CVE-2026-12853

The Flamingo plugin for WordPress (versions up to and including 2.6.2 ) is vulnerable to an authorization bypass. The plugin's flamingo_map_meta_cap() filter restricts access to its admin UI but does not extend to WordPress core APIs, specifically XML-RPC wp.getTerms and admin-ajax ajax-tag-searc...