PT-2026-136928

The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the wcfmmp profile settings REST handler exposed at POST /mobile-builder/v1/wcfm-profile-settings. This is due to a PHP loose-comparison logic flaw in the meta key...

CVE-2026-118567

Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5...

EUVD-2026-113691

Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5...

CVE-2026-118567 Bulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-280

Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5...

CVE-2026-118567 Bulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-280

Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5...

CVE-2026-118567

The Bulk Update User Roles Drupal module (versions 0.0.0 to 1.0.5 ) contains an incorrect authorization vulnerability (CWE-863) that allows Forceful Browsing . The root cause is that the bulk update form fails to prevent access to users who lack the necessary permissions to assign roles. While th...

Drupal Bulk Update User Roles authorization issue vulnerability

In Drupal Bulk Update User Roles versions 0.0.0 through 1.0.5, there is an authorization issue vulnerability stemming from improper authorization checks, which may lead to forced browsing...

CVE-2026-118567: Drupal Bulk Update User Roles: Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing

Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5...

CVE-2026-94262

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that...

CVE-2026-94268

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage...

EUVD-2026-108605

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage...

CVE-2026-94268 Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage...

CVE-2026-94268 Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage...

CVE-2026-94268

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins (versions before 0.9.2.8 ) are vulnerable to an unauthenticated administrator account takeover . The root cause is an inconsistency in how the Forms module resolves the target of the update-user action...

CVE-2026-94262 Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that...

CVE-2026-94262

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins, in versions prior to 0.9.2.8 , are vulnerable to an unauthenticated account takeover . The root cause is a lack of authorization verification in the front-end Forms module during the update-user actio...

EUVD-2026-108602

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that...

CVE-2026-94262 Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that...

PT-2026-121778

Name of the Vulnerable Software and Affected Versions Advanced Custom Fields: Extended versions prior to 0.9.2.8 Advanced Custom Fields: Extended PRO versions prior to 0.9.2.8 Description The front-end Forms module fails to consistently resolve the target of the update-user action between the...

PT-2026-121775

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that...