CVE-2022-0236

CVE-2022-0236 WP Import Export WordPress प्लगइन एक गैर-प्रमाणित संवेदनशील डेटा प्रकटीकरण के लिए कमजोर है, क्योंकि /includes/classes/class-wpie-general.php फ़ाइल में पाए जाने वाले डाउनलोड फ़ंक्शन wpieprocessfiledownload पर क्षमता जांच capability check गायब है। इससे गैर-प्रमाणित हमलावरों के लिए एक...

CVE-2024-43918

Wordpress WBW Product Table Pro = 1.9.4 - Неаутентифицированное произвольное выполнение SQL-запросов с переходом к удалённому выполнению кода CVE-2024-43918 Плагин WBW Product Table Pro для WordPress уязвим к неавторизованному произвольному выполнению SQL-запросов из-за отсутствия проверки прав...

CVE-2026-78138

The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user Subscriber and above to read the Finale Lite WordPress plugin before 2.21.0's campaign...

CVE-2026-16569

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber...

CVE-2026-78138 Finale Lite < 2.21.0 - Subscriber+ Campaign Configuration Disclosure via wcct_quick_view_html

The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user Subscriber and above to read the Finale Lite WordPress plugin before 2.21.0's campaign...

CVE-2026-78138

CVE-2026-78138 is a missing capability check in the Finale Lite WordPress plugin (versions

EUVD-2026-66883

The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user Subscriber and above to read the Finale Lite WordPress plugin before 2.21.0's campaign...

CVE-2026-16569 ShopApper <= 0.4.62 - Subscriber+ Arbitrary Product Stock Update

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber...

CVE-2026-16569

ShopApper (The Mobile App for WooCommerce) WordPress plugin versions through 0.4.62 (Patchstack reports affected up to 0.4.66) lack a capability check on a REST endpoint that handles stock-update operations. This allows any authenticated user with Subscriber role or higher to modify the stock qua...

EUVD-2026-66872

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber...

User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Attachment Deletion

The WP User Frontend plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check in the FrontendFormAjax::submitpost function. This makes it possible for unauthenticated attackers to delete attachment records through the plugin's AJAX handling when a public...

Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Control

The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the installoractivateaddonplugins function and a weak nonce hash in all...

CVE-2024-10586-Poc

Информация об уязвимости Описание Плагин Debug Tool для WordPress уязвим к произвольному созданию файлов из-за отсутствия проверки прав доступа в функции dbtpullimage и отсутствия проверки типа файла во всех версиях до 2.2 включительно. Это позволяет неаутентифицированным злоумышленникам создават...

CVE-2024-2782-PoC

CVE-2024-2782-PoC CVE-2024-2782 Доказательство концепции Плагин Contact Form от Fluent Forms для Quiz, Survey, и Drag & Drop WP Form Builder для WordPress уязвим к несанкционированному изменению данных из-за отсутствия проверки прав доступа на конечной точке REST API...

CVE-2024-10124-Poc

CVE-2024-10124-Poc إن إضافة Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce في ووردبريس عرضة للتثبيت والتفعيل العشوائي غير المصرح به للإضافات بسبب عدم وجود فحص للصلاحيات في الدالة tpinstall في جميع الإصدارات حتى 1.1.1 وما يشملها. وهذا يتيح للمهاجمين غير المصادَق عليهم تثبيت وتفعيل إضاف...

CVE-2024-7135

CVE-2024-7135 إن إضافة Tainacan لـ WordPress معرضة للوصول غير المصرح به إلى البيانات بسبب عدم وجود فحص للصلاحية في الدالة 'getfile' في جميع الإصدارات حتى 0.21.7 وما يشملها. كما أن الدالة معرضة أيضًا لثغرة اجتياز الدليل directory traversal. وهذا يتيح للمهاجمين المصادق عليهم، من مستوى Subscriber فم...

CVE-2024-12542-PoC

CVE-2024-12542-PoC Mancanza di autorizzazione all'esposizione non autenticata di informazioni sensibili Descrizione della vulnerabilità Il plugin linkID per WordPress è vulnerabile all'accesso non autorizzato ai dati a causa della mancanza di un controllo delle capacità quando include la funzione...

CVE-2023-4800

ID do CVE: CVE-2023-4800 Tipo de Vulnerabilidade: Exposição de Dados Sensíveis Descrição: O plugin DoLogin Security para WordPress é vulnerável a acesso não autorizado de dados devido à falta de uma verificação de capacidade no widget do painel em versões até a 3.7 inclusive. Isso possibilita que...

CVE-2024-3553

CVE-2024-3553 Tutor LMS = 2.6.2 - Autorizzazione mancante per aggiornamento non autenticato di opzioni limitate Il plugin Tutor LMS – soluzione eLearning e corsi online per WordPress è vulnerabile a modifiche non autorizzate dei dati a causa di un controllo di capacità mancante sulla funzione...

CVE-2024-5326-Poc

CVE-2024-5326 CVE-2024-5326 Post Grid Gutenberg Blocks e Plugin Blog WordPress – PostX = 4.1.2 - Autorizzazione Mancante per l'Aggiornamento Arbitrario delle Opzioni Descrizione Il plugin Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX per WordPress è vulnerabile a modifiche non...