PT-2026-67982

Name of the Vulnerable Software and Affected Versions MultiVendorX WordPress plugin versions prior to 5.0.11 Description An authentication bypass issue exists in the REST API where the plugin fails to verify if the targeted store belongs to the requesting vendor. This allows an authenticated user...

PT-2026-68014

Name of the Vulnerable Software and Affected Versions Page and Post Restriction versions prior to 1.4.1 Description Sensitive information exposure occurs via the WordPress core REST endpoints '/wp-json/wp/v2/pages', '/wp-json/wp/v2/pages/', '/wp-json/wp/v2/posts', and '/wp-json/wp/v2/posts/'. The...

PT-2026-67985

Name of the Vulnerable Software and Affected Versions MultiVendorX WordPress plugin versions prior to 5.0.11 Description An issue exists where the plugin fails to verify if the requested store belongs to the current user within a REST API endpoint. This allows any user with vendor-level privilege...

PT-2026-67980

Name of the Vulnerable Software and Affected Versions Passster WordPress plugin versions prior to 4.3.6 Description Category-based content protection is not enforced on the WordPress REST API. This allows unauthenticated users to access the full content, title, and excerpt of posts that are locke...

PT-2026-68173

Name of the Vulnerable Software and Affected Versions wiseCampaign – WooCommerce Conversions Made Easy versions prior to 1.1.17 Description The plugin is susceptible to unauthorized data disclosure and modification because all REST API endpoints are registered with permission callback = ' return...

CVE-2026-7529: Missing Authorization

The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to every one of its REST API endpoints being registered with permissioncallback = 'returntrue' in all versions up to, and including, 1.1.16. This makes i...

CVE-2026-12000: Missing Authorization

The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 1.4.0 via the WordPress core REST endpoints /wp-json/wp/v2/pages, /wp-json/wp/v2/pages/ , /wp-json/wp/v2/posts, and /wp-json/wp/v2/posts/ . This is due to the plugin'...

CVE-2026-16746: Authorization Bypass Through User-Controlled Key

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data...

CVE-2026-16605: Missing Authorization

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an authenticated vendor Store Owner and above to view, take over, permanently delete, or modify any other vendor's store on the marketplace...

CVE-2026-16603: Exposure of Sensitive Information to an Unauthorized Actor

The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API...

PT-2026-68213

Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions prior to 11.3.6 Progress MarkLogic Server versions prior to 12.0.3 Description Improper privilege management in the REST API document processing pipeline allows an authenticated user with an administrative RE...

CVE-2026-71203: Missing Authentication for Critical Function

changedetection.io's REST API resources are protected by an @auth.checktoken decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec changedetectionio/api/Spec.py, whose get method carries neither @auth.checktoken nor @validateopenapirequest...

PT-2026-68041

Name of the Vulnerable Software and Affected Versions changedetection.io affected versions not specified Description The REST API resources are protected by an @auth.check token decorator that validates the x-api-key header. However, the Spec resource registered at the '/api/v1/full-spec' endpoin...

CVE-2026-6020: Use of Externally-Controlled Input to Select Classes or Code

The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action REST API endpoint in all versions up to, and including, 3.3.7. This is due to the handleaction method passing user-supplied input directly to calluserfunc without an allowlist o...

PT-2026-68010

Name of the Vulnerable Software and Affected Versions HashBrown CMS versions prior to 1.4.7 Description An OS Command Injection issue exists in the media upload thumbnail generation routine. The Media.generateThumbnail function in src/Server/Entity/Resource/Media.js creates a temporary file path...

PT-2026-67971

Name of the Vulnerable Software and Affected Versions YayPricing WordPress plugin versions prior to 3.5.7 Description The plugin fails to perform capability checks on several REST API routes, relying solely on a shared nonce. This allows any authenticated user, including those with subscriber-lev...

CVE-2026-8709: Improper Privilege Management

An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges and execute privileged operations against the Security database...

CVE-2026-7327: Improper Privilege Management

An improper privilege management vulnerability in the REST API document processing pipeline of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with an administrative REST role to escalate privileges. This can result in unauthorized disclosure of sensitive server-si...

CVE-2026-71289: Missing Authentication for Critical Function

The NASA-AMMOS Asynchronous Network Management System ANMS reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface port 8089, e.g. ":8089/tcp" with capadd: NETADMIN, NETRAW, SYSNICE, bypassing the CAM Configuration...

CVE-2026-15230: Improper Access Control

The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, relying only on a shared nonce, allowing any authenticated user such as a subscriber to overwrite the store's pricing configuration and to disclose private coupon codes...