CVE-2026-1944

CVE-2026-1944 concerns the WordPress plugin CallbackKiller service widget, affected versions up to 1.2. The issue is a missing capability check in the cbk_save() function, enabling unauthenticated attackers to modify the plugin’s site ID settings via the cbk_save_v1 AJAX action. Multiple connecte...