CVE-2026-77786 Rank Math SEO < 1.0.277 - Editor+ Core Settings Modification via fix-site-seo Ability

The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to...

CVE-2026-77704 Amelia 1.2.32 - 2.4.8 - Amelia Customer+ Appointment Status Update and Self-Approval

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their ow...

EUVD-2026-68059

The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to...

CVE-2026-77786

The Rank Math SEO WordPress plugin, in versions prior to 1.0.277 , contains an incorrect authorization vulnerability. The plugin fails to verify if a user requesting an automated SEO fix possesses the specific capabilities required by WordPress for the underlying settings. This allows users with ...

CVE-2026-77704

The Booking for Appointments and Events Calendar WordPress plugin (versions 1.2.32-2.4.8 ) is vulnerable to an incorrect authorization issue. The plugin fails to verify if a user possesses the required capabilities before allowing them to modify an appointment's status. This flaw enables customer...

EUVD-2026-68058

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their ow...

PT-2026-83411

The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to...

PT-2026-83417

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.29.11 Description The plugin fails to perform a capability check on an AJAX action. This allows any authenticated user, including those with subscriber-level privileges, to delete arbitrary...

PT-2026-83410

Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar versions prior to 2.4.9 Description Insufficient capability checks allow users to modify the status of appointments they are booked on. This enables customers to set arbitrary statuses, such as...

CVE-2026-77704: Incorrect Authorization

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their ow...

PT-2026-83398

Name of the Vulnerable Software and Affected Versions Newsletters WordPress plugin versions prior to 4.17 Description Cross-Site Request Forgery CSRF occurs because the plugin fails to perform nonce or capability checks when saving settings screens. This allows an attacker to trick a logged-in...

PT-2026-83395

Name of the Vulnerable Software and Affected Versions SmartAIPress versions prior to 1.2.1 Description Users with subscriber-level access and above can perform a full-read Server-Side Request Forgery SSRF, a condition where an attacker forces a server to make requests to an unintended location...

CVE-2026-79996

The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator...

CVE-2026-12514

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visito...

CVE-2026-79996

The User Registration & Membership WordPress plugin, in versions prior to 5.2.6 , is vulnerable to an authenticated privilege escalation flaw. The root cause is a missing capability check when saving login settings. This allows authenticated users with management capabilities (but without full ad...

CVE-2026-79996 User Registration & Membership < 5.2.6 - Authenticated Privilege Escalation via Login Settings

The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator...

CVE-2026-79996 User Registration & Membership < 5.2.6 - Authenticated Privilege Escalation via Login Settings

The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator...

EUVD-2026-67575

The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator...

CVE-2026-12514

The Shared Files WordPress plugin (versions before 1.7.67 ) and shared-files-pro (versions before 1.7.70 ) contain an unauthenticated limited file upload vulnerability. The root cause is a missing capability check in the file-upload handler, which is accessible to unauthenticated users and only p...

EUVD-2026-67566

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visito...