CVE-2026-15248 Meta Box < 5.13.1 - Contributor+ Arbitrary Attachment Deletion via IDOR

The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users...

CVE-2026-15248

Affected software: Meta Box WordPress plugin (WordPress) prior to 5.13.1. Vulnerability: does not verify that the user is authorized to delete the supplied attachment, enabling a low-privilege user (e.g., Contributor) to permanently delete arbitrary media attachments owned by other users. Root ca...

EUVD-2026-51935

The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users...

CVE-2026-67334 better-auth Stale Sessions Persist After User Deletion

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days...

CVE-2026-67334 better-auth Stale Sessions Persist After User Deletion

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days...

CVE-2026-67334

CVE-2026-67334 affects better-auth versions before 1.6.11. When secondaryStorage is configured and storeSessionInDatabase is false, deleting users via admin, anonymous, or SCIM endpoints fails to delete cached sessions, allowing attackers to reuse deleted user session tokens for up to seven days ...

CVE-2025-71402 better-auth before 1.4.0 Session Revocation via Forged Cookie

better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature e.g., via...

CVE-2025-71402 better-auth before 1.4.0 Session Revocation via Forged Cookie

better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature e.g., via...

CVE-2025-71402

better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature e.g., via...

CVE-2026-15450

The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the deletefile AJAX handler retrieving a file path from the database and passing it directly to unlink with no...

EUVD-2026-51758

The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the deletefile AJAX handler retrieving a file path from the database and passing it directly to unlink with no...

CVE-2026-15450

The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the deletefile AJAX handler retrieving a file path from the database and passing it directly to unlink with no...

CVE-2026-15450 NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter

The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the deletefile AJAX handler retrieving a file path from the database and passing it directly to unlink with no...

CVE-2026-15450

The CVE-2026-15450 entry concerns Nex Forms – Ultimate Form Builder – Lite for WordPress (versions ≤ 9.2.3). Affected component is the delete_file() AJAX handler which takes a file path from the database and passes it to unlink() without validation (no realpath/basename/allowlist). Combined with ...

CVE-2026-3141

The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint in all versions up to, and including, 1.9.2 This is due to the REST API route being registered without any...

CVE-2026-13729 Podlove Podcast Publisher < 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion via CSRF

The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request CSRF when a logged-in administrator is tricked into...

WordPress Podlove Podcast Publisher plugin < 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion vulnerability

Podcast Contributor/Group/Role Creation and Deletion vulnerability discovered by Ryan Fabella in WordPress Plugin Podlove Podcast Publisher versions 4.5.3...

CVE-2026-13729

The CVE concerns the Podlove Podcast Publisher WordPress plugin prior to version 4.5.3. The vulnerability is a CSRF (forged request) flaw caused by missing nonce validation on certain administrative create and delete actions, enabling an attacker to create rogue records or delete legitimate ones ...

EUVD-2026-51725

The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint in all versions up to, and including, 1.9.2 This is due to the REST API route being registered without any...

CVE-2026-3141

The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint in all versions up to, and including, 1.9.2 This is due to the REST API route being registered without any...