CVE-2026-79632

The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recipients and subject from the request, allowing unauthenticated users to make the site send emails to arbitrary recipients with an...

CVE-2025-15691

The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead, allowing unauthenticated attackers to create WordPress user accounts even when...

WordPress WPFunnels plugin < 3.13.0 - Unauthenticated Order and Opt-In PII Disclosure vulnerability

Unauthenticated Order and Opt-In PII Disclosure vulnerability discovered by Abdullah Kareem in WordPress Plugin WPFunnels versions 3.13.0...

CVE-2026-79632 WPFunnels < 3.13.0 - Unauthenticated Arbitrary Recipient Email Sending via wpfnl_shortcode_optin_submission

The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recipients and subject from the request, allowing unauthenticated users to make the site send emails to arbitrary recipients with an...

CVE-2026-79632 WPFunnels < 3.13.0 - Unauthenticated Arbitrary Recipient Email Sending via wpfnl_shortcode_optin_submission

The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recipients and subject from the request, allowing unauthenticated users to make the site send emails to arbitrary recipients with an...

CVE-2026-79632

The WPFunnels WordPress plugin (versions before 3.13.0 ) contains a vulnerability where one of its opt-in submission handlers fails to perform authorisation or nonce checks . This flaw allows unauthenticated users to manipulate the request to provide arbitrary notification recipients and subjects...

CVE-2025-15691 WPFunnels < 3.13.0 - Unauthenticated User Registration via Opt-in Forms

The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead, allowing unauthenticated attackers to create WordPress user accounts even when...

CVE-2025-15691 WPFunnels < 3.13.0 - Unauthenticated User Registration via Opt-in Forms

The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead, allowing unauthenticated attackers to create WordPress user accounts even when...

CVE-2025-15691

The WPFunnels WordPress plugin, in versions before 3.13.0 , contains an authentication bypass vulnerability. The plugin fails to verify if user registration is enabled on the site before creating accounts from opt-in form submissions, incorrectly relying on a value provided within the request. Th...

PT-2026-85416

The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recipients and subject from the request, allowing unauthenticated users to make the site send emails to arbitrary recipients with an...

Twitch wants your content for Amazon AI training. Here’s how to opt out

The Dutch Autoriteit Persoonsgegevens AP has advised Twitch users to opt out of sharing data with Amazon AI. Twitch launched as a live-video platform and is currently owned by Amazon. Its core product is live broadcasting with a built-in chat culture: streamers broadcast gameplay, commentary,...

CVE-2026-75872

HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of t...

ANT-2026-AM0R21ZY · supabase/supabase · broken-access-control

broken-access-control medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-AM0R21ZY: HIPAA sensitive-project AI block enforced only client-side The client hook...

CVE-2026-75872 HTML Injection in MailerUp double opt-in verification email

HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of t...

CVE-2026-75872

In maalfer MailerUp before 1.1.3, the unauthenticated public subscription form interpolates the first_name field unescaped into the double opt-in verification email, letting remote attackers send arbitrary HTML from the form owner's configured sending identity to an attacker-chosen address. The v...

CVE-2026-75872 HTML Injection in MailerUp double opt-in verification email

HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of t...

EUVD-2026-60820

HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of t...

PT-2026-77135

HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the first name field of...

A week in security (August 3 – August 9)

Last week on Malwarebytes Labs: AI chat bots are sliding into League of Legends friend requests Meta ordered to pay $942 million over harm to children Apple WebKit vulnerabilities reveal your IP address, despite Private Relay Scammers target OnlyFans users with deepfakes Amazon and Apple...

TBK DVR - OS Command Injection Detection (CVE-2024-3721)

TBK DVR devices and rebrands allow unauthenticated OS command injection via /device.rsp?opt=sys&cmd=SOSTREAMAX&mdb=sos&mdc= with Cookie uid=1. !/usr/bin/env python3 -- coding: utf-8 -- """TBK DVR OS command injection via device.rsp CVE-2024-3721.""" import re from urllib.parse import quote from...