CVE-2026-4806

The Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the saveoption function in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to to export or...

CVE-2026-4806

The Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable in all versions up to and including 1.1.2 . The root cause is a missing capability check on the save_option() function, which allows unauthenticated attackers to perform unauthorized settings export or settings reset (de...

CVE-2026-3253

The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data in versions up to and including 1.7.21 . The root cause is a missing capability check on the forms() method of the AdminController class. This vulnerability allows authenticated attack...

CVE-2024-3553

CVE-2024-3553 Tutor LMS = 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hidenotices function in all...

CVE-2026-88845

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own accoun...

CVE-2026-88845 MasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own accoun...

CVE-2026-4806: Missing Authorization

The Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the saveoption function in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to to export or...

CVE-2026-93281

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix HE extended capability length check rtw89maccheckheobssnarrowbwruiter reads extended capability byte 10, but rejects only datalen values below 10. Byte 10 requires at least 11 bytes. Require datalen = 11 before...

CVE-2026-3253: Missing Authorization

The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...

Linux Distros Unpatched Vulnerability : CVE-2026-93281

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: rtw89: fix HE extended capability length check rtw89maccheckheobssnarrowbwruiter reads extended capability byte 10, but rejects only datalen values below...

CVE-2026-88974 WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level editposts capability and the post author, but does not enforce the object-level editpost capability or require publishposts for publ...

CVE-2026-86842

The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be...

CVE-2026-87981

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment...

CVE-2026-84743

The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including...

CVE-2026-86602

The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes...

CVE-2026-18364

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings...

CVE-2026-87981

The Paymob for WooCommerce WordPress plugin, in versions prior to 4.1.14 , contains a vulnerability where it fails to perform sufficient capability checks on several admin AJAX actions . This oversight allows users with contributor-level access to delete, wipe, or modify the payment-gateway confi...

EUVD-2026-85050

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment...

EUVD-2026-85046

The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be...

CVE-2026-87069

The Forminator Forms WordPress plugin (versions 1.38.1-1.57.2.0 ) is vulnerable to an authorization bypass because it fails to perform nonce , capability , or ownership checks during a one-time payment-field migration. This migration occurs during the construction of an admin screen, which is tri...