CVE-2026-123782 ChatWiki before 2.10.0 Cross-Tenant IDOR via SaveFormField and UpdateFormRequired

ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability in SaveFormField and UpdateFormRequired that allows authenticated users to modify other tenants' form fields. Attackers can pass their own formid to satisfy the ownership check alongside another tenant's sequential...

CVE-2026-123782: zhimaAi chatwiki: ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability in SaveFormField and…

ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability in SaveFormField and UpdateFormRequired that allows authenticated users to modify other tenants' form fields. Attackers can pass their own formid to satisfy the ownership check alongside another tenant's sequential...

EUVD-2026-22857

The e-shot™ form builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.2. The eshotformbuilderupdatefielddata AJAX handler lacks any capability checks currentusercan or nonce verification checkajaxreferer/wpverifynonce. The function is...