel, the following vulnerability has been resolved: fscrypt: use the mount idmap for the owner check in fscryptioctlsetpolicy fscryptioctlsetpolicy calls inodeownerorcapable with &nopmntidmap before allowing an encryption policy to be set, instead of the idmap of the mount the ioc...

PT-2026-79784

A vulnerability was found in code-projects Barangay Resident Profiling Management System 1.0. This impacts an unknown function of the file /archived records.php of the component Restore/Delete. The manipulation of the argument resident id results in authorization bypass. The attack may be launche...

PT-2026-79786

A vulnerability was identified in code-projects Barangay Resident Profiling Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /boarders.php of the component Boarder Management Module. Such manipulation of the argument ID leads to authorization bypass. T...

PT-2026-79766

A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /admin/edit user account.php of the component User Account Update. Such manipulation of the argument id/username leads to improper authorization. The attack may be...

CVE-2026-16149

Security Hardener for WordPress (all versions up to and including 2.4.4 ) contains a Missing Authorization flaw in its user-enumeration protection feature. The plugin's secure_user_endpoints() function hooks the rest_endpoints filter and overwrites the permission_callback on both /wp/v2/users and...

CVE-2026-16149 Security Hardener <= 2.4.4 - Authenticated (Subscriber+) Privilege Escalation via REST API '/wp/v2/users' permission_callback Overwrite

The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the restendpoints filter via secureuserendpoints and...

CVE-2026-74676

In the Linux kernel, the following vulnerability has been resolved: vt: add permission check for KDSKBMETA ioctl KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vtkioctl enforce, allowing a process to change meta mode on a non-controlling...

CVE-2026-74595

CVE-2026-74595 is an access control flaw in the Linux kernel's fscrypt component. The function fscrypt_ioctl_set_policy() incorrectly uses &nop_mnt_idmap instead of the actual mount's idmap when performing the owner check via inode_owner_or_capable(). On filesystems that support idmapped mounts (...

CVE-2026-5093

The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspbupdateglobalwpsettings' function that only verifies the 'editposts' capability...

EUVD-2026-64298

The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspbupdateglobalwpsettings' function that only verifies the 'editposts' capability...

CVE-2026-62382

PasswordPusher versions v1.45.11 through v2.9.5 contain an improper authorization vulnerability in the push deletion logic. The ownership check compares @push.user against currentuser; for an anonymously created push both values are nil, and Ruby evaluates nil == nil as true, so the check passes...

CVE-2026-58002

WWBN AVideo through commit 9c39d8c8b4c1f75540788d6b391740852ceb0732 contains an authorization bypass vulnerability in the Usersaffiliations add.json.php endpoint that allows authenticated users to forge two-party consent records by supplying the counterparty's agreement timestamp. Attackers can...

CVE-2026-59256

WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken creates tokens without binding to user identity or purpose, and plugin/Gallery/view/sections.php issues valid tokens to unauthenticated visitors. Attackers can retrieve a token from the Gallery...

CVE-2026-4244 Post Duplicator <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution

The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicatepost function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has editothersposts capability before...

CVE-2026-4244

The Post Duplicator plugin for WordPress (all versions up to and including 3.0.11 ) is vulnerable to unauthorized data modification due to a missing capability check in the duplicate_post() function. The function does not verify that the caller holds the edit_others_posts capability before accept...