CVE-2026-19073: Exposure of Sensitive Information to an Unauthorized Actor

The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any capability check on one of its REST API endpoints, and does not verify that the requester owns the account being queried, allowing unauthenticated attackers to retrieve the order history and purchase...

CVE-2026-15213: Undefined Security Weakness

The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or...

CVE-2026-13171: Improper Access Control

The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records...

CVE-2026-18391: Unrestricted Upload of File with Dangerous Type

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain...

CVE-2026-15045: External Control of Assumed-Immutable Web Parameter

The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkou...

CVE-2026-16977: Improper Neutralization of Special Elements used in an SQL Command

The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection...

CVE-2026-14858: Authorization Bypass Through User-Controlled Key

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store...

PT-2026-71051

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce WordPress plugin versions prior to 2.11.33 Description The plugin fails to verify the authenticity of the convenience-store and bank-transfer settlement callback. An unauthenticated request can change an order status from...

PT-2026-71249

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An issue exists in attribute-view template columns that expose the queryBlocks function. This function executes raw SQL using string substitution instead of parameterized queries, leading to a...

PT-2026-71004

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store...

CVE-2026-13177: Authorization Bypass Through User-Controlled Key

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers...

PT-2026-71025

Name of the Vulnerable Software and Affected Versions WooCommerce Subscriptions versions prior to 9.1.0 Description Insufficient validation of user input before unserialization occurs on stores with High-Performance Order Storage enabled. This leads to a PHP Object Injection, which unauthenticate...

CVE-2026-72807: Improper Neutralization of Special Elements used in an SQL Command

SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view template columns that expose the queryBlocks function, which executes raw SQL using string substitution instead of parameterized queries. Attackers can distribute malicious SiYuan documents or...

PT-2026-71052

Name of the Vulnerable Software and Affected Versions Payment Gateway for PayPal on WooCommerce WordPress plugin versions prior to 9.2.1 Description The plugin fails to verify if a payment was successful before completing an order within its PayPal return handler. An unauthenticated attacker can...

CVE-2026-16621: Undefined Security Weakness

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes t...

PT-2026-71032

Name of the Vulnerable Software and Affected Versions Order Sync with Zendesk for WooCommerce versions prior to 2.2.3 Description An issue exists where a REST API endpoint fails to perform capability checks and does not verify if the requester owns the account being queried. This allows...

SUSE CVE-2026-68347

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix IRQ unsafe locking in gdom allocation Lockdep complains: 259.410489 ===================================================== 259.417287 WARNING: HARDIRQ-safe - HARDIRQ-unsafe lock order detected 259.424667...

CVE-2026-68185

A flaw was found in the Linux kernel, specifically within the LoongArch architecture. When memory allocation profiling is enabled and then subsequently disabled via a boot parameter, an incorrect order of initialization for jumplabelinit and parseearlyparam can occur. This can lead to early...

CVE-2026-68347

A flaw was found in the Linux kernel's AMD IOMMU Input/Output Memory Management Unit driver. This vulnerability is caused by an unsafe lock order during the allocation of graphics domains gdom and within the IOMMUDESTROY free path. This issue could lead to a system crash or a denial of service Do...

CVE-2026-72783

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Local file system class. The order of operations validates the path before normalization, so normalization could invalidate prior...