CVE-2023-6700

CVE-2023-6700 Cookie Information | Free GDPR Consent Solution = 2.0.22 - Authenticated Subscriber+ Arbitrary Options Update Description: CVE-2023-6700 The Cookie Information | Free GDPR Consent Solution plugin for WordPress is vulnerable to arbitrary option updates due to a missing capability che...

CVE-2025-13342

CVE-2025-13342 PoC The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in all versions up to, and including, 3.28.20. This allows attackers to register users and set the default role to administrator. Exploitation becomes...

CVE-2024-54379

CVE-2024-54379 Minterpress = 1.0.5 - Authorization manquante pour la mise à jour arbitraire d'options par des utilisateurs authentifiés Abonné+ Description Le plugin Minterpress pour WordPress est vulnérable à la modification non autorisée de données pouvant conduire à une escalade de privilèges ...

CVE-2024-54378

CVE-2024-54378 Quietly Insights = 1.2.2 - Missing Authorization to Authenticated Subscriber+ Arbitrary Options Update Description The Quietly Insights plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on...

CVE-2024-5326-Poc

CVE-2024-5326 CVE-2024-5326 Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX = 4.1.2 - Missing Authorization to Arbitrary Options Update Description The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized modification of data...

DynamiApps Frontend Admin <= 3.28.20 - Unauthenticated Arbitrary Options Update

DynamiApps Frontend Admin plugin for WordPress .= 3.28.20 contains a broken access control vulnerability caused by insufficient capability checks and input validation in ActionOptions::run save handler, letting unauthenticated attackers modify critical WordPress options via crafted form data. id:...

WordPress Image Hover Ultimate - Unauthenticated Settings Update

Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate versions = 9.6.1 WordPress plugin. id: CVE-2021-36888 info: name: WordPress Image Hover Ultimate - Unauthenticated Settings Update author: riteshs4hu severity:...

agency-toolkit-1023-missing-authorization-to-unauthenticated-arbitrary-options-update

NoCVE Agency Toolkit = 1.0.23 — отсутствие авторизации ведёт к неаутентифицированному произвольному обновлению параметров Описание Плагин Agency Toolkit для WordPress уязвим к несанкционированному изменению данных, которое может привести к повышению привилегий, из-за отсутствия проверки прав...

CVE-2025-13342

CVE-2025-13342 Frontend Admin от DynamiApps - ----/| |/ ----| \ ||/ / / / //// |// |/ ◈ Уязвимость Поле| Детали ---|--- CVE ID| CVE-2025-13342 Оценка| 9.8 КРИТИЧЕСКАЯ — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CNA| Wordfence Затронуто| Frontend Admin от DynamiApps ≤ 3.28.20...

CVE-2024-4898-Poc

CVE-2024-4898-Poc CVE-2024-4898 InstaWP Connect – 1-click WP Staging & Migration = 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation...

CVE-2024-5326-Poc

CVE-2024-5326 CVE-2024-5326 Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX = 4.1.2 - Missing Authorization to Arbitrary Options Update Description The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized modification of data...

CVE-2024-22145

CVE-2024-22145 InstaWP Connect = 0.1.0.8 - Missing Authorization to Arbitrary Options Update Subscriber+ Description: The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the...

CVE-2025-2266

🚨 CVE-2025-2266 — Exploitation de plugin WordPress 🔍 Résumé de la vulnérabilité Le plugin Checkout Mestres do WP for WooCommerce pour WordPress est affecté par une vulnérabilité de mise à jour d'options arbitraires sans authentification dans les versions 8.6.5 à 8.7.5. La fonction vulnérable...

CVE-2025-5701

CVE-2025-5701 HyperComments = 1.2.2 - Mise à jour non authentifiée Abonné+ d'options arbitraires Description Le plugin HyperComments pour WordPress est vulnérable à une modification non autorisée de données pouvant entraîner une escalade de privilèges en raison d'un manque de vérification des...

CVE-2024-50476

CVE-2024-50476 GRÜN spendino Spendenformular = 1.0.1 - Mise à jour arbitraire d'options sans authentification Description : Le plugin GRÜN spendino Spendenformular – Mehr Spenden! Weniger Arbeit! pour WordPress est vulnérable à une modification non autorisée des données pouvant conduire à une...

CVE-2024-50490

CVE-2024-50490 PegaPoll = 1.0.2 - Mise à jour non authentifiée d'options arbitraires Description : Le plugin PegaPoll pour WordPress est vulnérable à une modification non autorisée de données pouvant conduire à une élévation de privilèges en raison d'un contrôle de capacité manquant dans toutes l...

WordPress Botiga Pro plugin < 1.6.5 - Unauthenticated Arbitrary Blog Options Update vulnerability

Unauthenticated Arbitrary Blog Options Update vulnerability discovered by Erwan LR WPScan in WordPress Plugin Botiga Pro versions 1.6.5...

WordPress JSON Options plugin <= 0.0.4 - Unauthenticated Arbitrary Options Update vulnerability

Unauthenticated Arbitrary Options Update vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin JSON Options versions = 0.0.4...

CVE-2026-75860 JSON Options <= 0.0.4 - Unauthenticated Arbitrary Options Update

The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user...

CVE-2026-75860

The JSON Options WordPress plugin, affecting versions prior to 0.0.5 (through 0.0.4), is vulnerable to an unauthenticated arbitrary options update . The root cause is a lack of capability checks and nonce verification on an action that executes on every request. This flaw allows unauthenticated a...