PT-2026-103203

Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...

PT-2026-103486

Subscriber Broken Access Control in Optimole = 4.2.14 versions...

PT-2026-103048

The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of redirects when checking links, allowing unauthenticated attackers to bypass its internal-address filter and make the server send requests to internal services...

PT-2026-103169

Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms = 2.7.2 versions...

CVE-2026-94120: Missing Authorization

Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms = 2.7.2 versions...

CVE-2026-97247: Missing Authorization

Unauthenticated Broken Access Control in Blocksy Companion = 2.1.55 versions...

PT-2026-103230

Unauthenticated Broken Access Control in WordPress Backup & Migration = 1.6.0 versions...

PT-2026-103243

Unauthenticated Broken Access Control in Blocksy Companion = 2.1.55 versions...

CVE-2026-97243: Missing Authorization

Subscriber Broken Access Control in AllAble Connector = 0.13.4 versions...

PT-2026-103177

Subscriber Broken Access Control in FormGent = 1.12.2 versions...

ABSENTIA: Detecting Broken Access Control Vulnerabilities in Web Applications

Broken access control, the failure of authorization, is one of the most prevalent web security risks. Unlike injection, a flow of untrusted input into a dangerous operation, authorization is a relation: who may act on what, not how data moves. Each application decides that relation for itself, so...

CVE-2026-61519

Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability that allows any user holding a pending team invitation to invite additional attacker-controlled accounts with elevated privileges by exploiting a flawed authorization predicate in TeamPolicy::addTeamMember that grants...

CVE-2026-61519 Liberu CRM 0.9.1 < 10.0.0 Broken Access Control via TeamPolicy::addTeamMember()

Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability that allows any user holding a pending team invitation to invite additional attacker-controlled accounts with elevated privileges by exploiting a flawed authorization predicate in TeamPolicy::addTeamMember that grants...

EUVD-2026-89339

Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability that allows any user holding a pending team invitation to invite additional attacker-controlled accounts with elevated privileges by exploiting a flawed authorization predicate in TeamPolicy::addTeamMember that grants...

CVE-2026-61519 Liberu CRM 0.9.1 < 10.0.0 Broken Access Control via TeamPolicy::addTeamMember()

Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability that allows any user holding a pending team invitation to invite additional attacker-controlled accounts with elevated privileges by exploiting a flawed authorization predicate in TeamPolicy::addTeamMember that grants...

CVE-2026-61519

Liberu CRM versions prior to 10.0.0 are susceptible to a broken access control vulnerability within the TeamPolicy::addTeamMember() function. The root cause is a flawed authorization predicate that grants invitation rights based solely on a pending invitation email match, failing to validate priv...

CVE-2026-61519 Liberu CRM 0.9.1 < 10.0.0 Broken Access Control via TeamPolicy::addTeamMember()

Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability that allows any user holding a pending team invitation to invite additional attacker-controlled accounts with elevated privileges by exploiting a flawed authorization predicate in TeamPolicy::addTeamMember that grants...

EUVD-2026-88751

The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but...

WordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by onecomputerguy in WordPress Plugin Hostinger Migrator versions = 1.0...

WordPress AllAble Connector plugin <= 0.13.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin AllAble Connector versions = 0.13.4...