CVE-2026-40776

CVE-2026-40776 Eventin wp-event-solution のアクセス制御の不備 WordPress プラグイン Eventin アクティブインストール数 10,000+ における、認証なしの PII 個人情報 開示 と 注文データの偽造 です。公開 REST エンドポイントが任意の訪問者に wprest nonce を配布し、後続の 3 つのパーミッションコールバックがその nonce を認証の代用として受け入れるため、すべての顧客注文エンドポイントで認可が崩壊します。 完全な技術解説:...

CVE-2026-84799

Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relation fields including author , authors , uploader , draftCreator , and revisionCreator . An attacker holding a scoped GraphQL token can query these relations to read the usernames, email addresses, and fu...

TRUfusion Enterprise <= 7.10.4.0 - Admin Contact Portal

TRUfusion Enterprise versions 7.10.4.0 and earlier contained a vulnerability that allowed unauthenticated access to the Internal Admin Contact Page, resulting in the disclosure of PII including partner and contact names. id: CVE-2025-27225 info: name: TRUfusion Enterprise = 7.10.4.0 - Admin Conta...

CVE-2026-74927

MultiVendorX WordPress plugin (versions 5.0.13–5.0.14 ) lacks proper authorization on its stores REST endpoint , enabling unauthenticated attackers to retrieve vendor contact information, payout details, pending payout amounts, and administrative notes attached to store applications. The issue is...

CVE-2026-74927 MultiVendorX 5.0.13 - 5.0.14 - Unauthenticated Vendor PII and Payout Data Disclosure via stores REST Endpoint

The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications...

WordPress MultiVendorX plugin 5.0.13-5.0.14 - Unauthenticated Vendor PII and Payout Data Disclosure vulnerability

Unauthenticated Vendor PII and Payout Data Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin MultiVendorX versions 5.0.13-5.0.14...

CVE-2026-13736

CVE-2026-13736: NewPath WildApricotPress Add-on – Member Directory = 1.0.0 — REST API 経由の未認証メンバー PII 開示 📖 アドバイザリ概要 CVE-2026-13736 は、バージョン 1.0.0 以前の NewPath WildApricotPress Add-on – Member Directory WordPress プラグインに影響を与える、未認証のメンバー個人識別情報（PII）開示の脆弱性です。サイバーセキュリティ研究者 Huynh Kien...

CVE-2025-60357

CVE-2025-60357- NoSQLMongoDB注入 漏洞和产品描述 AhnLab EPP Management 是全球公认的下一代高级端点保护平台，集成了补丁管理、高级恶意软件检测、EDR 和 XDR 功能。 在 AhnLab EPP Management v1.0.14.32-6249 的端点 /api/console/ems/eventlog/agentEvent/list 中发现了 NoSQLMongoDB注入 ，导致敏感信息和 PII 泄露。该受影响端点现已修补，AhnLab 于 2024 年 8 月发布了补丁版本（P14.32 P16.25）。...

CVE-2026-52217-VTEX-Checkout-CrossTenant-IDOR

CVE-2026-52217 VTEX Commerce PlatformのCheckoutサービスにおけるクロステナントおよびクロスユーザー認可の欠陥（IDOR / BOLA） フィールド| 値 ---|--- CVE ID| CVE-2026-52217 Vendor| VTEX Product| VTEX Commerce Platform, Checkoutサービス（chk） Affected| chk v2.367.3で確認され、v2.374.3でも再現。根本原因はOrderFormのストレージおよび認可レイヤーにあり、プラットフォーム全体に影響する。 Vulnerabilit...

CVE-2026-81200 MasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...

CVE-2026-81200

CVE-2026-81200 affects the MasterStudy LMS WordPress plugin in versions before 3.7.42 . The flaw is an improper access restriction (IDOR) in the order information handling: any user holding the instructor role can enumerate order IDs to read other users' billing details—name, email address, phone...

exploit-CVE-2022-0482

Divulgazione di PII in Easy!Appointments Easy!Appointments --debug exploit.rb -h | --help Options: Root URL base path including HTTP scheme, port and root folder All events since default: 2015-01-11 All events until default: today --debug Display arguments -h, --help Show this screen Examples:...

CVE-2026-4106

CVE-2026-4106: Exploit di Divulgazione PII Non Autenticata per WordPress HT Mega Una Proof of Concept PoC robusta e multi-thread per CVE-2026-4106 , che colpisce il plugin HT Mega - Absolute Addons for Elementor per WordPress versioni 3.0.7. Panoramica della Vulnerabilità Il plugin HT Mega regist...

WordPress Salon booking system plugin <= 10.31.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Salon booking system versions = 10.31.1...

WordPress Simple Newsletter Plugin plugin < 4.3.3 - Unauthenticated Subscriber PII and confirm_key Disclosure vulnerability

Unauthenticated Subscriber PII and confirmkey Disclosure vulnerability discovered by Shivamani Vastrala in WordPress Plugin Noptin versions 4.3.3...

CVE-2026-13736

The NewPath WildApricotPress Add-on WordPress plugin (Member Directory) through 1.0.0 fails to enforce members-only field privacy on an unauthenticated REST route. This allows anonymous visitors to read member email addresses and phone numbers that are configured to be visible only to authenticat...

CVE-2026-13736 NewPath WildApricotPress Add-on – Member Directory <= 1.0.0 - Unauthenticated Member PII Disclosure via REST API

The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only...

CVE-2026-18778 TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Customer PII Disclosure via Multiple AJAX Actions

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to retrieve the personal information of customers who booked an appointment, including their name, email address, phone number and postal address...

CVE-2026-18778

The TrueBooker WordPress appointment-booking plugin (versions before 1.2.7) lacks authorization checks in several AJAX endpoints, allowing unauthenticated remote attackers to retrieve customer PII—name, email, phone, and postal address—via crafted requests. CVSS 3.1 scores this MEDIUM (5.3). No e...

BIT-MASTODON-2026-72915 Mastodon: Personally-identifying information disclosure due to incorrect access control validation

Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0 until 4.6.4 and 4.7.0, any logged-in local user could use the show action in app/controllers/admin/collectionscontroller.rb to access personally identifying information about another local user in a collection...