PT-2026-89293

The zipMoneyZip Co Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options...

PT-2026-89450

Unauthenticated Broken Access Control in WP Fast Total Search = 1.82.284 versions...

CVE-2026-81787: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in IMPress for IDX Broker = 3.3.0 versions...

PT-2026-89438

Name of the Vulnerable Software and Affected Versions Salon booking system versions prior to 10.31.9 Description Salon booking system contains a missing authorization flaw that allows the exploitation of incorrectly configured access control security levels. Recommendations Update to version...

PT-2026-89441

Name of the Vulnerable Software and Affected Versions WP Travel versions prior to 12.0.4 Description An authentication bypass issue exists via an alternate path or channel, which allows for password recovery exploitation. Recommendations Update to version 12.0.4 or later...

CVE-2026-81794: Missing Authorization

Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions...

CVE-2026-81793: Missing Authorization

Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon booking system: from n/a through 10.31.9...

PT-2026-89432

Unauthenticated Broken Access Control in BuddyForms = 2.9.0 versions...

CVE-2026-81786: Missing Authorization

Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce = 1.2.2 versions...

PT-2026-89442

Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce = 4.6.4 versions...

CVE-2026-81799: Missing Authorization

Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce = 4.6.4 versions...

PT-2026-89433

Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce = 1.2.2 versions...

PT-2026-89592

IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration. This could result in information disclosure or denial of service...

PT-2026-89427

Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce = 1.8.9 versions...

PT-2026-89482

Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or...

PT-2026-89430

Subscriber Broken Authentication in MailMunch – Grow your Email List = 3.2.5 versions...

CVE-2026-81788: Missing Authorization

Subscriber Broken Access Control in IMPress for IDX Broker = 3.3.0 versions...

CVE-2026-78536: Missing Authorization

Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce = 1.8.9 versions...

PT-2026-89365

There is an Vulnerability in some HikCentral Access Control versions. Authenticated low-privilege users can invoke API interfaces that their role is not authorized to access...

PT-2026-89260

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK EDITOR permission to plant a VQL...