WordPress FunnelKit Automations plugin <= 3.7.3 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Jakub Herman in WordPress Plugin FunnelKit Automations versions = 3.7.3...

WordPress ReviewX plugin <= 2.3.6 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Jakub Herman in WordPress Plugin ReviewX versions = 2.3.6...

WordPress BookIt plugin <= 2.5.1 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by davidfdzmorilla in WordPress Plugin BookIt versions = 2.5.1...

Exploit for CVE-2025-49901

CVE-2025-49901 WordPress Simple Link Directory Plugin 14...

CVE-2026-30702

The WiFi Extender WDR201A HW V2.1, FW LFMZX28040922V1.02 implements a broken authentication mechanism in its web management interface. The login page does not properly enforce session validation, allowing attackers to bypass authentication by directly accessing restricted web application endpoint...

CVE-2026-32519

CVE-2026-32519 affects Bit SMTP (WordPress plugin) with versions up to 1.2.2. The vulnerability is described as an Incorrect Privilege Assignment that enables privilege escalation. Public sources in Connected documents note the issue as a missing authorization/privilege control vulnerability, all...

CVE-2026-32519 WordPress Bit SMTP plugin <= 1.2.2 - Broken Authentication vulnerability

Incorrect Privilege Assignment vulnerability in Bit Apps Bit SMTP bit-smtp allows Privilege Escalation.This issue affects Bit SMTP: from n/a through = 1.2.2...

CVE-2026-32519 WordPress Bit SMTP plugin <= 1.2.2 - Broken Authentication vulnerability

Incorrect Privilege Assignment vulnerability in Bit Apps Bit SMTP bit-smtp allows Privilege Escalation.This issue affects Bit SMTP: from n/a through = 1.2.2...

CVE-2026-27073 WordPress Addi – Cuotas que se adaptan a ti plugin <= 2.0.4 - Broken Authentication vulnerability

Use of Hard-coded Credentials vulnerability in Addi Addi Cuotas que se adaptan a ti buy-now-pay-later-addi allows Password Recovery Exploitation.This issue affects Addi Cuotas que se adaptan a ti: from n/a through = 2.0.4...

CVE-2026-27073 WordPress Addi – Cuotas que se adaptan a ti plugin <= 2.0.4 - Broken Authentication vulnerability

Use of Hard-coded Credentials vulnerability in Addi Addi – Cuotas que se adaptan a ti buy-now-pay-later-addi allows Password Recovery Exploitation.This issue affects Addi – Cuotas que se adaptan a ti: from n/a through = 2.0.4...

CVE-2026-27073

CVE-2026-27073 is a WordPress plugin issue affecting Addi – Cuotas que se adaptan a ti, 2.0.4. The available connected sources do not provide explicit exploit details or in-the-wild activity beyond the vulnerability description and fixes. If you use this plugin, prioritize upgrading to a non-vul...

CVE-2026-25406

CVE-2026-25406 is a authentication bypass vulnerability in Themeum Tutor LMS Pro (tutor-pro) affecting versions up to and including 3.9.4. The issue is described as an authentication abuse via an alternate path or channel. Remediation from multiple sources recommends updating to a version later t...

WordPress Tutor LMS Pro plugin <= 3.9.4 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Phat RiO in WordPress Plugin Tutor LMS Pro versions = 3.9.4...

WordPress Bit SMTP plugin <= 1.2.2 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by johska in WordPress Plugin Bit SMTP versions = 1.2.2...

CVE-2026-25471

CVE-2026-25471 is cited in Wordfence as a vulnerability in the Admin Safety Guard (admin-safety-guard) plugin, affecting versions up to 1.2.6. The connected document indicates an authentication/authorization bypass, described as a Missing Authorization issue tied to Admin Safety Guard’s login/pas...

PT-2026-26108

The WiFi Extender WDR201A HW V2.1, FW LFMZX28040922V1.02 implements a broken authentication mechanism in its web management interface. The login page does not properly enforce session validation, allowing attackers to bypass authentication by directly accessing restricted web application endpoint...

CVE-2026-30702

The WiFi Extender WDR201A HW V2.1, FW LFMZX28040922V1.02 implements a broken authentication mechanism in its web management interface. The login page does not properly enforce session validation, allowing attackers to bypass authentication by directly accessing restricted web application endpoint...

CVE-2026-30702

The affected hardware is the WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02). The vulnerability is a broken authentication mechanism in the web management interface; the login page fails to enforce proper session validation, allowing attackers to bypass authentication by directly accessing...

WordPress LearnPress – Sepay Payment plugin <= 4.0.0 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Arif Shaikh in WordPress Plugin LearnPress Sepay Payment versions = 4.0.0...

WordPress Admin Safety Guard plugin <= 1.2.7 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Robert Akhmerov v31dt in WordPress Plugin Admin Safety Guard versions = 1.2.7...