CVE-2026-16269

The Newsletters WordPress plugin (before 4.16) fails to strictly compare its API authentication key, enabling an unauthenticated bypass of API authentication through type juggling. This allows attackers to perform privileged actions when the optional API is enabled, such as modifying subscriber r...

CVE-2026-15239 Simple CAPTCHA with Cloudflare Turnstile < 1.42.0 - Unauthenticated Turnstile Protection Bypass via Reusable Forminator Cache Key

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solv...

CVE-2026-15239

CVE-2026-15239 affects the Simple CAPTCHA with Cloudflare Turnstile WordPress plugin (pre-1.42.0). The vulnerability arises because the Turnstile validation cache isn’t bound to the single-use challenge token, instead tying to an attacker-controlled reusable request value, enabling unauthenticate...

EUVD-2026-54180

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments...

CVE-2026-15208 RegistrationMagic < 6.0.9.5 - Unauthenticated Payment Bypass via Amount-Blind PayPal Verification

The RegistrationMagic WordPress plugin before 6.0.9.5 does not compare the verified PayPal capture's amount, currency, payee, or prior use against the registration it is finalising: its server-side check only confirms the capture status is COMPLETED. An unauthenticated attacker can therefore...

CVE-2026-11361 Formidable Forms < 6.32.1 - Unauthenticated Payment Bypass via PayPal APPROVAL_PENDING Subscription Status

The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete, allowing unauthenticated users to bypass payment and trigger paid form actions — such as digital content access, license delivery, and membership...

CVE-2026-11361

Formidable Forms for WordPress (before 6.32.1) is affected by CVE-2026-11361 due to improper validation of PayPal subscription status, enabling unauthenticated users to bypass payment and trigger paid actions (content access, license delivery, membership activation) without charges. Impact aligns...

CVE-2026-65570

Unauthenticated Bypass Vulnerability in Login with phone number = 1.8.70 versions...

CVE-2026-65502

Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons = 8.7.13 versions...

CVE-2026-32469

Unauthenticated Bypass Vulnerability in CAPTCHA 4WP = 7.6.0 versions...

EUVD-2026-53988

Unauthenticated Bypass Vulnerability in Login with phone number = 1.8.70 versions...

CVE-2026-65570 WordPress Login with phone number plugin <= 1.8.70 - Bypass vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Login with phone number = 1.8.70 versions...

CVE-2026-65570

Technical details about CVE-2026-65570 are not publicly available in the provided documents. The records only state an unauthenticated bypass in the WordPress plugin up to version 1.8.70; no specifics on exploit vectors or fixes are included. Monitor for updates.

CVE-2026-32469 WordPress CAPTCHA 4WP plugin <= 7.6.0 - Captcha Bypass vulnerability

Unauthenticated Bypass Vulnerability in CAPTCHA 4WP = 7.6.0 versions...

EUVD-2026-53954

Unauthenticated Bypass Vulnerability in CAPTCHA 4WP = 7.6.0 versions...

CVE-2026-32469

The CVE-2026-32469 entry concerns the WordPress CAPTCHA 4WP plugin. Affected product: CAPTCHA 4WP

CVE-2026-70552

MaxSite CMS

CVE-2026-63456 Authentication bypass via spoofed HTTP headers Orchestrator REST API

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive...

WordPress Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin 10.8.7 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin' Parameter vulnerability

Unauthenticated Authentication Bypass via Hardcoded Backdoor in 'wplogin' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Advanced Responsive Video Embedder versions 10.8.7...

CVE-2026-12493

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin is affected up to version 1.3.6. The vulnerability stems from insufficient verification of external payment records: an approved payment may not be tied to the correct WooCommerce order, and the paid amount may not be validate...