58559 matches found
CVE-2026-9810
The CVE-2026-9810 entry concerns the AI Copilot WordPress plugin prior to version 1.5.4. The root cause is that the plugin does not bind OAuth access tokens to a WordPress user, allowing any valid token to be treated as an administrator session. Consequently, unauthenticated attackers completing ...
EUVD-2026-45150
The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitra...
CVE-2026-9810 AI Chatbot & Workflow Automation by AIWU < 1.5.4 - Unauthenticated Privilege Escalation via MCP OAuth
The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitra...
CVE-2026-9046
creationtimestamp| type| source ---|---|--- 2026-07-17 05:13:21+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mqsyirmdtq2e 2026-07-17 05:13:36+00:00| seen| https://mastodon.social/users/hugovalters/statuses/116933605175540875...
CVE-2026-24227
creationtimestamp| type| source ---|---|--- 2026-07-17 03:46:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqstmpirax2a...
CVE-2026-62207
creationtimestamp| type| source ---|---|--- 2026-07-17 02:51:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsqkt3uoy2m...
CVE-2026-14956
The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldIds parameter in the Pro Forms registration action, which allows attacker-supplied field IDs to be added to the trusted form-fie...
CVE-2026-62321
creationtimestamp| type| source ---|---|--- 2026-07-17 02:01:13+00:00| seen| https://bsky.app/profile/slackers.it/post/3mqsnr7xax22x...
CVE-2026-14956 Bricksforge <= 3.1.8.6 - Unauthenticated Privilege Escalation via Pro Forms fieldIds Parameter
The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldIds parameter in the Pro Forms registration action, which allows attacker-supplied field IDs to be added to the trusted form-fie...
EUVD-2026-45123
The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldIds parameter in the Pro Forms registration action, which allows attacker-supplied field IDs to be added to the trusted form-fie...
CVE-2026-44453
creationtimestamp| type| source ---|---|--- 2026-07-17 00:39:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsj7gczaa2n...
CVE-2026-44434
creationtimestamp| type| source ---|---|--- 2026-07-17 00:29:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsinjcw2422...
CVE-2026-62241
creationtimestamp| type| source ---|---|--- 2026-07-17 00:24:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqsidieaof2d 2026-07-17 01:30:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/116932727657867490 2026-07-17 01:30:28+00:00| seen|...
EUVD-2026-45121
grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achiev...
CVE-2026-62233 grav-plugin-api < 1.0.6 Privilege Escalation via createApiKey
grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achiev...
EUVD-2026-45119
The Grav API plugin getgrav/grav-plugin-api before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the ApiKeyAuthenticator class never reads or enforces these scopes. It loads and returns the owning user's full account object, so a key created...
CVE-2026-57076
creationtimestamp| type| source ---|---|--- 2026-07-17 00:03:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsh6birny2m 2026-07-17 01:08:59+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqsktsqhdz27...
CVE-2026-14253
creationtimestamp| type| source ---|---|--- 2026-07-16 23:41:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsfxkt7h72u...