WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability

Bypass Vulnerability vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP User Frontend versions = 4.3.11...

EUVD-2026-85172

An Improper Authentication vulnerability in the Apache Doris Frontend FE meta service allows an unauthenticated remote attacker to access internal metadata service endpoints. The affected endpoints relied on client-supplied node information for authentication without providing sufficient...

CVE-2026-31377 Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service

An Improper Authentication vulnerability in the Apache Doris Frontend FE meta service allows an unauthenticated remote attacker to access internal metadata service endpoints. The affected endpoints relied on client-supplied node information for authentication without providing sufficient...

CVE-2026-31377

An Improper Authentication vulnerability exists in the Apache Doris Frontend (FE) meta service , allowing an unauthenticated remote attacker to access internal metadata service endpoints. The root cause is that affected endpoints rely on client-supplied node information for authentication without...

PT-2026-97242

Name of the Vulnerable Software and Affected Versions Apache Doris versions 2.0.0 through 2.0.x Apache Doris versions 2.1.0 through 2.1.x Apache Doris versions 3.0.0 through 3.0.x Apache Doris versions 3.1.0 through 3.1.x Apache Doris versions 4.0.0 through 4.0.7 Apache Doris versions 4.1.0 throu...

PT-2026-97478

Name of the Vulnerable Software and Affected Versions WP User Frontend versions prior to 4.3.12 Description An unauthenticated bypass issue exists that allows users to circumvent security restrictions without providing valid credentials. Recommendations Update to a version newer than 4.3.11...

CVE-2026-95524: Authentication Bypass by Spoofing

Unauthenticated Bypass Vulnerability in WP User Frontend = 4.3.11 versions...

CVE-2026-31377: Improper Authentication

An Improper Authentication vulnerability in the Apache Doris Frontend FE meta service allows an unauthenticated remote attacker to access internal metadata service endpoints. The affected endpoints relied on client-supplied node information for authentication without providing sufficient...

PT-2026-97477

Subscriber Bypass Vulnerability in WP User Frontend = 4.3.11 versions...

CVE-2026-95523: Authentication Bypass by Spoofing

Subscriber Bypass Vulnerability in WP User Frontend = 4.3.11 versions...

CVE-2026-95525: Improper Limitation of a Pathname to a Restricted Directory

Subscriber Arbitrary File Deletion in WP User Frontend = 4.3.11 versions...

PT-2026-97672

This module lets a frontend scanner post CSS-usage measurements to the site so admin reports can show real-page statistics. This module doesn't sufficiently protect the /css-usage-analyzer/save endpoint against forged or repeated submissions...

PT-2026-97479

Subscriber Arbitrary File Deletion in WP User Frontend = 4.3.11 versions...

Improper Authorization

Overview @tauri-apps/plugin-updater is a Affected versions of this package are vulnerable to Improper Authorization via the allowDowngrades option exposed to the frontend JavaScript API, which allowed any web content running inside a Tauri application to request installation of an older, previous...

Malicious Package

Overview epic-blog-frontend is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview epic-comment-rating-frontend is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-13355

The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populateviaquerystring function in the mb-frontend-submission component unconditionally overrides the form's target objectid fr...

EUVD-2026-84268

The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populateviaquerystring function in the mb-frontend-submission component unconditionally overrides the form's target objectid fr...

CVE-2026-13355

The Meta Box AIO WordPress plugin (versions ≤ 3.11.0 ) is vulnerable to unauthenticated Privilege Escalation to Administrator due to a chained flaw in its bundled components. The mb-frontend-submission component lacks authorization checks in the populate_via_query_string() function, allowing atta...

CVE-2026-13355 Meta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter

The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populateviaquerystring function in the mb-frontend-submission component unconditionally overrides the form's target objectid fr...