CVE-2026-77239 WACRM: Service-role routes missing a role check

WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. In src/app/api/flows/id/route.ts,...

CVE-2026-77239 WACRM: Service-role routes missing a role check

WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. In src/app/api/flows/id/route.ts,...

CVE-2026-89007

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments...

CVE-2026-88844

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names...

CVE-2026-81340

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users'...

CVE-2026-89007 Bookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments...

CVE-2026-89007

The Bookit — Booking & Appointment Calendar WordPress plugin (versions before 2.6.0.5 ) is vulnerable to an authorization flaw. The plugin fails to perform a capability check within one of its appointment-deletion functions. This allows users assigned to the low-privileged custom Staff role to pe...

CVE-2026-89007 Bookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments...

EUVD-2026-82678

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names...

CVE-2026-84738 AF Companion < 2.2.0 - Shop Manager+ Arbitrary File Upload to RCE

The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-privileged store-management role to upload arbitrary files, including PHP ones, leading to Remote Code Execution...

CVE-2026-81340 MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users'...

CVE-2026-81340 MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users'...

CVE-2026-89007: Missing Authorization

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments...

CVE-2026-88844: Authorization Bypass Through User-Controlled Key

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names...

CVE-2026-81340: Authorization Bypass Through User-Controlled Key

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users'...

PT-2026-95251

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description An Insecure Direct Object Reference IDOR exists where the plugin fails to verify if the requesting user owns a course before returning its enrolled-student data. This allows...

WP < 7.1.1 - Author+ Unpublished Post Title Disclosure via Attachment Edit Screen

Description WordPress does not check that the user is allowed to read an attachment's parent post before displaying its title on an admin screen in some cases, which could allow users with a role as low as author to learn the title of a private or draft post they cannot access...

WP < 7.1.1 - Author+ Path Traversal via Templates REST API

Description WordPress does not properly validate template identifiers passed to a REST API endpoint in some cases, which could allow users with a role as low as author to read HTML files outside of the themes directory via path traversal...

PT-2026-95231

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description Insufficient per-object ownership or capability checks occur when updating orders via the REST API. This allows users with the Instructor role to modify any order on the sit...

PT-2026-95253

Name of the Vulnerable Software and Affected Versions Bookit — Booking & Appointment Calendar WordPress plugin versions prior to 2.6.0.5 Description An issue exists where the plugin fails to perform a capability check within an appointment-deletion function. This allows users assigned to the...