CVE-2026-14858: Authorization Bypass Through User-Controlled Key

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store...

CVE-2026-19091

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleterevision function in all versions up to, and including, 2.8.169. This makes it possible for...

CVE-2026-15426: Improper Privilege Management

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.11.1. This is due to the plugin not properly verifying that a user is authorized to perform an action...

CVE-2026-19091: Improper Limitation of a Pathname to a Restricted Directory

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleterevision function in all versions up to, and including, 2.8.169. This makes it possible for...

CVE-2026-18200: Authorization Bypass Through User-Controlled Key

The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user making the request, allowing authenticated users, with Subscriber-level access and above, to modify the profile details of arbitrary users, including administrators...

CVE-2026-17017 CubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cubewp_remove_relation

The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on that action, allowing users with Subscriber-level access and above to perform SQL injection...

CVE-2026-17017 CubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cubewp_remove_relation

The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on that action, allowing users with Subscriber-level access and above to perform SQL injection...

CVE-2026-17017: Improper Neutralization of Special Elements used in an SQL Command

The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on that action, allowing users with Subscriber-level access and above to perform SQL injection...

PT-2026-69269

Name of the Vulnerable Software and Affected Versions CubeWP Framework versions prior to 1.1.31 Description An issue exists where a parameter is not properly sanitized and escaped before being used in a SQL statement via an AJAX action. Additionally, the action lacks a capability check, which...

CVE-2026-16955

The AI Engine WordPress plugin versions prior to 3.6.6 is vulnerable to an arbitrary file read via a path traversal flaw. The root cause is a failure to confine caller-supplied file paths before the plugin reads and forwards content to external services. This allows users with subscriber-level ac...

CVE-2026-16955

The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at...

CVE-2026-16955: Improper Limitation of a Pathname to a Restricted Directory

The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at...

CVE-2026-16562: Exposure of Sensitive Information to an Unauthorized Actor

The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every authenticated user holds, allowing users with Subscriber-level access and above to disclose the site's visitor analytics data...

PT-2026-69174

Name of the Vulnerable Software and Affected Versions WP Statistics versions prior to 14.16.10 Description Insufficient capability checks in a set of dashboard analytics AJAX handlers allow authenticated users with Subscriber-level access and above to disclose sensitive site visitor analytics dat...

PT-2026-68850

Name of the Vulnerable Software and Affected Versions Stream plugin for WordPress versions prior to 4.2.1 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows authenticated attackers with...

PT-2026-68872

Name of the Vulnerable Software and Affected Versions WP Maps versions prior to 4.9.7 Description An issue exists where the plugin fails to perform a capability check in an AJAX action and does not properly validate a user-controlled path used in a file inclusion. This allows users with a...

CVE-2026-11907: Missing Authorization

The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2026-15991

The File Manager WordPress plugin (versions 6.0–6.9) is affected by an access control flaw in its elFinder integration. Insufficient file path validation in the connector allows an authenticated user with subscriber-level access or higher to read and delete arbitrary server files via a cmd parame...

CVE-2026-65554: Missing Authorization

Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions...

CVE-2025-9266: Missing Authorization

The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueuescripts function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to instal...