PT-2025-36578

Name of the Vulnerable Software and Affected Versions: AutomatorWP – Automator plugin for WordPress versions prior to 5.3.7 Description: The AutomatorWP – Automator plugin for WordPress is susceptible to unauthorized data modification due to a missing capability check on the automatorwp ajax impo...

CVE-2025-9542: Missing Authorization

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on multiple plugin's functions in all versions up to, and including, 5.3.7...

WordPress Plugin AutomatorWP has a code injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

WordPress plugin AutomatorWP has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2025-36579

Name of the Vulnerable Software and Affected Versions: AutomatorWP – Automator plugin for WordPress versions through 5.3.7 Description: The AutomatorWP – Automator plugin for WordPress is susceptible to unauthorized access and modification of data. This is due to a missing capability check on...

PT-2025-36850

Name of the Vulnerable Software and Affected Versions: Capability Access Management Service camsvc affected versions not specified Description: A race condition exists within the Capability Access Management Service camsvc due to improper synchronization during concurrent execution using a shared...

CVE-2025-7045

The Cloud SAML SSO plugin for WordPress is vulnerable to Identity Provider Deletion due to a missing capability check on the deleteconfig action of the cssohandleactions function in all versions up to, and including, 1.0.19. This makes it possible for unauthenticated attackers to delete any...

CVE-2025-7040

The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'setorganizationsettings' action of the cssohandleactions function in all versions up to, and including, 1.0.19. The handler reads client-supplied POST parameters fo...

CVE-2025-7040 Cloud SAML SSO <= 1.0.19 - Missing Authorization to Unauthenticated Settings Modification via set_organization_settings Action

The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'setorganizationsettings' action of the cssohandleactions function in all versions up to, and including, 1.0.19. The handler reads client-supplied POST parameters fo...

CVE-2025-7040

The Wordfence Vulnerability (CVE-2025-7040) affects the Cloud SAML SSO plugin for WordPress up to version 1.0.19. The issue is a missing capability check on the set_organization_settings action inside csso_handle_actions(), allowing unauthenticated attackers to submit POST data that is passed dir...

PT-2025-36357

Name of the Vulnerable Software and Affected Versions: Cloud SAML SSO plugin for WordPress versions up to and including 1.0.19 Description: The Cloud SAML SSO plugin for WordPress is susceptible to Identity Provider Deletion. A missing capability check on the delete config action within the csso...

CVE-2025-7040: Missing Authorization

The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'setorganizationsettings' action of the cssohandleactions function in all versions up to, and including, 1.0.19. The handler reads client-supplied POST parameters fo...

PT-2025-36356

Name of the Vulnerable Software and Affected Versions: Cloud SAML SSO plugin for WordPress versions up to and including 1.0.19 Description: The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set organization settings...

AZL-70795 CVE-2025-39707 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check if hubbub is NULL in debugfs/amdgpudmcapabilities HUBBUB structure is not initialized on DCE hardware, so check if it is NULL to avoid null dereference while accessing amdgpudmcapabilities file in debugfs...

CVE-2025-39707 drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check if hubbub is NULL in debugfs/amdgpudmcapabilities HUBBUB structure is not initialized on DCE hardware, so check if it is NULL to avoid null dereference while accessing amdgpudmcapabilities file in debugfs...

CVE-2025-9219

The Post SMTP – WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updatepostsmtpprooptioncallback'...

CVE-2025-8944

The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any authenticated users, such as subscriber to update the darkMod setting...

CVE-2025-8944

The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any authenticated users, such as subscriber to update the darkMod setting...

CVE-2025-8944 OceanWP < 4.1.2 - Subscriber+ Limited Option Update

The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any authenticated users, such as subscriber to update the darkMod setting...

CVE-2025-8944 OceanWP < 4.1.2 - Subscriber+ Limited Option Update

The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any authenticated users, such as subscriber to update the darkMod setting...