CVE-2026-4124 Ziggeo <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'ziggeo_ajax' AJAX Action

The Ziggeo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1. The wpajaxziggeoajax handler only verifies a nonce checkajaxreferer but performs no capability checks via currentusercan. Furthermore, the nonce 'ziggeoajaxnonce' is exposed to all...

CVE-2025-23786

creationtimestamp| type| source ---|---|--- 2025-02-14 13:17:26+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3li5bzirf6m2i 2025-02-14 14:38:48+00:00| seen| https://infosec.exchange/users/cve/statuses/114002750893462072...