CVE-2026-64665 Statamic: Account takeover via OAuth email matching without email-verification check

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, witho...

CVE-2026-64665 Statamic: Account takeover via OAuth email matching without email-verification check

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, witho...

CVE-2026-13342 Security Optimizer – The All-In-One Protection Plugin < 1.6.5 - Login Access IP Allowlist Bypass via post_password

The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-based login restriction feature, allowing the restriction to be bypassed so that unauthenticated requests from non-allowlisted IP addresses can reach and use the login form, defeati...

CVE-2026-13342 Security Optimizer – The All-In-One Protection Plugin < 1.6.5 - Login Access IP Allowlist Bypass via post_password

The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-based login restriction feature, allowing the restriction to be bypassed so that unauthenticated requests from non-allowlisted IP addresses can reach and use the login form, defeati...

CVE-2026-66681

Unauthenticated Cross Site Request Forgery CSRF in Theme My Login = 7.1.14 versions...

CVE-2026-65570

Unauthenticated Bypass Vulnerability in Login with phone number = 1.8.70 versions...

CVE-2026-66681 WordPress theme My Login plugin <= 7.1.14 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Theme My Login = 7.1.14 versions...

CVE-2026-66681

Theme My Login WordPress plugin

CVE-2026-66681

Unauthenticated Cross Site Request Forgery CSRF in Theme My Login = 7.1.14 versions...

CVE-2026-66681 WordPress theme My Login plugin <= 7.1.14 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Theme My Login = 7.1.14 versions...

EUVD-2026-53893

Unauthenticated Cross Site Request Forgery CSRF in Theme My Login = 7.1.14 versions...

EUVD-2026-53988

Unauthenticated Bypass Vulnerability in Login with phone number = 1.8.70 versions...

CVE-2026-65570

Unauthenticated Bypass Vulnerability in Login with phone number = 1.8.70 versions...

CVE-2026-65570 WordPress Login with phone number plugin <= 1.8.70 - Bypass vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Login with phone number = 1.8.70 versions...

CVE-2026-65570

Technical details about CVE-2026-65570 are not publicly available in the provided documents. The records only state an unauthenticated bypass in the WordPress plugin up to version 1.8.70; no specifics on exploit vectors or fixes are included. Monitor for updates.

WordPress theme My Login plugin <= 7.1.14 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Theme My Login versions = 7.1.14...

WordPress Login & Register Forms plugin < 3.2.5 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Chamseddine Bouzaiene in WordPress Plugin Login/Signup Popup versions 3.2.5...

CVE-2025-13736

When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. For valid users, the server resolves and displays their canonical username, while for non-existent users, it echoes the original input. This occurs regardless of the...

CVE-2025-15039

CVE-2025-15039 concerns the Conditional Authentication (Adaptive Authentication) script in multiple WSO2 products. The flaw is that the script does not properly enforce completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configure...

CVE-2025-13736 Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery

When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. For valid users, the server resolves and displays their canonical username, while for non-existent users, it echoes the original input. This occurs regardless of the...