CVE-2026-114658

The Grav Login plugin versions 3.6.0 to 3.9.13 are vulnerable to a Privilege Escalation flaw due to missing authorization in the login.invite task. This allows page authors to gain super user accounts and full site control. An attacker can define an invitation form in the page frontmatter grantin...

CVE-2026-114658 Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite

Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the...

CVE-2026-109314

Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route. When a victim opens an emailed reset link, the publisher-controlled page rendered by Login::getPage exposes the...

CVE-2026-109314 Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page

Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route. When a victim opens an emailed reset link, the publisher-controlled page rendered by Login::getPage exposes the...

CVE-2026-109313 Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as...

CVE-2026-109313

The Grav Login plugin (versions 2.7.0 before 3.9.9 ) is vulnerable to an authentication bypass (CWE-287). Attackers possessing a valid password can bypass two-factor authentication (2FA) by exploiting the remember-me cookie restoration mechanism. By obtaining a persistent remember-me cookie after...

CVE-2026-109314 Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page

Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route. When a victim opens an emailed reset link, the publisher-controlled page rendered by Login::getPage exposes the...

CVE-2026-109313 Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as...

CVE-2026-109314

The Grav Login plugin (versions 1.2.0 before 3.9.9) is vulnerable to an information disclosure flaw. A publisher can author a page at the reset route, causing the Login::getPage() function to render a publisher-controlled page when a victim clicks an emailed password reset link. This action expos...

CVE-2026-109312 Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile, which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invok...

CVE-2026-109312 Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile, which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invok...

Malicious code in hermione-login-plugin (npm)

--- Credit: OpenSSF source...

CVE-2026-77752

The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a single site on a multisite network to take over the whole...

CVE-2026-77753

The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site ov...

CVE-2026-77753 Temporary Login Without Password < 1.9.9 - Authenticated Temporary Access Revocation Bypass via Application Passwords

The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site ov...

CVE-2026-77753

The Temporary Login Without Password WordPress plugin versions prior to 1.9.9 contains an authenticated temporary access revocation bypass. The plugin fails to prevent temporary users from creating Application Passwords and does not revoke these credentials once the temporary access expires or is...

CVE-2026-77753 Temporary Login Without Password < 1.9.9 - Authenticated Temporary Access Revocation Bypass via Application Passwords

The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site ov...

GHSA-7MGC-C7PQ-3RR3 Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge

Summary When 2FA is enabled on an account, submitting correct credentials authenticates the user but leaves them unauthorized pending TOTP verification. During this pending-challenge window, the login.regenerate2FASecret task which requires only $user-exists, not $user-authorized can be called...

EUVD-2026-62540

Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge...

WordPress Social Login & Sharing buttons with Analytics By SoClever plugin <= 1.2.0 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Social Login & Sharing buttons with Analytics By SoClever versions = 1.2.0...