EUVD-2026-85493

Unauthenticated Bypass Vulnerability in WP User Frontend = 4.3.11 versions...

CVE-2026-95524

The WP User Frontend WordPress plugin, affecting versions

EUVD-2026-85489

Unauthenticated Bypass Vulnerability in Netgsm = 2.10.0 versions...

CVE-2026-95514

The Netgsm WordPress plugin, affecting versions

EUVD-2026-85478

Unauthenticated Bypass Vulnerability in Captcha Code = 3.32 versions...

CVE-2026-94457

The WordPress Captcha Code plugin (versions ≤ 3.32 ) is vulnerable to an unauthenticated bypass vulnerability. While the specific root cause and practical consequences are not detailed in the provided documents, the flaw allows for a bypass of security measures. No specific exploits, mitigation s...

CVE-2021-26088

PoC for CVE-2021-26088 用 PowerShell 编写 描述 FSSO Collector 中的认证漏洞可能允许未经认证的用户绕过任何防火墙认证规则，通过发送特制的 UDP 登录通知数据包访问受保护的网络。 https://www.fortiguard.com/psirt/FG-IR-20-191 内容 forgeauth.ps1：主要利用脚本 checksrcport.ps1：获取分配给当前用户的源端口范围 免责声明...

CVE-2026-10795-Lab

CVE Lab: CVE-2026-10795 - 通过 UpdraftCentral RPC 身份认证绕过连锁利用实现插件安装 执行摘要 此仓库包含一个本地 Docker 实验室，用于重现和验证 CVE-2026-10795，这是一个未认证的身份认证绕过漏洞，影响通过其 UpdraftCentral 远程通信层的 UpdraftPlus WordPress 插件。 易受攻击的行为存在于 UpdraftCentral RPC 消息处理流程中。在易受攻击的版本中，伪造的 format=1 RPC 消息可以绕过签名验证，触发失败的 RSA 解密路径，并仍然以可预测的 null key/nul...

CVE-2026-86800

The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange,...

PT-2026-92068

FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS...

CVE-2026-82215

The Payment Gateway PayPay for WooCommerce WordPress plugin (versions 0.5 through 0.9.3) fails to verify the authenticity of incoming payment notification webhooks before acting on them. An unauthenticated attacker who knows a store's merchant identifier can mark arbitrary orders as paid , or can...

CVE-2026-82215 WC PayPay Gateway 0.5 - 0.9.3 - Unauthenticated Payment Bypass via Unverified Webhook

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...

CVE-2026-66674

Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile = 1.42.1 versions...

EUVD-2026-75512

Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile = 1.42.1 versions...

PT-2026-89426

Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile = 1.42.1 versions...

WordPress B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More plugin < 5.2.40 - Unauthenticated B2B Group Assignment and Approval Bypass vulnerability

Unauthenticated B2B Group Assignment and Approval Bypass vulnerability discovered by Farid Narimanov in WordPress Plugin B2BKing versions 5.2.40...

CVE-2026-85038 B2BKing < 5.2.40 - Unauthenticated B2B Group Assignment and Approval Bypass via Registration Role Selection

The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to...

CVE-2026-85038

The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin (versions before 5.2.40 ) contains a vulnerability where it fails to verify that a selected role during registration matches the roles offered on the registration form. This flaw allows unauthenticated users to assign themselves to restr...

CVE-2026-84428

fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the...

CVE-2026-84043 ePayco Payment Gateway for WooCommerce < 8.4.7 - Unauthenticated Payment Confirmation Bypass

The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation requests, allowing unauthenticated attackers to mark orders as paid without a valid gateway signature...