CVE-2026-14359 YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user

The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the adduserinwaitinglist function registered on the wpajaxyithwcwtladduser action being missing both a capability check and a nonce verificatio...

CVE-2026-16759 Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutorcoursefilterajax AJAX action. This is due to missing authorization on the handler...

EUVD-2026-67406

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutorcoursefilterajax AJAX action. This is due to missing authorization on the handler...

CVE-2026-16759

Tutor LMS (eLearning plugin for WordPress, versions ≤ 4.0.5 ) is vulnerable to unauthenticated Remote Code Execution limited to zero-argument function invocation via the tutor_course_filter_ajax AJAX action. The root cause is a missing authorization check combined with unsanitized array keys pass...

phpmps 注入一枚

简要描述： 过滤不严。 详细说明： 在member.php case 'checkinfogold': $json = new ServicesJSON; extract$REQUEST; $mgold = $db-getOne"select gold from $tablemember where userid='$userid' "; $data'kou' = $CFG'infotopgold' intval$number; $data'gold' = $mgold - $data'kou'; $data=$json-encode$data; echo $data; break;...