CVE-2026-78204 Ghostwriter through 7.2.6 Missing Authorization on Report Template Lint Endpoints

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

CVE-2026-78204

Ghostwriter through version 7.2.6 is missing per-object authorization on its report template lint endpoints . The underlying cause is that RoleBasedAccessControlMixin.test_func only checks request.user.is_active unless a view explicitly overrides it, and neither the lint endpoint nor the stored-l...

EUVD-2026-64679

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

CVE-2026-78204 Ghostwriter through 7.2.6 Missing Authorization on Report Template Lint Endpoints

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

CVE-2026-8239

CVE-2026-8239 CVE-2026-8239 è una vulnerabilità Insecure Direct Object Reference IDOR che colpisce Concrete CMS 9.5.0 e versioni precedenti. La vulnerabilità è presente nell'endpoint /ccm/frontend/conversations/getrating, che consente a un attaccante di determinare se un messaggio di conversazion...

PT-2026-80856

Name of the Vulnerable Software and Affected Versions nektos/act versions 0.2.81 through 0.2.89 Description The software starts an HTTP Artifacts V4 backend when workflows use actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs, including 'CreateArtifact',...

CVE-2025-30772

🚨 CVE-2025-30772 - Escalation dei privilegi in WPC Smart Upsell Funnel for WooCommerce 📅 Pubblicato: 27 marzo 2025 🔐 Punteggio CVSS: 8.8 Alto 🔥 CWE-862: Autorizzazione mancante 🐞 Riepilogo della vulnerabilità Una vulnerabilità di Autorizzazione mancante nel plugin WPC Smart Upsell Funnel for...

CVE-2025-34171

CVE-2025-34171: Esposizione non autenticata di file e dati di debug in CasaOS Panoramica della vulnerabilità Campo| Valore ---|--- ID CVE| CVE-2025-34171 Interessa| CasaOS ≤ 0.4.15 Corretto in| Nessuna patch disponibile Gravità| Media CVSS 4.0|...

CVE-2024-52429

CVE-2024-52429 WP Quick Setup history.pushState'', '', '/'; document.forms0.submit;...

CVE-2026-14853 WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing Authorization

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...

CVE-2026-14853

WooCommerce Bookings (WordPress plugin) versions before 3.9.0 contain an authorization flaw: one of its AJAX actions lacks a capability check , and the associated nonce check can be bypassed by simply omitting the token. This allows any authenticated user with Subscriber-level access or above to ...

EUVD-2026-64605

The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the restendpoints filter via secureuserendpoints and...

CVE-2026-16149

The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the restendpoints filter via secureuserendpoints and...

CVE-2026-16149 Security Hardener <= 2.4.4 - Authenticated (Subscriber+) Privilege Escalation via REST API '/wp/v2/users' permission_callback Overwrite

The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the restendpoints filter via secureuserendpoints and...

CVE-2026-16149

Security Hardener for WordPress (all versions up to and including 2.4.4 ) contains a Missing Authorization flaw in its user-enumeration protection feature. The plugin's secure_user_endpoints() function hooks the rest_endpoints filter and overwrites the permission_callback on both /wp/v2/users and...

CVE-2024-25092

CVE-2024-25092 Exploit Panoramica CVE-2024-25092 è una vulnerabilità ad alta gravità che colpisce il plugin WordPress NextMove Lite versioni = 2.17.0. Questa vulnerabilità consente a un utente con permessi da subscriber o superiori di installare e attivare plugin arbitrari su un sito WordPress a...

CVE-2025-2807

CVE-2025-2807: Plugin Motors Exploit di: Nxploited | Khaled Alenazi ⚠️ Riepilogo della vulnerabilità Plugin: Motors 📅 Si prevede che venga sfruttata su larga scala a causa della sua semplicità e dell'impatto critico. 🚫 Dettagli tecnici...

CVE-2023-36531

CVE-2023-36531 LiquidPoll – Erweiterte Umfragen für Kreative und Marken = 3.3.68 - Fehlende Autorisierung über activateaddon Informationen Erfordert einen Benutzer mit Abonnentenrolle, und das Plugin muss deaktiviert sein. Dadurch wird das von Ihnen bereitgestellte Plugin aktiviert. Verwendung...

CVE-2025-1639

🔓 Script di Exploit per CVE-2025-1639 📝 Descrizione Il plugin Animation Addons for Elementor Pro per WordPress è vulnerabile all'installazione non autorizzata di plugin arbitrari a causa di un mancato controllo delle capability nella funzione installelementorpluginhandler in tutte le versioni fin...

CVE-2026-4244 Post Duplicator <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution

The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicatepost function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has editothersposts capability before...