WordPress Benaa Framework plugin <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Settings Updates vulnerability

Missing Authorization to Authenticated Subscriber+ Settings Updates vulnerability discovered by Lucio Sá in WordPress Plugin Benaa Framework versions = 4.0.0...

WordPress Beyot Framework plugin <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Settings Updates vulnerability

Missing Authorization to Authenticated Subscriber+ Settings Updates vulnerability discovered by Lucio Sá in WordPress Plugin Beyot Framework versions = 6.0.6...

WordPress Auteur Framework plugin <= 7.1 - Missing Authorization to Authenticated (Subscriber+) Settings Updates vulnerability

Missing Authorization to Authenticated Subscriber+ Settings Updates vulnerability discovered by Lucio Sá in WordPress Plugin Auteur Framework versions = 7.1...

WordPress April Framework plugin <= 5.1 - Missing Authorization to Authenticated (Subscriber+) Settings Updates vulnerability

Missing Authorization to Authenticated Subscriber+ Settings Updates vulnerability discovered by Lucio Sá in WordPress Plugin April Framework versions = 5.1...

CVE-2025-52289

A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a crafted request to /mbilling/index.php/user/save to set their account status fom "pending" to "active" without requiring administrator approval...

WordPress StoreKeeper for WooCommerce Plugin <= 14.4.4 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by theviper17 in WordPress Plugin StoreKeeper for WooCommerce versions = 14.4.4...

WordPress SureDash Plugin <= 1.1.0 - Sensitive Data Exposure Vulnerability

Sensitive Data Exposure Vulnerability discovered by Denver Jackson in WordPress Plugin SureDash versions = 1.1.0...

CVE-2025-52289

A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a crafted request to /mbilling/index.php/user/save to set their account status fom "pending" to "active" without requiring administrator approval...

CVE-2025-52289

A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a crafted request to /mbilling/index.php/user/save to set their account status fom "pending" to "active" without requiring administrator approval...

CVE-2025-52289

CVE-2025-52289 affects MagnusBilling v7.8.5.3 and is a Broken Access Control vulnerability where newly registered users can escalate privileges by sending a crafted request to /mbilling/index.php/user/save to change status from "pending" to "active" without admin approval. The issue’s remediation...

PT-2025-31528 · Unknown · Magnusbilling

Name of the Vulnerable Software and Affected Versions: MagnusBilling version 7.8.5.3 Description: A broken access control issue in MagnusBilling version 7.8.5.3 allows newly registered users to gain escalated privileges. This is achieved by sending a crafted request to the...

CVE-2025-52289

A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a crafted request to /mbilling/index.php/user/save to set their account status fom "pending" to "active" without requiring administrator approval...

WordPress WpEvently plugin <= 4.4.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Denver Jackson in WordPress Plugin WpEvently versions = 4.4.6...

WordPress HT Mega Plugin plugin <= 2.9.0 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Denver Jackson in WordPress Plugin HT Mega versions = 2.9.0...

WordPress Button Block Plugin plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Button Block versions = 1.2.0...

WordPress TheBooking Plugin <= 1.4.4 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Nguyen Ngoc Quang Bach maysbachs in WordPress Plugin TheBooking versions = 1.4.4...

Drupal Config Pages module < 2.18.0 - Authenticated Broken Access Control vulnerability

Authenticated Broken Access Control vulnerability discovered by Pierre Rudloff prudloff in WordPress Module Config Pages versions 2.18.0...

WordPress Bonanza – WooCommerce Free Gifts Lite plugin <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Opt In Success vulnerability

Missing Authorization to Authenticated Subscriber+ Opt In Success vulnerability discovered by Poli in WordPress Plugin Bonanza – WooCommerce Free Gifts Lite versions = 1.0.0...

WordPress Brizy plugin <= 2.6.20 - Missing Authorization to Unauthenticated Limited File Upload vulnerability

Missing Authorization to Unauthenticated Limited File Upload vulnerability discovered by mikemyers in WordPress Plugin Brizy versions = 2.6.20...

WordPress Custom API for WP <= 4.2.2 - Privilege Escalation Vulnerability

Privilege Escalation Vulnerability discovered by Hiro Code016Hiro in WordPress Plugin Custom API for WP versions = 4.2.2...