CVE-2026-72829 Grav before 1.0.13 API Key Scope Bypass via UsersController

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope-cap bypass in UsersController's create and update methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin check that reads access.api.super...

CVE-2026-72829

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope-cap bypass in UsersController's create and update methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin check that reads access.api.super...

EUVD-2026-58643

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope-cap bypass in UsersController's create and update methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin check that reads access.api.super...

CVE-2026-72824 Grav before 1.0.13 API Key Scope Bypass via PagesController

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent. The Twig-toggle check uses a bare isSuperAdmin gate that does not consult apikeyscopes, so a least-privilege API key scoped only to api.pages.write and minted on a...

CVE-2026-72824

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent. The Twig-toggle check uses a bare isSuperAdmin gate that does not consult apikeyscopes, so a least-privilege API key scoped only to api.pages.write and minted on a...

CVE-2026-16041

The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores...

CVE-2026-16039

The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information...

CVE-2026-16030

The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including...

CVE-2026-14602

The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects, which can lead to remote code execution when a suitable gadget chain is present through another installed Remot...

CVE-2026-14602 Remote API <= 0.2 - Unauthenticated PHP Object Injection via remote-api Query Parameter

The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects, which can lead to remote code execution when a suitable gadget chain is present through another installed Remot...

CVE-2026-14602

The CVE-2026-14602 entry concerns the Remote API WordPress plugin (version &lt;= 0.2). The issue is that it does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects. This can lead to remote code execution when a s...

CVE-2026-65897 Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership,...

CVE-2026-65897 Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership,...

EUVD-2026-48247

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership,...

CVE-2026-65896

Grav API Plugin Composer package getgrav/grav-plugin-api before 1.0.10 fails to properly validate the slug field in the POST /pages/route/move endpoint. PagesController::move sanitizes the slug only with ltrim$body'slug', '.', which strips leading periods but does not neutralize '/' or '..'...

CVE-2026-65895 Grav API Plugin before 1.0.10 Broken Access Control

Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential...

CVE-2026-65896

CVE-2026-65896 affects Grav API Plugin (getgrav/grav-plugin-api) versions before 1.0.10. PagesController::move() sanitizes only leading dots via ltrim($body['slug'], '.') and does not neutralize '/' or '..' segments, enabling an authenticated api.pages.write user to perform path traversal (e.g., ...

CVE-2026-65896 Grav API Plugin before 1.0.10 Path Traversal via move

Grav API Plugin Composer package getgrav/grav-plugin-api before 1.0.10 fails to properly validate the slug field in the POST /pages/route/move endpoint. PagesController::move sanitizes the slug only with ltrim$body'slug', '.', which strips leading periods but does not neutralize '/' or '..'...

CVE-2026-65895

CVE-2026-65895 affects Grav API Plugin prior to 1.0.10. The issue allows an authenticated user with the api.config.write privilege to modify security-critical plugin configuration scopes, namely rate limiting and CORS. This can disable site-wide rate limiting (facilitating credential brute-forcin...

CVE-2026-65895 Grav API Plugin before 1.0.10 Broken Access Control

Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential...