WordPress SupportCandy plugin <= 3.3.7 - Authentication Bypass to Support Session Takeover vulnerability

Authentication Bypass to Support Session Takeover vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin SupportCandy versions = 3.3.7...

WordPress Service Finder SMS System plugin <= 2.0.0 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by Foxyyy in WordPress Plugin Service Finder SMS System versions = 2.0.0...

Automated Testing of Broken Authentication Vulnerabilities in Web APIs with AuthREST

We present AuthREST, an open-source security testing tool targeting broken authentication, one of the most prevalent API security risks in the wild. AuthREST automatically tests web APIs for credential stuffing, password brute forcing, and unchecked token authenticity. Empirical results show that...

WordPress Doccure Theme <= 1.4.8 is vulnerable to Broken Authentication

Software Doccure Type Theme Vulnerable versions = 1.4.8 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2025-9114 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID ed52533a6b26 Credits István Márton...

WordPress AdForest Theme <= 6.0.9 is vulnerable to Broken Authentication

Software AdForest Type Theme Vulnerable versions = 6.0.9 Fixed in 6.0.10 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2025-8359 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID f086df38edf9 Credits Tonn Required...

DNSSEC validation may accept broken authentication chains

...

CVE-2025-54725 WordPress Golo Theme <= 1.7.0 - Broken Authentication Vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in uxper Golo allows Authentication Abuse. This issue affects Golo: from n/a through 1.7.0...

CVE-2025-54725 WordPress Golo Theme <= 1.7.0 - Broken Authentication Vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in uxper Golo golo allows Authentication Abuse.This issue affects Golo: from n/a through = 1.7.0...

WordPress StopBadBots plugin <= 11.58 - Insufficient Authorization to Unauthenticated Blocklist Bypass vulnerability

Insufficient Authorization to Unauthenticated Blocklist Bypass vulnerability discovered by Jarno Vos jarnovos in WordPress Plugin StopBadBots versions = 11.58...

WordPress RingCentral Communications plugin 1.5-1.6.8 - Missing Server‑Side Verification to Authentication Bypass via ringcentral_admin_login_2fa_verify Function

Missing Server‑Side Verification to Authentication Bypass via ringcentraladminlogin2faverify Function vulnerability discovered by kr0d in WordPress Plugin RingCentral Communications versions 1.5-1.6.8...

WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 1.0.7 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Denver Jackson in WordPress Plugin Image Gallery block – Create and display photo gallery/photo album. versions = 1.0.7...

WordPress Parallax Section block plugin <= 1.0.9 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Denver Jackson in WordPress Plugin Parallax Section block versions = 1.0.9...

Broken Authentication

github.com/hashicorp/vault is vulnerable to Broken Authentication. The vulnerability is due to improper MFA enforcement when usernameasalias is set to true and a user has multiple CNs with leading or trailing spaces, which allows attackers to bypass MFA authentication...

WordPress Taxi Booking Manager for WooCommerce plugin <= 1.3.0 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Denver Jackson in WordPress Plugin Taxi Booking Manager for WooCommerce versions = 1.3.0...

WordPress Bravis User plugin <= 1.0.0 - Authentication Bypass to Account Takeover vulnerability

Authentication Bypass to Account Takeover vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Bravis User versions = 1.0.0...

WordPress Case Theme User plugin <= 1.0.3 - Authentication Bypass via Social Login vulnerability

Authentication Bypass via Social Login vulnerability discovered by Foxyyy in WordPress Plugin Case Theme User versions = 1.0.3...

WordPress Simpler Checkout <= 1.1.13 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by kr0d in WordPress Plugin Simpler Checkout versions = 1.1.13...

WordPress Golo Theme <= 1.7.0 - Broken Authentication Vulnerability

Broken Authentication Vulnerability discovered by Rau má đậu xanh in WordPress Theme Golo versions = 1.7.0...

WordPress Jobmonster Theme <= 4.7.9 - Broken Authentication Vulnerability

Broken Authentication Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Jobmonster versions = 4.7.9...

WordPress Jobmonster Theme <= 4.7.9 is vulnerable to Broken Authentication

Software Jobmonster Type Theme Vulnerable versions = 4.7.9 Fixed in 4.8.0 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2025-54738 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 87e1e5542be4 Credits Tran Nguyen...