13912 matches found
CVE-2026-16575: Exposure of Sensitive Information to an Unauthorized Actor
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict access to per-vendor commission configuration returned by one of its unauthenticated store REST endpoints, allowing any unauthenticated user to disclose a vendor's commission type...
PT-2026-79298
The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only...
PT-2026-79302
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor...
CVE-2026-16576: Improper Access Control
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor...
CVE-2026-17559: Incorrect Authorization
The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an...
CVE-2026-49217
Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is...
CVE-2026-49217
Mailu , a mail server distributed as Docker images, is affected by a missing authorization check in its admin REST API prior to version 2024.06.52 . When the REST API is enabled, an unauthenticated remote attacker can remove IP restrictions or modify the comment field on any existing user token v...
CVE-2026-49217 Mailu missing authentication on PATCH /api/v1/token/<id>, which allows unauthenticated removal of IP restrictions
Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is...
CVE-2026-49217 Mailu missing authentication on PATCH /api/v1/token/<id>, which allows unauthenticated removal of IP restrictions
Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is...
EUVD-2026-63743
Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is...
CVE-2026-49217 Mailu missing authentication on PATCH /api/v1/token/<id>, which allows unauthenticated removal of IP restrictions
Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is...
Exploit for Interpretation Conflict in Wordpress
CVE-2026-63030 — wp2shell Lab Pre-Authentication RCE in W...
WordPress Essential Blocks plugin < 6.4.0 - Unauthenticated WooCommerce Sales Data Disclosure via REST products Endpoint vulnerability
Unauthenticated WooCommerce Sales Data Disclosure via REST products Endpoint vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Essential Blocks for Gutenberg versions 6.4.0...
WordPress Builderall for WordPress plugin < 3.0.2 - Unauthenticated OAuth Access Token Poisoning via Public REST Routes vulnerability
Unauthenticated OAuth Access Token Poisoning via Public REST Routes vulnerability discovered by Pablo González and Fran Ramírez in WordPress Plugin Builderall Builder for WordPress versions 3.0.2...
WordPress Content Protector (Passster) plugin < 4.3.7 - Contributor+ Protected Content Disclosure via Core REST API vulnerability
Contributor+ Protected Content Disclosure via Core REST API vulnerability discovered by Pierre Rudloff in WordPress Plugin Passster versions 4.3.7...
WordPress CatFolders Document Gallery plugin < 2.0.7 - Unauthenticated Attachment Disclosure via REST API vulnerability
Unauthenticated Attachment Disclosure via REST API vulnerability discovered by Shikhali Jamalzade in WordPress Plugin CatFolders Document Gallery & PDF Library versions 2.0.7...
WordPress All-in-One WP Migration and Backup plugin < 7.108 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import vulnerability
Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import vulnerability discovered by Mohamed Bassia in WordPress Plugin All-in-One WP Migration versions 7.108...
WordPress Ajax Search Lite plugin < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint vulnerability
Unauthenticated PHP Object Injection via Search Statistics REST Endpoint vulnerability discovered by Jakub Herman in WordPress Plugin Ajax Search Lite versions 4.14.5...
CVE-2026-19699
The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account...
CVE-2026-19699 GutenKit 2.4.12 - 2.4.15 - Contributor+ Mailchimp Audience Data Disclosure
The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account...