CVE-2026-16983

The Gutentor WordPress plugin versions prior to 4.0.6 is vulnerable to sensitive information disclosure. The flaw exists because the plugin fails to apply proper context restrictions to one of its REST endpoints . This oversight allows any authenticated user with at least a Subscriber role to acc...

CVE-2026-12526 Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...

CVE-2026-12526

The Advanced Custom Fields: Extended WordPress plugin (versions before 0.9.2.7 ) contains an unauthenticated administrator account takeover vulnerability in its front-end Forms module . The root cause is a failure to verify if a requester is authorized to edit the targeted user account during the...

CVE-2026-12526 Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...

EUVD-2026-69871

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...

Multiple vulnerabilities in ShizenBox2

Overview ShizenBox2 provided by Shizen Connect Inc. contains multiple vulnerabilities listed below. Improper physical access control CWE-1263 - CVE-2026-80253 Authorization bypass through user-controlled key CWE-639 - CVE-2026-80254 CVE-2026-80253 Naohide Waguri of PwC Consulting LLC reported thi...

CVE-2026-84699

Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access...

CVE-2026-84699 Team Password Manager before 14.184.308 Authentication Bypass in Password Reset

Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access...

EUVD-2026-69790

Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access...

CVE-2026-84699 Team Password Manager before 14.184.308 Authentication Bypass in Password Reset

Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access...

CVE-2026-84699

Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow, allowing unauthenticated attackers to reset local account passwords and authenticate as those users, resulting in unauthorized access. The vulnerability is rated CVSS 3.1...

EUVD-2026-69722

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full...

PT-2026-84578

Name of the Vulnerable Software and Affected Versions Team Password Manager versions prior to 14.184.308 Description An issue exists where the software fails to enforce authentication requirements during the local account password reset flow. This allows unauthenticated attackers to reset local...

PT-2026-84857

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents by reading a retained backup key from the process memory of UpSignOn.exe, even after the vault has been re-locked. Attackers ca...

PT-2026-84603

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or super admin. On ...

PT-2026-84608

The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role...

PT-2026-84743

The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission which doesn’t allow changing...

CVE-2025-8945: Incorrect Authorization

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...

PT-2026-84653

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The reset password.html page parses query string parameters and uses the url parameter as a redirection target via window.location = url following a password...

PT-2026-84712

The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...