EUVD-2026-55040

The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them...

CVE-2026-16257: Improper Authentication

The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthenticated users through type juggling when the Arvow AI SEO Writer WordPress plugin before 1.5.4 has not been configured, allowi...

PT-2026-69366

Name of the Vulnerable Software and Affected Versions File Manager WordPress plugin versions prior to 6.9.1 Description Lack of authorization checks on a REST API route allows unauthenticated users to access the file activity log. This leads to the disclosure of file operations performed on the...

PT-2026-69377

Name of the Vulnerable Software and Affected Versions Block User Account versions prior to 2.0.1 Description The plugin fails to enforce account blocks across all authentication paths. This allows a blocked user who possesses an application password created before the block was applied to maintai...

The vulnerability of the REST API interface implementation of the Splunk Enterprise platform for operational analysis allows a perpetrator to disclose protected information.

The vulnerability of the REST API implementation of the Splunk Enterprise platform for operational analysis is related to insufficient protection of sensitive data when the |rest command is executed. Exploiting this vulnerability allows a malicious actor to disclose sensitive information by sendi...

PT-2026-69361

Name of the Vulnerable Software and Affected Versions Salon Booking System WordPress plugin versions prior to 10.30.34 Description An issue exists where a REST API endpoint fails to verify if a requested booking belongs to the user making the request. This allows any authenticated user, such as a...

PT-2026-69349

Name of the Vulnerable Software and Affected Versions MotoPress Hotel Booking WordPress plugin versions prior to 6.2.3 Description An issue exists where the software fails to perform authorization or ownership checks on a REST endpoint used to create payment records. This allows unauthenticated...

CVE-2026-18960: Improper Authentication

The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API...

CVE-2026-17541: Exposure of Sensitive Information to an Unauthorized Actor

The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them...

CVE-2026-15237: Missing Authorization

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid...

CVE-2026-17020: Authorization Bypass Through User-Controlled Key

The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user including a Subscriber or self-registered customer account to disclose...

PT-2026-69343

Name of the Vulnerable Software and Affected Versions vitepos WordPress plugin versions prior to 3.6.0 Description An issue exists where an identifier from a REST request body is not sanitized or parameterized before being used in a database query within a report endpoint. This allows users with...

PT-2026-69988

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 7.10.14 Rocket.Chat versions prior to 8.0.8 Rocket.Chat versions prior to 8.1.7 Rocket.Chat versions prior to 8.2.7 Rocket.Chat versions prior to 8.3.7 Rocket.Chat versions prior to 8.4.5 Rocket.Chat versions prio...

CVE-2026-18786: Improper Authentication

The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible f...

PT-2026-69359

Name of the Vulnerable Software and Affected Versions CubeWP Framework WordPress plugin versions prior to 1.1.31 Description An issue exists where a REST API endpoint fails to perform per-object read authorization checks and does not restrict the metadata keys that can be requested. This allows...

CVE-2026-14238: Improper Neutralization of Special Elements used in an SQL Command

The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection...

CVE-2026-17018: Authorization Bypass Through User-Controlled Key

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

PT-2026-69351

Name of the Vulnerable Software and Affected Versions Arvow AI SEO Writer WordPress plugin versions prior to 1.5.4 Description Insufficient access control in a REST endpoint allows unauthenticated users to bypass security checks via type juggling when the plugin is not configured. Type juggling i...

PT-2026-69374

Name of the Vulnerable Software and Affected Versions CheckView versions prior to 2.3.2 Description The plugin fails to restrict its REST API authentication filter to its own routes. It unconditionally discards authentication errors for any request where the URI contains a specific string related...

The vulnerability of the REST API interface implementation of the Splunk Enterprise platform for operational analysis allows a perpetrator to gain unauthorized access to modify files or execute arbitrary code.

The vulnerability of the REST API interface implementation of the Splunk Enterprise platform for operational analysis is related to an incorrect limitation on the path name to the $SPLUNKHOME/etc/ directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access t...