CVE-2026-6741

CVE-2026-6741 CVE-2026-6741은 LatePoint – Calendar Booking Plugin에서 발생하는 CVSS 8.8High 등급의 인증된Agent+ 권한 상승 취약점입니다. CVE-2026-6741 — LatePoint 권한 상승 스캐너 플러그인: LatePoint – Calendar Booking Plugin for Appointments and Events latepoint CVE ID: CVE-2026-6741 CVSS 점수: 8.8 High CVSS 벡터:...

CVE-2026-13471 LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via the LatePointAbilityDeleteBooking::execute due to missing validation on a user controlled key. This makes it...

CVE-2026-80438 Ninja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST API

The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress...

CVE-2026-77785 Rank Math SEO < 1.0.277 - Author+ Non-Public Post Content Disclosure via Abilities API

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other user...

CVE-2026-77785

The Rank Math SEO WordPress plugin, in versions prior to 1.0.277 , is vulnerable to a content disclosure flaw because it fails to verify if a requesting user has permission to access specific posts. This allows users with the Author role and above to view the title, body, and metadata of non-publ...

CVE-2026-77785 Rank Math SEO < 1.0.277 - Author+ Non-Public Post Content Disclosure via Abilities API

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other user...