WordPress Mapster WP Maps plugin < 2.0.6 - Unauthenticated Arbitrary Post Modification vulnerability

Unauthenticated Arbitrary Post Modification vulnerability discovered by Usama Arshad in WordPress Plugin Mapster WP Maps versions 2.0.6...

CVE-2026-118638

The Mapster WP Maps WordPress plugin versions before 2.0.6 is vulnerable to an unauthenticated arbitrary post modification vulnerability. The root cause is a missing authorization check on a REST API route used to write post data (specifically identified in some records as the save-mapmaker route...

CVE-2026-118638 Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST Route

The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin...

CVE-2026-118638 Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST Route

The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin...

WordPress Modern Events Calendar Lite plugin < 7.36.4 - Subscriber+ Arbitrary Post Modification vulnerability

Subscriber+ Arbitrary Post Modification vulnerability discovered by Nguyen Duc Thinh in WordPress Plugin Modern Events Calendar Lite versions 7.36.4...

CVE-2026-118101 BuddyForms < 2.10.1 - Subscriber+ Arbitrary Post Modification

The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the target post, allowing users who have been granted edit access to a form, as low as Subscriber, to overwrite the title, content and status of any other user's posts or pages,...

WordPress BuddyForms plugin < 2.10.1 - Subscriber+ Arbitrary Post Modification vulnerability

Subscriber+ Arbitrary Post Modification vulnerability discovered by Furkan Arslan in WordPress Plugin BuddyForms versions 2.10.1...

CVE-2026-118101 BuddyForms < 2.10.1 - Subscriber+ Arbitrary Post Modification

The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the target post, allowing users who have been granted edit access to a form, as low as Subscriber, to overwrite the title, content and status of any other user's posts or pages,...

CVE-2026-118101

The BuddyForms WordPress plugin, in versions prior to 2.10.1 , is vulnerable to an arbitrary post modification issue due to a missing authorization check. The plugin fails to verify if a user editing an existing entry is the actual author of the target post. This allows users with form edit acces...

CVE-2026-115259

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authenticated attackers, with Author-level access...

WordPress AI Engine plugin < 3.7.9 - Editor+ Arbitrary Post Modification vulnerability

Editor+ Arbitrary Post Modification vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin AI Engine versions 3.7.9...

CVE-2026-110070 Modern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDOR

The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types...

CVE-2026-110070 Modern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDOR

The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types...

CVE-2026-110070

The Modern Events Calendar Lite WordPress plugin version before 7.36.4 contains an authorization bypass (IDOR) vulnerability. The plugin fails to verify if a user is authorized to edit a target post before processing an update. This allows authenticated users with the Subscriber role to modify th...

CVE-2026-111041

The AI Engine WordPress plugin, in versions prior to 3.7.9 , contains an authorization vulnerability in its AI media management functionality. Specifically, the plugin fails to verify if a user owns or is authorized to edit a targeted object during certain actions, such as update_media_metadata a...

CVE-2026-111041 AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_media

The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including...

CVE-2026-111041 AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_media

The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including...

WordPress Bricks Builder theme <= 2.4.2 - Unauthenticated Arbitrary Post Modification via Form Submission vulnerability

Unauthenticated Arbitrary Post Modification via Form Submission vulnerability discovered by Patchstack in WordPress Theme Bricks Builder versions = 2.4.2...

CVE-2026-96532

The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form, allowing unauthenticated users to modify or create arbitrary posts, including overwriting the title, content and author of any existing...

EUVD-2026-87540

The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form, allowing unauthenticated users to modify or create arbitrary posts, including overwriting the title, content and author of any existing...