WordPress Security For WooCommerce plugin <= 1.0.16 - Unauthenticated Two-Factor Authentication Reset vulnerability

Unauthenticated Two-Factor Authentication Reset vulnerability discovered by Benjamin Kincses Dextheking1 in WordPress Plugin Ultimate Security For WooCommerce: IP Restriction, Password Policy and More versions = 1.0.16...

CVE-2026-50550: Incorrect Authorization

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor authentication through app/Http/Controllers/Api/UsersController.php postTwoFactorReset. The endpoint authorizes update access but does not enforce canEditAuthFiel...