WordPress Booking for Appointments and Events Calendar – Amelia plugin <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover vulnerability

Authenticated Custom+ Missing Authorization to Limited Account Takeover vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin Amelia versions = 2.4.4...

WordPress Booking for Appointments and Events Calendar – Amelia plugin <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass vulnerability

Missing Authorization to Unauthenticated Payment Bypass vulnerability discovered by ricky morty in WordPress Plugin Amelia versions = 2.4.5...

WordPress Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) plugin <= 9.8.1 - Missing Authorization to 2FA Bypass vulnerability

Missing Authorization to 2FA Bypass vulnerability discovered by Michael Holmquist in WordPress Plugin Really Simple SSL versions = 9.8.1...

CVE-2026-91015

The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup...

CVE-2026-91008

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information full name, email address, phone...

CVE-2026-91015

The Master Addons for Elementor WordPress plugin (versions 3.0.0-3.1.8 ) is vulnerable to unauthenticated popup deactivation. The flaw exists because the plugin fails to perform proper authorization checks on the AJAX action used to deactivate its Popup Builder popups. Instead, the action relies ...

CVE-2026-87831: Missing Authorization

The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...

CVE-2026-54519: Missing Authorization

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, backend/src/controllers/memory.controller.js authenticates requests but listMemories, deleteMemory, and clearAgentMemory use a caller-supplied agentId or memory id...

CVE-2026-74000: Missing Authorization

Contributor Broken Access Control in Simple Membership = 4.8.2 versions...

CVE-2026-91015: Missing Authorization

The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup...

CVE-2026-54643: Missing Authorization

CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of orderid and delete-note parameters before deleting records from CubeCartordernotes, without requiring CCPERMDELETE for orders. An authenticated...

CVE-2026-54648: Missing Authorization

CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CCPERMREAD access and do not require CCPERMDELETE for the purge, noorderpurge, or deleteguests commands. An authenticated administrator with read-only customer...

CVE-2026-49292: Missing Authorization

Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so repeated access...

CVE-2026-54676: Missing Authorization

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot access because src/main/java/com/erudika/scoold/api/ApiController.java in ApiController.getPostReplies does not apply...

CVE-2026-91010: Missing Authorization

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather than validating it, allowing any authenticated user, such as a...

CVE-2026-54677: Missing Authorization

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, authenticated users who are not members of a private space can create content in questions belonging to that space because src/main/java/com/erudika/scoold/controllers/QuestionController.java in QuestionController.reply...

CVE-2026-16750: Missing Authorization

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvlajaxdealerloadcars function in all versions up to, and including, 1.4.120. This makes it possible for unauthenticated attackers to...

CVE-2026-93378: Missing Authorization

Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. Chromium security severity: Medium...

CVE-2026-92992: Missing Authorization

A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected element is an unknown function of the file server/internal/ai/api/ai.go of the component AI Assistant. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The...

PT-2026-95071

Name of the Vulnerable Software and Affected Versions Dromara mayfly-go versions prior to 1.11.6 Description A missing authorization issue exists within the AI Assistant component, specifically in the server/internal/ai/api/ai.go file. This flaw allows for remote exploitation via a whitelist bypa...