CVE-2025-68049 WordPress bunny.net plugin <= 2.3.6 - Broken Access Control vulnerability

Subscriber Broken Access Control in bunny.net = 2.3.6 versions...

What Changed in OWASP Top 10 2025 and Recommendations for Each Category

Key Takeaways 1. The 2025 list introduces two new categories – Software Supply Chain Failures A03 and Mishandling of Exceptional Conditions A10 - reflecting attacks already happening in production. 2. Security Misconfiguration jumping from 5 to 2 signals that continuous deployment without...

CVE-2025-64215

CVE-2025-64215 affects WordPress MasterStudy LMS Pro (StylemixThemes) prior to 4.7.16. The issue is a Missing Authorization vulnerability causing Broken Access Control by allowing access to functionality not properly constrained by ACLs. The publicly cited source (Patchstack) lists the vulnerabil...

CVE-2026-48969 WordPress Really Simple SSL plugin <= 9.5.9 - Broken Access Control vulnerability

Subscriber Broken Access Control in Really Simple SSL = 9.5.9 versions...

EUVD-2026-36723

Subscriber Broken Access Control in Really Simple SSL = 9.5.9 versions...

CVE-2026-48969

CVE-2026-48969 describes a Broken Access Control vulnerability in the WordPress plugin Really Simple SSL prior to or equal to version 9.5.9 . The initial description and connected records confirm the affected product and version range; the CVSS metrics indicate a Network attack vector with Low pr...

PT-2026-49486

Unauthenticated Broken Access Control in TrueBooker = 1.1.9 versions...

PT-2026-49431

Subscriber Broken Access Control in myCred = 3.0.3 versions...

PT-2026-49457

Unauthenticated Broken Access Control in Salon booking system = 10.30.25 versions...

PT-2026-49396

Unauthenticated Broken Access Control in Masteriyo - LMS = 2.1.5 versions...

PT-2026-49364

Name of the Vulnerable Software and Affected Versions Rank Math SEO versions prior to 1.0.272 Description Broken access control allows users with the Subscriber role to perform unauthorized actions within the plugin. Recommendations Update to version 1.0.272 or later...

PT-2026-49365

Unauthenticated Broken Access Control in Event Tickets Manager for WooCommerce = 1.5.3 versions...

PT-2026-49412

Unauthenticated Broken Access Control in wpForo Forum 3.0.2 versions...

PT-2026-49473

Unauthenticated Broken Access Control in Contact Form by WPForms = 1.10.0.4 versions...

PT-2026-49417

Subscriber Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress = 4.7.9 versions...

PT-2026-49409

Unauthenticated Broken Access Control in Tutor LMS = 3.9.7 versions...

PT-2026-49506

Unauthenticated Broken Access Control in Knit Pay = 9.4.0.0 versions...

PT-2026-49419

Unauthenticated Broken Access Control in Royal MCP = 1.4.2 versions...

PT-2026-49362

Unauthenticated Broken Access Control in Simple Membership = 4.7.1 versions...

PT-2026-49491

Name of the Vulnerable Software and Affected Versions JS Help Desk versions prior to 3.0.10 Description Broken Access Control allows unauthenticated users to bypass security restrictions. Recommendations Update to version 3.0.10 or later...