CVE-2026-100587

OpenClaw versions before 2026.7.1 fail to properly validate owner authorization in the Codex computer-use installation command. Non-owner channel senders can install arbitrary plugins and execute MCP processes with OpenClaw user privileges, affecting host confidentiality, integrity, and...

CVE-2026-100587

Versions of OpenClaw prior to 2026.7.1 are vulnerable to an authorization bypass in the Codex computer-use installation command . The flaw occurs because the system fails to properly validate owner authorization, allowing non-owner channel senders to install arbitrary plugins and execute MCP proc...

PT-2026-99223

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1 Description Insufficient validation of owner authorization occurs within the Codex computer-use installation command. This allows senders in a channel who are not owners to install arbitrary plugins and...

CVE-2026-18364

The zportals WordPress plugin versions prior to 6.4.2 is vulnerable to an unauthorized settings modification. The root cause is the failure to perform capability or nonce checks on several AJAX actions . This allows users with low-privileged subscriber-level accounts to modify the plugin's stored...

CVE-2026-18364 Zportals < 6.4.2 - Subscriber+ Arbitrary Plugin Settings Update

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings...

WordPress zportals plugin < 6.4.2 - Subscriber+ Arbitrary Plugin Settings Update vulnerability

Subscriber+ Arbitrary Plugin Settings Update vulnerability discovered by Erwan LR WPScan in WordPress Plugin Zportals versions 6.4.2...

CVE-2026-19802 Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter

The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

CVE-2026-19802 Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter

The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

CVE-2026-2520 Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, wit...

CVE-2026-2520

The Bookly WordPress plugin (Online Scheduling and Appointment Booking System) is affected by a missing capability check on the updateAddon function in all versions up to and including 27.2 . Authenticated attackers with Subscriber-level access or higher can trigger an update of any plugin whose ...

WordPress Really Simple Security plugin < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation vulnerability

Multisite Subsite Admin+ Arbitrary Plugin Installation vulnerability discovered by Charles Vosburgh in WordPress Plugin Really Simple SSL versions 9.8.0...

CVE-2026-81766

The Really Simple Security WordPress plugin (versions before 9.8.0 ) is vulnerable to an arbitrary plugin installation flaw. Due to insufficient authorization checks during the plugin installation process, a subsite administrator on a multisite network can install and execute arbitrary code withi...

CVE-2026-81766 Really Simple Security < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation via rsp_upgrade_install_plugin

The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute...

WordPress Subscriptions for WooCommerce plugin < 2.0.1 - Shop Manager+ Arbitrary Plugin Installation vulnerability

Shop Manager+ Arbitrary Plugin Installation vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Subscriptions for WooCommerce versions 2.0.1...

CVE-2026-16576

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor...

CVE-2026-16576

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin versions prior to 5.0.14 is vulnerable to improper access control on certain admin REST API routes. The root cause is that the plugin fails to properly verify user capabilities, checking only for a general WooComm...

EUVD-2026-63818

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor...

CVE-2026-16576 Dokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor...

CVE-2026-16576: Improper Access Control

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor...

WordPress Everest Forms - Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints vulnerability

WordPress Everest Forms - Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin = 3.5.2 - Missing Authorization to Authenticated Delegated+ Arbitrary Plugin Activation via REST API and AJAX Endpoints vulnerability discovered by skyv3il in WordPress Plugin Everest Forms...