PT-2026-71389

The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the...

WordPress Homey plugin <= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Reservation & Post Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Reservation & Post Deletion vulnerability discovered by a00n in WordPress Theme Homey versions = 2.4.4...