CVE-2026-100632

Parse Server is an open-source backend server. In versions = 9.0.0 and 9.10.1-alpha.8, and in versions 8.6.89, LiveQuery evaluates the protectedFields class-level permission against an incompletely resolved caller identity: the subscriber's roles are not resolved, and when a subscription does not...

CVE-2026-100632 Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery

Parse Server is an open-source backend server. In versions = 9.0.0 and 9.10.1-alpha.8, and in versions 8.6.89, LiveQuery evaluates the protectedFields class-level permission against an incompletely resolved caller identity: the subscriber's roles are not resolved, and when a subscription does not...

WordPress Real Estate Manager Pro plugin <= 12.8.6 - Authenticated (Subscriber+) Privilege Escalation via 'user_has_cap' Filter ID Collision vulnerability

Authenticated Subscriber+ Privilege Escalation via 'userhascap' Filter ID Collision vulnerability discovered by 0xd4rk5id3 - EnvoraSec in WordPress Plugin Real Estate Manager Pro versions = 12.8.6...

CVE-2026-12976

The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in...

PT-2026-70997

The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in...

PT-2026-71009

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent...

CVE-2026-15230 YayPricing < 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupon Code Disclosure

The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, relying only on a shared nonce, allowing any authenticated user such as a subscriber to overwrite the store's pricing configuration and to disclose private coupon codes...

CVE-2026-14848

The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout belongs to the current user, allowing any authenticated user with Subscriber-level access and above to take over another member's...

CVE-2026-16295

The Clearfy Cache WordPress plugin, in versions prior to 2.4.3 , is vulnerable to Sensitive Information Disclosure due to a missing capability check in one of its admin-page dispatch paths. This flaw allows any authenticated user, such as a Subscriber , to access and render admin-only settings pa...

CVE-2026-10782 RealHomes Memberships <= 3.0.9 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass via 'ims_add_paypal_recurring_membership' AJAX Action

The RealHomes Memberships plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-14328 Eazy Plugin Manager <= 4.4.1 - Authenticated (Subscriber+) Privilege Escalation via pos_get_option AJAX Action and admin/login REST Endpoint

The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.1. This is due to insufficient authorization on the wpajaxposgetoption AJAX handler, which verifies only a nonce that is...

WordPress Advanced Form Integration plugin <= 2.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary MailUp OAuth Token Overwrite vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary MailUp OAuth Token Overwrite vulnerability discovered by Wordfence PRISM in WordPress Plugin Advanced Form Integration versions = 2.6.0...

CVE-2026-15802

The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'deletelocationsbackupfilecallback' function in all versions up to, and including, 4.9. This makes it possible for authenticated attackers, with subscriber-level access...

CVE-2026-63749: Incorrect Authorization

SurrealDB versions before 3.1.0 contain an authentication bypass vulnerability in LIVE SELECT subscriptions where permission expressions referencing $value, $before, $after, or $event are evaluated against attacker-controlled bindings instead of actual documents. Authenticated subscribers can bin...

CVE-2026-14503 pCloud WP Backup <= 2.0.3 - Missing Authorization on the 'start_backup' AJAX Method to Authenticated (Subscriber+) Arbitrary File Read

The pCloud WP Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.3 via the wp2pclajaxprocessrequestinner. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract force generation of a...

WordPress WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel plugin <= 8.0.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution vulnerability

Missing Authorization to Authenticated Subscriber+ Remote Code Execution vulnerability discovered by daroo in WordPress Plugin WP Ultimate CSV Importer versions = 8.0.1...

CVE-2026-12941

The MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-12941

The MultiVendorX plugin for WordPress (WooCommerce Multivendor) ≤ 5.0.9 is vulnerable to a generic SQL Injection via the order_by parameter. Root cause: insufficient escaping of user input and lack of proper query preparation. Attack requires an authenticated user with subscriber-level access; vi...

EUVD-2026-44860

The MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient...

WordPress Academy LMS plugin <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference vulnerability

Authenticated Subscriber+ Insecure Direct Object Reference vulnerability discovered by sorawautsukushiii in WordPress Plugin Academy LMS versions = 3.8.0...