EUVD-2026-55011

The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API...

CVE-2026-15237

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid...

CVE-2026-15237

The MotoPress Hotel Booking (and Hotel Booking Lite ) WordPress plugin versions prior to 6.2.3 is vulnerable to an authentication bypass. The root cause is a lack of authorization or ownership checks on a REST endpoint used to create payment records. This flaw allows unauthenticated users to crea...

EUVD-2026-55017

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid...

CVE-2026-15237 Hotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid...

CVE-2026-17018

The CubeWP Framework WordPress plugin (versions through 1.1.30 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw due to a lack of per-object read authorization checks and missing restrictions on metadata keys. This allows users with the Contributor role or higher to access arbitr...

CVE-2026-17018 CubeWP Framework <= 1.1.30 - Contributor+ Arbitrary Post and User Meta Disclosure via IDOR

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

CVE-2026-16257 Arvow AI SEO Writer < 1.5.4 - Unauthenticated Arbitrary Post Creation via Webhook Secret Type-Juggling

The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthenticated users through type juggling when the Arvow AI SEO Writer WordPress plugin before 1.5.4 has not been configured, allowi...

CVE-2026-17541 Bit File Manager < 6.9.1 - Unauthenticated File Activity Log Disclosure

The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them...

CVE-2026-17541

The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them...

EUVD-2026-55040

The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them...

CVE-2026-16257: Improper Authentication

The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthenticated users through type juggling when the Arvow AI SEO Writer WordPress plugin before 1.5.4 has not been configured, allowi...

PT-2026-69377

Name of the Vulnerable Software and Affected Versions Block User Account versions prior to 2.0.1 Description The plugin fails to enforce account blocks across all authentication paths. This allows a blocked user who possesses an application password created before the block was applied to maintai...

PT-2026-69349

Name of the Vulnerable Software and Affected Versions MotoPress Hotel Booking WordPress plugin versions prior to 6.2.3 Description An issue exists where the software fails to perform authorization or ownership checks on a REST endpoint used to create payment records. This allows unauthenticated...

CVE-2026-18960: Improper Authentication

The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API...

CVE-2026-17541: Exposure of Sensitive Information to an Unauthorized Actor

The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them...

CVE-2026-15237: Missing Authorization

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid...

PT-2026-69361

Name of the Vulnerable Software and Affected Versions Salon Booking System WordPress plugin versions prior to 10.30.34 Description An issue exists where a REST API endpoint fails to verify if a requested booking belongs to the user making the request. This allows any authenticated user, such as a...

CVE-2026-17020: Authorization Bypass Through User-Controlled Key

The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user including a Subscriber or self-registered customer account to disclose...

PT-2026-69343

Name of the Vulnerable Software and Affected Versions vitepos WordPress plugin versions prior to 3.6.0 Description An issue exists where an identifier from a REST request body is not sanitized or parameterized before being used in a database query within a report endpoint. This allows users with...