CVE-2026-77770: Missing Authorization

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every...

PT-2024-15551

Name of the Vulnerable Software and Affected Versions Index Now plugin for WordPress versions up to, and including, 2.6.3 Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the reset form function. This allows unauthenticated attackers t...

CVE-2024-0428: Cross-Site Request Forgery (CSRF)

The Index Now plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.3. This is due to missing or incorrect nonce validation on the 'resetform' function. This makes it possible for unauthenticated attackers to delete arbitrary site options via a...