67 matches found
CVE-2026-118437
The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors...
EUVD-2026-114585
The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors...
CVE-2026-118437: Unknown BuddyForms: The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded…
The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors...
CVE-2026-10752
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 0.9.2.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to...
EUVD-2026-110756
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 0.9.2.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to...
PT-2026-126383
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 0.9.2.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to...
CVE-2026-111972 Photo Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOR
The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users...
CVE-2026-111972
The Photo Engine (Media Organizer & Lightroom) WordPress plugin, in versions before 6.5.8 , contains an authorization bypass vulnerability. The plugin fails to verify if a user is authorized to act on a targeted media attachment. This allows authenticated users with the author role or higher to d...
WordPress weForms path traversal vulnerability
WordPress weForms versions 1.6.28 and earlier have a path traversal vulnerability. This vulnerability stems from insufficient file path validation in the weFormsdeleteentryattachments function. Unauthorized attackers can delete any media file on the server. To exploit this vulnerability, attacker...
CVE-2026-107770
The Photo Engine Media Organizer & Lightroom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...
EUVD-2026-102787
The Photo Engine Media Organizer & Lightroom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...
CVE-2026-107770 Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action
The Photo Engine Media Organizer & Lightroom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...
PT-2026-115488
Name of the Vulnerable Software and Affected Versions The Photo Engine Media Organizer & Lightroom versions prior to 6.5.7 Description An authorization bypass exists because the plugin fails to properly verify user permissions before performing actions. Unauthenticated attackers can permanently...
WordPress Photo Engine (Media Organizer & Lightroom) Authorization Issues Vulnerability
WordPress Photo Engine Media Organizer & Lightroom versions 6.5.6 and earlier have a vulnerability related to authorization. This vulnerability arises from the plugin’s failure to properly verify whether the user has the necessary permissions to perform certain actions. Additionally, the protecti...
CVE-2026-17031
The Checkout Field Manager Checkout Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
EUVD-2026-101841
The Checkout Field Manager Checkout Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-17031: Missing Authorization
The Checkout Field Manager Checkout Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
PT-2026-114772
The Checkout Field Manager Checkout Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
QuadLayers Checkout Field Manager (Checkout Manager) for WooCommerce: Authorization issue vulnerability
The Checkout Field Manager Checkout Manager in WooCommerce 7.9.6 and earlier versions has an authorization issue vulnerability. This vulnerability arises from the plugin’s failure to properly verify whether the user has the necessary permissions to perform certain operations. As a result,...
WordPress Classified Listing plugin < 6.1.1 - Subscriber+ Unattached Media Deletion and Modification vulnerability
Subscriber+ Unattached Media Deletion and Modification vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Classified Listing versions 6.1.1...