CVE-2026-14943

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read...

EUVD-2026-54209

The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful...

EUVD-2026-54195

The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at...

EUVD-2025-210644

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the editposts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of...

CVE-2026-69127: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby...

📄 WordPress WP2Shell SQL Injection / Remote Code Execution

This Metasploit module chains two WordPress core vulnerabilities, together known as WP2Shell, to gain unauthenticated remote code execution against default installs of WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. The vulnerabilities are fixed in WordPress 6.9.5 and 7.0.2. CVE-2026-60137...

CVE-2026-14943: Exposure of Sensitive Information to an Unauthorized Actor

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read...

CVE-2026-52880: Uncontrolled Resource Consumption

Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. Both REST APIs are started with the Gin Engine.Run convenience method, which serves requests through Go's default HTTP server with ...

PT-2026-69100

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.5 Kirby versions 5.0.0 through 5.5.1 Description The REST API error handler can return unsanitized PHP error messages, which allows unauthenticated users to view the full filesystem path of the installation. This...

CVE-2026-3418 Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution

The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful...

CVE-2026-3418

The CVE-2026-3418 entry concerns the System REST API in multiple WSO2 products that allows arbitrary file uploads due to insufficient validation of file type/destination. The vulnerability enables an authenticated publisher (admin with publisher privileges) to upload files to server-accessible lo...

CVE-2026-3418 Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution

The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful...

CVE-2025-15674 Content Protector (Passster) < 4.3.7 - Contributor+ Protected Content Disclosure via Core REST API

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the editposts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of...

CVE-2026-10524 CoCart < 4.9.0 - Unauthenticated Arbitrary Price Manipulation

The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at...

CVE-2026-1728

Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative...

EUVD-2026-53821

Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative...

CVE-2026-1728

Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative...

CVE-2025-14779

The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, when triggered, fails to enforce organizational boundaries, leading to the removal of secrets associated with that type across all organizations. Exploitation o...

CVE-2025-15674: Incorrect Authorization

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the editposts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of...

CVE-2026-11588: Improper Neutralization of Input During Web Page Generation

The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before saving the post, allowing unauthenticated attackers to create administrator-attributed published posts containing arbitrary web scripts...