EUVD-2026-85033

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and...

EUVD-2026-85022

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings...

CVE-2026-18365

The zportals WordPress plugin in versions prior to 6.4.2 is vulnerable to an unauthorized information disclosure flaw. The root cause is the failure to perform capability or nonce checks on one of its AJAX actions . This allows authenticated users with subscriber-level accounts to disclose the di...

PT-2026-97184

Name of the Vulnerable Software and Affected Versions Forminator Forms WordPress plugin versions prior to 1.57.2.1 Description The plugin fails to perform a nonce, capability, or ownership check before executing a one-time payment-field migration during the construction of an admin screen. This...

PT-2026-97178

Name of the Vulnerable Software and Affected Versions WP Recipe Maker versions prior to 10.8.2 Description An issue exists where the plugin fails to perform a capability check in an AJAX action. This allows any authenticated user, including those with subscriber-level privileges, to read the full...

PT-2026-97176

Name of the Vulnerable Software and Affected Versions The Events Calendar WordPress plugin versions prior to 6.17.5 Description The software fails to perform a per-object capability check on a family of its REST write routes. This allows users with low-privilege roles, such as contributors, to...

CVE-2026-18345

The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete function in versions up to, and including, 2.9.18. The function is registered on the admininit hook which fires for every authenticated user that...

EUVD-2026-84307

The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete function in versions up to, and including, 2.9.18. The function is registered on the admininit hook which fires for every authenticated user that...

CVE-2026-18345 WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback

The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete function in versions up to, and including, 2.9.18. The function is registered on the admininit hook which fires for every authenticated user that...

CVE-2026-12470

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes for WordPress (all versions up to and including 4.1.17 ) is affected by a missing capability check on the cmp_ajax_import_settings AJAX action. An authenticated attacker with Editor-level or higher access can update arbitrary site options,...

CVE-2026-12470 CMP <= 4.1.17 - Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp_ajax_import_settings AJAX Action

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'cmpajaximportsettings' AJAX action in all versions up to, and including, 4.1.17. This...

EUVD-2026-84273

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'cmpajaximportsettings' AJAX action in all versions up to, and including, 4.1.17. This...

PT-2026-96668

Name of the Vulnerable Software and Affected Versions ThumbPress versions prior to 6.2.2 Description Authenticated users with Subscriber-level access and above can deactivate the plugin by sending a crafted POST request to the 'admin-ajax' endpoint. This occurs because the send deactivation surve...

CVE-2026-12470: Improper Privilege Management

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'cmpajaximportsettings' AJAX action in all versions up to, and including, 4.1.17. This...

PT-2026-96646

Name of the Vulnerable Software and Affected Versions CMP – Coming Soon & Maintenance Plugin by NiteoThemes versions prior to 4.1.18 Description An issue exists where a missing capability check on the 'cmp ajax import settings' AJAX action allows authenticated attackers with Editor-level access o...

PT-2026-96662

Name of the Vulnerable Software and Affected Versions WP User Manager versions prior to 2.9.19 Description The plugin allows unauthorized modification of data because the Connect::complete function lacks a capability check. This function is registered on the admin init hook, which executes for an...

CVE-2026-18345: Missing Authorization

The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete function in versions up to, and including, 2.9.18. The function is registered on the admininit hook which fires for every authenticated user that...

CVE-2026-92423

The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returning post data, allowing authenticated users with Author-level access and above to disclose the titles, authors, dates and statuses of other...

CVE-2026-81654

The NextGEN Gallery WordPress plugin (versions before 4.5.0 ) is vulnerable to an authorization bypass because it fails to verify if a user possesses the options capability before saving image sizing settings. This allows users with only gallery-management privileges to modify settings that affec...

CVE-2026-92423: Exposure of Sensitive Information to an Unauthorized Actor

The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returning post data, allowing authenticated users with Author-level access and above to disclose the titles, authors, dates and statuses of other...