By-Poloss..-..CVE-2026-12432-PoC

CVE-2026-12432: WP Full Stripe Free = 8.4.4 Published : June 26, 2026 Last Updated : June 27, 2026 Researcher : Netwurm - VTDR e.V.i.G. Vulnerability Description The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.4.3 via the...

CVE-2026-118531 Directorist < 8.11.1 - Subscriber+ Listing Moderation Bypass via REST Status Update

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11.1 does not prevent a listing's own author from changing its status from pending to published, allowing users with a Subscriber-level account and above to bypass the administrator's listing...

CVE-2026-118531

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin, in versions prior to 8.11.1 , contains a vulnerability that fails to restrict a listing's author from modifying its status. This allows users with a Subscriber-level account or higher to bypass administrat...

EUVD-2026-111404

A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/resultmanager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading ...

CVE-2026-118128

A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/resultmanager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading ...

CVE-2026-118128 a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition

A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/resultmanager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading ...

CVE-2026-118128 a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition

A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/resultmanager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading ...

CVE-2026-118128 a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition

A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/resultmanager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading ...

CVE-2026-118128

A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/resultmanager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading ...

CVE-2026-118128

The a2aproject a2a-js software (versions up to 1.1.0 ) is vulnerable to a race condition within the Task Status Update Handler component. Specifically, the flaw exists in the ResultManager.applyStatusUpdate function located in the file src/server/result_manager.ts. This vulnerability can be explo...

PT-2026-127246

A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/result manager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading...

CVE-2026-118128: a2aproject a2a-js: A vulnerability has been found in a2aproject a2a-js up to 1.1.0

A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/resultmanager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading ...

Agent2Agent A2A JavaScript SDK race condition vulnerability

Agent2Agent A2A JavaScript SDK versions 1.1.0 and earlier contain a race condition vulnerability. This vulnerability stems from a race condition in the function ResultManager.applyStatusUpdate within the file src/server/resultmanager.ts in the Task Status Update Handler component. Exploitation of...

CVE-2026-106010

The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default...

EUVD-2026-104096

The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default...

PT-2026-117241

Name of the Vulnerable Software and Affected Versions BDM Digital Payment Gateway WordPress plugin versions prior to 1.3.13 Description The plugin fails to verify credentials on its public payment-status update route and treats unset credentials as valid. This allows unauthenticated attackers to...

CVE-2026-106010: Missing Authorization

The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default...

CVE-2026-89289

The Fast Courier WordPress plugin (versions

CVE-2026-89289 Fast Courier <= 5.2.3 - Unauthenticated Order Fulfillment Update via order-status-update REST Endpoint

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id...

CVE-2026-89289 Fast Courier <= 5.2.3 - Unauthenticated Order Fulfillment Update via order-status-update REST Endpoint

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id...