CVE-2026-14195: Authorization Bypass Through User-Controlled Key

The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Contributor role or higher to read the content of arbitrary posts, including other users' private, pending, and draft posts...

PT-2026-67051

The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...

CVE-2026-58048

creationtimestamp| type| source ---|---|--- 2026-07-31 17:56:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxjnjuke42b 2026-07-31 18:00:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jdwwbzeerzdry 2026-08-01 09:22:36+00:00| seen|...

CVE-2026-66360

creationtimestamp| type| source ---|---|--- 2026-07-31 01:00:34+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrvqvmxm6n2e 2026-07-31 02:06:00+00:00| seen| https://bsky.app/profile/termsofsurrender.bsky.social/post/3mrvuknfmqh23...

CVE-2026-66418

creationtimestamp| type| source ---|---|--- 2026-07-30 22:04:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrvh22scsy22 2026-07-30 22:50:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/gtwl3xl2iqw3q 2026-07-31 12:42:04+00:00| seen|...

CVE-2026-48499

creationtimestamp| type| source ---|---|--- 2026-07-30 20:23:53+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrvbgw5k5s2c 2026-07-30 20:56:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrvdahgdbl23...

CVE-2026-67594

creationtimestamp| type| source ---|---|--- 2026-07-30 20:02:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrva7x7eag22 2026-07-30 21:00:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrvdib25zu2j...

CVE-2026-66415

creationtimestamp| type| source ---|---|--- 2026-07-30 20:00:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrva57i7jh2o 2026-07-30 20:22:29+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrvbe4xv6v2d...

CVE-2026-12940

creationtimestamp| type| source ---|---|--- 2026-07-30 17:54:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mruz2zcjdt2z 2026-07-30 18:01:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mruzhq4nk622 2026-07-30 18:50:13+00:00| seen|...

CVE-2026-58066

creationtimestamp| type| source ---|---|--- 2026-07-30 07:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrtujmg3ak2a 2026-07-30 07:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrtukzihe22w 2026-07-30 07:10:21+00:00| seen|...

CVE-2026-58046

creationtimestamp| type| source ---|---|--- 2026-07-30 07:00:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrtujl5bc42j 2026-07-30 07:00:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrtukscvpt22 2026-07-30 07:08:22+00:00| seen|...

CVE-2026-14305

The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata a like counter and an associated identifier list on arbitrary posts, including inflating the counter and growing the...

EUVD-2026-51015

The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata a like counter and an associated identifier list on arbitrary posts, including inflating the counter and growing the...

CVE-2026-14305

The WP Delicious WordPress plugin (versions before 1.10.2 ) is vulnerable because it fails to perform an authorization check on one of its AJAX actions . This allows unauthenticated users to modify limited post metadata, such as a like counter and an associated identifier list , on arbitrary post...

CVE-2026-14305 WP Delicious < 1.10.2 - Unauthenticated Arbitrary Post Meta Update via recipe_likes

The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata a like counter and an associated identifier list on arbitrary posts, including inflating the counter and growing the...

CVE-2026-14231 LifterLMS < 10.0.10 - Subscriber+ Sensitive Information Disclosure via select2_query_posts

The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, allowing any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by...

CVE-2026-14231 LifterLMS < 10.0.10 - Subscriber+ Sensitive Information Disclosure via select2_query_posts

The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, allowing any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by...

CVE-2026-15975

creationtimestamp| type| source ---|---|--- 2026-07-30 04:45:25+00:00| seen| https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities20260730 2026-07-30 05:01:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrtnuxzugp2q 2026-07-30 14:15:31+00:00| seen|...

CVE-2026-14923: Incorrect Authorization

The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability such...

CVE-2026-67432

creationtimestamp| type| source ---|---|--- 2026-07-29 20:57:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrsstprxqw2i 2026-07-29 21:00:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrsszcbcnl22 2026-07-30 16:35:23+00:00| published-proof-of-concept|...