733 matches found
EUVD-2026-85042
The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes...
EUVD-2026-85038
The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published...
CVE-2026-86603: Exposure of Sensitive Information to an Unauthorized Actor
The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to retrieve the IDs and titles of other users' unpublished lists...
CVE-2026-93952
creationtimestamp| type| source ---|---|--- 2026-09-22 07:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mw3qipnnvk2t 2026-09-22 09:00:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/117313871866403815 2026-09-22 09:00:28+00:00| seen|...
CVE-2026-93455 django-page-cms through 2.0.13 Unauthorized Content Access via Staff Account
django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page...
WP < 7.1.1 - Contributor+ Unpublished Post Title Disclosure
Description WordPress does not check that the user is allowed to access a post before returning its sample permalink in some cases, which could allow users with a role as low as contributor to retrieve the titles of other users' draft and pending posts...
WordPress LearnPress plugin 4.2.7.1-4.4.6 - Unauthenticated Unpublished Course Disclosure vulnerability
Unauthenticated Unpublished Course Disclosure vulnerability discovered by Sai Praneeth Koti in WordPress Plugin LearnPress versions 4.2.7.1-4.4.6...
CVE-2026-86449
The LearnPress WordPress plugin (versions 4.2.7.1-4.4.6 ) is vulnerable to an unauthenticated information disclosure flaw. The root cause is a failure to verify user capabilities before applying a user-supplied post status filter within one of its REST routes . This allows unauthenticated attacke...
CVE-2026-89026
creationtimestamp| type| source ---|---|--- 2026-09-15 18:08:59+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvl7sxnjy62j 2026-09-15 18:20:09+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvlagwcy572w 2026-09-16 13:16:18+00:00| seen|...
CVE-2026-91998
creationtimestamp| type| source ---|---|--- 2026-09-15 13:27:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6qzzxavbnrej6 2026-09-15 14:08:20+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvksenru5t2f 2026-09-15 17:30:04+00:00| seen|...
CVE-2026-18232
The WP Directory Kit WordPress plugin, in versions through 1.5.7 , is vulnerable to an unauthenticated unpublished listing disclosure . The root cause is a failure to validate the status or ownership of a listing before returning its content via a public AJAX action (specifically identified as ma...
WordPress WP Directory Kit plugin <= 1.5.7 - Unauthenticated Unpublished Listing Disclosure vulnerability
Unauthenticated Unpublished Listing Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Directory Kit versions = 1.5.7...
CVE-2026-86283
creationtimestamp| type| source ---|---|--- 2026-09-14 01:00:04+00:00| seen| https://t.me/GithubRedTeam/102243 2026-09-14 03:00:06+00:00| seen| Telegram/HpvRlDBORm0kLsO1zg2R5Kugqpwi6YOLawI6LgE5lPyRWI 2026-09-15 00:00:30+00:00| published-proof-of-concept|...
CVE-2026-73315
creationtimestamp| type| source ---|---|--- 2026-09-08 15:00:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muzbzzw62s22 2026-09-08 15:12:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2utzt2ez7wxpe...
CVE-2026-86165
creationtimestamp| type| source ---|---|--- 2026-09-05 18:19:05+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117219809348083174 2026-09-06 04:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mut46qvwjy2j 2026-09-06 05:52:24+00:00| seen|...
CVE-2026-84745 The Events Calendar < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API
The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other...
CVE-2026-84745 The Events Calendar < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API
The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other...
PT-2026-86348
šØ CVE-2026-84745 The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site,...
CVE-2026-80848
creationtimestamp| type| source ---|---|--- 2026-09-04 19:51:25+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117214510129353453 2026-10-01 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20261002...
Incorrect Authorization
Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Incorrect Authorization due to insufficient permission checks on admin content pages. An attacker can access unpublished content by leveraging add...