WordPress Sydney Theme <= 2.56 is vulnerable to Broken Access Control

Software Sydney Type Theme Vulnerable versions = 2.56 Fixed in 2.57 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2025-8999 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 2b984ceb50d6 Credits Dmitrii Ignatyev Required privilege...

CVE-2025-37125

A broken access control vulnerability exists in HPE Aruba Networking EdgeConnect OS ECOS. Successful exploitation could allow an attacker to bypass firewall protections, potentially leading to unauthorized traffic being handled improperly...

CVE-2025-37125 Broken access control vulnerability in Firewall Configuration Leads to Unauthorized Access to Internal Network Resources

A broken access control vulnerability exists in HPE Aruba Networking EdgeConnect OS ECOS. Successful exploitation could allow an attacker to bypass firewall protections, potentially leading to unauthorized traffic being handled improperly...

WordPress Wide Banner plugin <= 1.0.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Wide Banner versions = 1.0.4...

WordPress Blaze Demo Importer plugin <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install vulnerability

Missing Authorization to Authenticated Subscriber+ Limited Plugin Install vulnerability discovered by wesley wcraft in WordPress Plugin Blaze Demo Importer versions = 1.0.12...

WordPress Accordion plugin <= 2.3.14 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Abu Hurayra in WordPress Plugin Accordion versions = 2.3.14...

WordPress The Events Calendar plugin <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure vulnerability

Missing Authorization to Unauthenticated Password-Protected Information Disclosure vulnerability discovered by Miguel Santareno in WordPress Plugin The Events Calendar versions = 6.15.2...

WordPress WPLMS plugin <= 1.9.9.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin WPLMS versions = 1.9.9.7...

WordPress ListingPro theme < 2.9.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Theme ListingPro versions 2.9.10...

Automated Testing of Broken Authentication Vulnerabilities in Web APIs with AuthREST

We present AuthREST, an open-source security testing tool targeting broken authentication, one of the most prevalent API security risks in the wild. AuthREST automatically tests web APIs for credential stuffing, password brute forcing, and unchecked token authenticity. Empirical results show that...

WordPress Rank Math SEO plugin <= 1.0.252.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Abu Hurayra in WordPress Plugin Rank Math SEO versions = 1.0.252.1...

WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.4.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by ? in WordPress Plugin Recipe Card Blocks for Gutenberg & Elementor versions = 3.4.8...

WordPress Time Tracker plugin <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Limited Data Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Options Update and Limited Data Deletion vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Time Tracker versions = 3.1.0...

WordPress My WP Translate plugin <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Options Update vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin My WP Translate versions = 1.1...

WordPress My WP Translate plugin <= 1.1 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Option Read and Deletion vulnerability

Authenticated Subscriber+ Missing Authorization to Arbitrary Option Read and Deletion vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin My WP Translate versions = 1.1...

WordPress Ultimate Classified Listings plugin <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update vulnerability

Missing Authorization to Authenticated Subscriber+ Plugin Settings Update vulnerability discovered by Ivan Kuzymchak in WordPress Plugin Ultimate Classified Listings versions = 1.6...

WordPress Salon booking system plugin <= 10.22 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by CodeCheq Devs in WordPress Plugin Salon booking system versions = 10.22...

PT-2025-37149

The AutoCatSet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.4. This is due to missing or incorrect nonce validation on the autocatset ajax function. This makes it possible for unauthenticated attackers to trigger automatic...

WordPress XStore theme < 9.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Theme XStore versions 9.6...

WordPress NitroPack plugin <= 1.18.4 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update via nitropack_set_compression_ajax Function vulnerability

Missing Authorization to Authenticated Subscriber+ Limited Settings Update via nitropacksetcompressionajax Function vulnerability discovered by Peter Thaleikis in WordPress Plugin NitroPack versions = 1.18.4...