EUVD-2026-83540

The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible woocommerceapiwtstripe webhook endpoint EHStripeWebhookHandler::handle wrapping...

CVE-2026-9832 Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint

The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible woocommerceapiwtstripe webhook endpoint EHStripeWebhookHandler::handle wrapping...

CVE-2026-92430

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying...

CVE-2026-92430 Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webhook

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying...

CVE-2026-92430 Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webhook

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying...

WordPress Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit plugin 3.6.1-5.4.6 - Unauthenticated Order Status Manipulation vulnerability

Unauthenticated Order Status Manipulation vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Rede Itaú for WooCommerce versions 3.6.1-5.4.6...

CVE-2026-92430

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin, affecting versions 3.6.1-5.4.6 , contains an unauthenticated order status manipulation vulnerability. The root cause is the failure to verify the authenticity of its PIX payment webhook before updating an order's...

CVE-2026-9832: Improper Verification of Cryptographic Signature

The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible woocommerceapiwtstripe webhook endpoint EHStripeWebhookHandler::handle wrapping...

WordPress UpsellWP plugin 1.4.4-2.2.9 - Unauthenticated Price Manipulation vulnerability

Unauthenticated Price Manipulation vulnerability discovered by Pedro Pinho in WordPress Plugin UpsellWP versions 1.4.4-2.2.9...

grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default

A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation...

CVE-2026-85350

The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign belong to that campaign, allowing unauthenticated users to buy arbitrary products at the campaign's discounted price...

CVE-2026-85350

The UpsellWP WordPress plugin (versions 1.4.4-2.2.9 ) is vulnerable to an unauthenticated price manipulation issue. The root cause is a failure to verify that products added to the cart via a Frequently Bought Together campaign actually belong to that specific campaign. This allows unauthenticate...

CVE-2026-85350 UpsellWP < 2.2.10 - Unauthenticated Price Manipulation via Frequently Bought Together

The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign belong to that campaign, allowing unauthenticated users to buy arbitrary products at the campaign's discounted price...

CVE-2026-85350 UpsellWP < 2.2.10 - Unauthenticated Price Manipulation via Frequently Bought Together

The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign belong to that campaign, allowing unauthenticated users to buy arbitrary products at the campaign's discounted price...

EUVD-2026-82668

The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign belong to that campaign, allowing unauthenticated users to buy arbitrary products at the campaign's discounted price...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.50 - Instructor+ Order Status Manipulation vulnerability

Instructor+ Order Status Manipulation vulnerability discovered by Shivamani Vastrala in WordPress Plugin MasterStudy LMS versions 3.7.50...

CVE-2026-81340 MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users'...

CVE-2026-81340 MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users'...

CVE-2026-82982: Undefined Security Weakness

The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and...

PT-2026-95617

Name of the Vulnerable Software and Affected Versions IBM Platform RTM affected versions not specified Description An issue exists where a remote attacker can execute specially crafted SQL statements. This allows the attacker to view, add, modify, or delete information within the back-end databas...