CVE-2022-0952

CVE-2022-0952 Sitemap by click5 1.0.36 - Actualización de opciones arbitrarias sin autenticar Descripción El plugin no tiene comprobaciones de autorización ni CSRF al actualizar opciones a través de un endpoint REST, y no garantiza que la opción a actualizar pertenezca al plugin. Como resultado,...

ShortCode Addons - Unauthenticated Options Update

WordPress plugin Shortcode Addons = 3.0.2 contains an unauthenticated arbitrary option update caused by insufficient access controls in the plugin, letting attackers modify options without authentication. id: CVE-2022-34487 info: name: ShortCode Addons - Unauthenticated Options Update author:...

CVE-2024-11643

CVE-2024-11643 Accesibilidad por AllAccessible input type="hidden" name="action" value="AllA...

CVE-2023-47179

CVE-2023-47179 WooODT Lite = 2.4.6 - Autorización faltante para actualización de opciones arbitrarias Suscriptor+ Descripción: El plugin WooODT Lite para WordPress es vulnerable a la modificación no autorizada de datos debido a una falta de verificación de capacidades en la función...

CVE-2022-1203

CVE-2022-1203 Content Mask 1.8.4 - Subscriber+ Arbitrary Options Update Description The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the plugin. As a...

CVE-2023-3124

CVE-2023-3124 Prueba de concepto de CVE-2023-3124 Este es un exploit de prueba de concepto PoC para CVE-2023-3124, una vulnerabilidad en el plugin Elementor Pro de WordPress. Descripción: El plugin Elementor Pro para WordPress es vulnerable a la modificación de datos no autorizada debido a una...

freemius-exploit

freemius-exploit Freemius Library 2.2.4 - Subscriber+ Arbitrary Option Update Descripción La librería, utilizada en numerosos plugins, no tiene la autorización adecuada al actualizar las opciones del blog, lo que permite a cualquier usuario autenticado, como un suscriptor, actualizar opciones...

CVE-2026-19840 Notiqoo < 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions

The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo...

CVE-2026-19840

The Notiqoo WordPress plugin before 1.4.14 lacks capability checks on several of its AJAX actions and constructs the name of the option to write from user input. This allows users with a role as low as contributor to modify arbitrary WordPress options. The practical consequence is the ability to ...

CVE-2026-17522 Newsletters < 4.17 - Arbitrary Plugin Option Update via CSRF

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin...

CVE-2026-75982

The LearnPress WordPress plugin (versions up to and including 4.4.4 ) is vulnerable to unauthorized modification of arbitrary WordPress options via the learnpress_create_page AJAX action. The LP_Admin_Ajax::create_page() handler validates only the edit_pages capability and a wp_rest nonce (both a...

CVE-2026-19883

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...

CVE-2026-19883 WPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...

CVE-2026-19883 WPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...

EUVD-2026-64207

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...

CVE-2026-19883

The WPeMatico RSS Feed Fetcher WordPress plugin (all versions up to and including 2.8.24 ) is vulnerable to privilege escalation due to a missing capability check on the wpematico_import_settings function. An authenticated attacker with subscriber-level access or above can update arbitrary WordPr...

EUVD-2026-38664

The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary Options Update in all versions up to and including 0.0.31. This is due to a missing capability check in the ncsetOption function, which is exposed via the nc.setOption XML-RPC method. The function authenticates the us...

CVE-2026-12407 E2Pdf <= 1.32.26 - Missing Authorization to Authenticated (Custom+) Arbitrary Option Update / Privilege Escalation via 'screen_action' Parameter

The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.32.26. This is due to the screenaction function lacking a dedicated capability check and nonce verification — when invoked via the ?action=screen routing path...

WordPress E2Pdf – Export Pdf Tool for WordPress plugin <= 1.32.26 - Missing Authorization to Authenticated (Custom+) Arbitrary Option Update / Privilege Escalation vulnerability

Missing Authorization to Authenticated Custom+ Arbitrary Option Update / Privilege Escalation vulnerability discovered by endy in WordPress Plugin e2pdf versions = 1.32.26...

CVE-2026-0845

The CVE affects the WordPress ecosystem: WCFM – Frontend Manager for WooCommerce with the Bookings Subscription Listings Compatible plugin for WordPress. It has a missing capability check in WCFM_Settings_Controller::processing across all versions up to and including 6.7.24, allowing authenticate...