PT-2026-28029

Name of the Vulnerable Software and Affected Versions Miraculous versions prior to 2.1.2 Description An authorization issue exists in Miraculous, allowing exploitation of incorrectly configured access control security levels. Recommendations Update Miraculous to version 2.1.2 or later...

PT-2026-27947

Missing Authorization vulnerability in سید محمدامین هاشمی GZSEO gzseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GZSEO: from n/a through = 2.0.14...

PT-2026-27996

Name of the Vulnerable Software and Affected Versions Product Rearrange for WooCommerce versions through 1.2.2 Description An authorization flaw exists in Product Rearrange for WooCommerce. This issue allows exploitation of incorrectly configured access control security levels. Recommendations...

PT-2026-27856

Name of the Vulnerable Software and Affected Versions WPVulnerability versions through 4.2.1 Description An authorization issue exists in Javier Casares WPVulnerability wpvulnerability. The issue stems from incorrectly configured access control security levels, potentially allowing unauthorized...

PT-2026-28009

Name of the Vulnerable Software and Affected Versions WP Terms Popup versions through 2.10.0 Description An authorization issue exists in WP Terms Popup. The issue involves exploiting incorrectly configured access control security levels. Recommendations Update WP Terms Popup to a version later...

PT-2026-27846

Name of the Vulnerable Software and Affected Versions WPFactory Helpdesk Support Ticket System for WooCommerce versions through 2.1.2 Description An authorization issue exists in WPFactory Helpdesk Support Ticket System for WooCommerce. The issue involves incorrectly configured access control...

PT-2026-27950

Name of the Vulnerable Software and Affected Versions MVPThemes The League versions through 4.4.1 Description A missing authorization flaw exists in MVPThemes The League. This allows exploitation of incorrectly configured access control security levels. Recommendations Update MVPThemes The League...

PT-2026-27897

Name of the Vulnerable Software and Affected Versions PublishPress Authors versions through 4.10.1 Description A missing authorization flaw exists in PublishPress Authors. This issue allows exploitation of incorrectly configured access control security levels. Recommendations Update PublishPress...

PT-2026-27876

Name of the Vulnerable Software and Affected Versions WP System Log versions through 1.2.7 Description An authorization issue exists in activity-log.com WP System Log winterlock. This allows exploitation of incorrectly configured access control security levels. Recommendations Update WP System Lo...

PT-2026-27955

Name of the Vulnerable Software and Affected Versions LiquidThemes Ave Core versions through 2.9.1 Description An authorization issue exists in LiquidThemes Ave Core. The problem stems from incorrectly configured access control security levels, potentially allowing unauthorized access...

Missing Authorization

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Missing Authorization in the actionMoveToSection process. An attacker can perform unauthorized content changes by sending crafted POST requests to the affected endpoint, allowing them to move...

Missing Authorization

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Missing Authorization via the assets/image-editor endpoint. An attacker can access private editor metadata, including focalPoint, for assets they are not authorized to view by supplying the I...

Missing Authorization

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Missing Authorization via the assets/generate-transform endpoint. An attacker can access content derived from private assets by submitting requests with arbitrary asset references, as the...

Missing Authorization

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Missing Authorization via the ConfigSyncController process. An attacker can perform unauthorized configuration synchronization operations by sending crafted requests to endpoints such as...

WordPress Smart Custom Fields plugin <= 5.0.6 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Relational Post Search vulnerability

Missing Authorization to Authenticated Contributor+ Sensitive Information Exposure via Relational Post Search vulnerability discovered by darkmode in WordPress Plugin Smart Custom Fields versions = 5.0.6...

CVE-2026-33676 Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, when the Vikunja API returns tasks, it populates the relatedtasks field with full task objects for all related tasks without checking whether the requesting user has read permission on those tasks' projects. A...

CVE-2026-33676

Summary: Vikunja, an open-source self-hosted task manager, has a cross-project information disclosure in its API. Before 2.2.1, when returning tasks, the API fills the related_tasks field with full task objects for all related tasks without verifying the requester’s read permission on those proje...

CVE-2026-33676 Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, when the Vikunja API returns tasks, it populates the relatedtasks field with full task objects for all related tasks without checking whether the requesting user has read permission on those tasks' projects. A...

CVE-2026-3225 LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized deletion of quiz question answers due to a missing capability check in the deletequestionanswer function of the EditQuestionAjax class in all versions up to, and including, 4.3.2.8. The...

CVE-2026-4066 Smart Custom Fields <= 5.0.6 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Relational Post Search

The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relationalpostssearch function in all versions up to, and including, 5.0.6. This makes it possible for authenticated attackers, with Contributor-level access and abov...