CVE-2026-90923

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...

CVE-2026-87836

The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commente...

CVE-2026-86446

The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing unauthenticated attackers to obtain the correct answer to every option of a question, along with the instructor's explanation, on courses configured to be taken...

CVE-2026-91019

Event Booking Manager for WooCommerce (also identified as WpEvently ) before version 5.6.0 contains an improper access control flaw: the plugin's stored payment gateway configuration is not restricted by user role. As a result, any user with Contributor-level access or above can read the site's P...

CVE-2026-91019 Event Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...

EUVD-2026-81358

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...

WordPress Event Booking Manager for WooCommerce plugin < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure vulnerability

Contributor+ Payment Gateway Credential Disclosure vulnerability discovered by Artus KG in WordPress Plugin WpEvently versions 5.6.0...

CVE-2026-91016 Motors < 1.4.121 - Unauthenticated Draft/Private Listing Disclosure

The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowing unauthenticated attackers to read any author's draft, pending and private car listings - including titles, prices, media URLs and seller...

EUVD-2026-81357

The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowing unauthenticated attackers to read any author's draft, pending and private car listings - including titles, prices, media URLs and seller...

WordPress Motors plugin < 1.4.121 - Unauthenticated Draft/Private Listing Disclosure vulnerability

Unauthenticated Draft/Private Listing Disclosure vulnerability discovered by Pedro Pinho in WordPress Plugin Motors versions 1.4.121...

CVE-2026-91016

The Motors WordPress plugin (a car dealership classified listings plugin) before version 1.4.121 contains an unauthorized disclosure vulnerability . The plugin fails to verify whether a request is authorized to view a user's non-published listings, allowing unauthenticated attackers to read any a...

EUVD-2026-81351

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information full name, email address, phone...

CVE-2026-90923

CVE-2026-90923 affects the Autopay WordPress plugin in versions before 5.0.1 . The root cause is a missing signature enforcement on one of its payment callback endpoints, which allows unauthenticated users to disclose and delete the stored payment parameters of other customers' orders. The vulner...

CVE-2026-90923 Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...

WordPress Event Booking Manager for WooCommerce plugin 5.3.6-5.3.7 - Unauthenticated Attendee PII Disclosure vulnerability

Unauthenticated Attendee PII Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin WpEvently versions 5.3.6-5.3.7...

CVE-2026-91008

Event Booking Manager for WooCommerce (WpEvently) WordPress plugin versions before 5.3.8 (specifically 5.3.6–5.3.7) fail to perform an ownership or authorization check before rendering booking confirmation details. This allows unauthenticated attackers to retrieve registered attendees' personal i...

CVE-2026-90923 Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...

EUVD-2026-81350

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...

CVE-2026-87836 Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export

The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commente...

CVE-2026-87836

The Comments Import & Export WordPress plugin (versions 2.1.11–2.5.3 ) contains an insufficient permissions check in its comment export feature. The export is neither restricted to users with comment-moderation capabilities nor scoped to content owned by the requesting user, so any user with the ...