CVE-2026-87854 Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...

CVE-2026-87854

The Subscriptions for WooCommerce WordPress plugin, in versions before 2.0.3 , is vulnerable to an unauthenticated subscription data disclosure . The root cause is an insufficient validation of the shared secret protecting one of its REST endpoints . This flaw allows unauthorized users to retriev...

CVE-2026-87854 Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...

CVE-2026-4664

CVE-2026-4664 affects the WordPress plugin “Customer Reviews for WooCommerce” up to version 5.103.0. The vulnerability is an unauthenticated authentication bypass in create_review_permissions_check(), which compares the user-supplied key against the order’s ivole_secret_key meta using strict equa...

PT-2022-24825 · Pypi · Python-Jwt

Name of the Vulnerable Software and Affected Versions: python-jwt versions prior to 3.3.4 Description: The issue allows an attacker who obtains a JSON Web Token JWT to arbitrarily forge its contents without knowing the secret key. This may enable the attacker to spoof other users' identities,...

cups: authorization bypass when using "local" authorization

An authorization vulnerability was found in the CUPS printing system. This security vulnerability occurs when local authorization happens. This flaw allows an attacker to authenticate to CUPS as root/admin without the 32-byte secret key and perform arbitrary code execution...