11036 matches found
CVE-2025-66385
UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges e.g., obtain a higher role such as admin via the user-edit endpoint by supplying or modifying roleid or organisationid fields in the edit request...
PT-2025-48317
Name of the Vulnerable Software and Affected Versions Cerebrate versions prior to 1.30 Description The UsersController::edit function in Cerebrate allows an authenticated, non-privileged user to escalate their privileges, potentially obtaining a higher role such as administrator. This is achieved...
CVE-2025-66385
UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges e.g., obtain a higher role such as admin via the user-edit endpoint by supplying or modifying roleid or organisationid fields in the edit request...
CVE-2025-66385
CVE-2025-66385 affects Cerebrate prior to version 1.30. The issue arises in UsersController::edit where an authenticated, non-privileged user can escalate privileges by supplying or modifying role_id or organisation_id in the user-edit endpoint. Affected is the ability to obtain higher roles (e.g...
EUVD-2025-199805
The Hide Category by User Role for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.3.1. This is due to a missing capability check on the admininit hook that executes wpcacheflush. This makes it possible for unauthenticated attackers ...
CVE-2025-13441
The Hide Category by User Role for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.3.1. This is due to a missing capability check on the admininit hook that executes wpcacheflush. This makes it possible for unauthenticated attackers ...
CVE-2025-13441 Hide Category by User Role for WooCommerce <= 2.3.1 - Missing Authorization to Unauthenticated Cache Flushing
The Hide Category by User Role for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.3.1. This is due to a missing capability check on the admininit hook that executes wpcacheflush. This makes it possible for unauthenticated attackers ...
CVE-2025-13441 Hide Category by User Role for WooCommerce <= 2.3.1 - Missing Authorization to Unauthenticated Cache Flushing
The Hide Category by User Role for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.3.1. This is due to a missing capability check on the admininit hook that executes wpcacheflush. This makes it possible for unauthenticated attackers ...
CVE-2025-13441
CVE-2025-13441 refers to the WordPress plugin Hide Category by User Role for WooCommerce (WordPress plugin); affected versions include all up to 2.3.1. The vulnerability is described as Missing Authorization on the admin_init hook that executes wp_cache_flush(), allowing unauthenticated users to ...
EUVD-2025-199798
The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the plugin allowing a user to update the user role through the $user-setrole function. This makes it possible for authenticated attackers, with Subscriber-level access...
EUVD-2025-199797
The Tiare Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. This is due to the 'tiaremembershipinitrestapiregister' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attacker...
CVE-2025-13540
CVE-2025-13540 affects the Tiare Membership WordPress plugin (versions
CVE-2025-13540 Tiare Membership <= 1.2 - Unauthenticated Privilege Escalation
The Tiare Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. This is due to the 'tiaremembershipinitrestapiregister' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attacker...
CVE-2025-13540 Tiare Membership <= 1.2 - Unauthenticated Privilege Escalation
The Tiare Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. This is due to the 'tiaremembershipinitrestapiregister' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attacker...
CVE-2025-13675 Tiger <= 101.2.1 - Unauthenticated Privilege Escalation
The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the 'paypal-submit.php' file not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrato...
CVE-2025-13680
CVE-2025-13680 affects the WordPress Tiger theme (versions up to and including 101.2.1). The vulnerability is an Authenticated Privilege Escalation where an attacker with Subscriber-level access or higher can exploit the plugin to elevate privileges via the $user->set_role() function, potentia...
CVE-2025-13675
CVE-2025-13675 affects the Tiger WordPress Theme (pre-101.2.2; WordPress Tiger 101.2.1 and earlier). The root cause is in paypal-submit.php, which does not restrict registration roles, allowing unauthenticated attackers to set administrator during signup. Impact is unauthenticated privilege escal...
CVE-2025-13538 FindAll Listing <= 1.0.5 - Unauthenticated Privilege Escalation
The FindAll Listing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.5. This is due to the 'findalllistinguserregistrationadditionalparams' function not restricting what user roles a user can register with. This makes it possible for...
CVE-2025-13538 FindAll Listing <= 1.0.5 - Unauthenticated Privilege Escalation
The FindAll Listing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.5. This is due to the 'findalllistinguserregistrationadditionalparams' function not restricting what user roles a user can register with. This makes it possible for...
WordPress Hide Category by User Role for WooCommerce plugin <= 2.3.1 - Missing Authorization to Unauthenticated Cache Flushing vulnerability
Missing Authorization to Unauthenticated Cache Flushing vulnerability discovered by Legion Hunter in WordPress Plugin Hide Category by User Role for WooCommerce versions = 2.3.1...