CVE-2026-123703

The Security For WooCommerce WordPress plugin (versions

CVE-2026-123703 Security For WooCommerce <= 1.0.16 - Unauthenticated Arbitrary User Logout via usfw_user_force_logout

The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before ending a user's login sessions, allowing unauthenticated visitors to log out any user, including administrators, and to keep them logged out by repeating the request...

WordPress Security For WooCommerce plugin <= 1.0.16 - Unauthenticated Arbitrary User Logout vulnerability

Unauthenticated Arbitrary User Logout vulnerability discovered by Benjamin Kincses Dextheking1 in WordPress Plugin Ultimate Security For WooCommerce: IP Restriction, Password Policy and More versions = 1.0.16...

WordPress Advanced Appointment Booking & Scheduling plugin < 2.7 - Unauthenticated Arbitrary User Registration vulnerability

Unauthenticated Arbitrary User Registration vulnerability discovered by Daniel Dhaniswara in WordPress Plugin Advanced Appointment Booking & Scheduling versions 2.7...

CVE-2026-81422

The Advanced Appointment Booking & Scheduling WordPress plugin (versions before 2.7 ) contains a vulnerability where it fails to verify the site's user-registration setting when creating accounts via a publicly accessible shortcode . This flaw allows unauthenticated attackers to register arbitrar...

CVE-2026-81422 Advanced Appointment Booking & Scheduling < 2.7 - Unauthenticated Arbitrary User Registration

The Advanced Appointment Booking & Scheduling WordPress plugin before 2.7 does not verify the site's user-registration setting before creating accounts through a publicly accessible shortcode, allowing unauthenticated attackers to register arbitrary user accounts, and be automatically logged in,...

CVE-2026-81422 Advanced Appointment Booking & Scheduling < 2.7 - Unauthenticated Arbitrary User Registration

The Advanced Appointment Booking & Scheduling WordPress plugin before 2.7 does not verify the site's user-registration setting before creating accounts through a publicly accessible shortcode, allowing unauthenticated attackers to register arbitrary user accounts, and be automatically logged in,...

CVE-2026-104338

The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not perform an authorization check on one of its REST routes and derives the acting user's identity from an unauthenticated request parameter, allowing an unauthenticated attacker to cause the request to execute as an arbitrary user...

EUVD-2026-119472

The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not perform an authorization check on one of its REST routes and derives the acting user's identity from an unauthenticated request parameter, allowing an unauthenticated attacker to cause the request to execute as an arbitrary user...

PT-2026-139903

The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not perform an authorization check on one of its REST routes and derives the acting user's identity from an unauthenticated request parameter, allowing an unauthenticated attacker to cause the request to execute as an arbitrary user...

CVE-2026-110972

Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user. This issue was fixed in metric 334 in version 10.02.002...

CVE-2026-110972 Use of Client-Side Authentication in Płatnik

Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user. This issue was fixed in metric 334 in version 10.02.002...

CVE-2026-110972: Zakład Ubezpieczeń Społecznych Płatnik: Płatnik performs client-side authentication

Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user. This issue was fixed in metric 334 in version 10.02.002...

PT-2026-133450

Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user. This issue was fixed in metric 242 in version 10.02.002...

npm: mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths

npm: mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths vulnerability discovered by ? in WordPress npm mcp-sanitizer versions 1.4.0...

CVE-2026-58255 Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with createevents and runevents privileges can inject top-level uid and gid fields through /api/app/createevent or /api/app/updateevent. In lib/api.js,...

CVE-2026-58255 Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with createevents and runevents privileges can inject top-level uid and gid fields through /api/app/createevent or /api/app/updateevent. In lib/api.js,...

WordPress MasterStudy LMS WordPress Plugin plugin 3.7.13-3.7.54 - Instructor+ Arbitrary User Display Name Update vulnerability

Instructor+ Arbitrary User Display Name Update vulnerability discovered by Arman Kumar in WordPress Plugin MasterStudy LMS versions 3.7.13-3.7.54...

Astra Linux – vulnerability in wget

Applications that use Wget to access a remote resource via short URLs and accept arbitrary user credentials in the URL are vulnerable. In such cases, attackers can supply specially crafted credentials, causing Wget to connect to any desired host...

CVE-2026-92978 User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect...