CVE-2026-77789: Authorization Bypass Through User-Controlled Key

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before acting on it, allowing a user with a confirmed portal session to cancel, reactivate or modify subscriptions...

CVE-2026-16986: Improper Access Control

The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price...

PT-2026-81968

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information...

PT-2026-81949

The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price...

WordPress RealHomes Memberships plugin < 3.1.0 - Subscriber+ Membership Payment Bypass vulnerability

Subscriber+ Membership Payment Bypass vulnerability discovered by Pablo González and Fran Ramírez in WordPress Plugin RealHomes Memberships versions 3.1.0...

WordPress RegistrationMagic plugin < 6.0.9.5 - Unauthenticated Payment Bypass via Amount-Blind PayPal Verification vulnerability

Unauthenticated Payment Bypass via Amount-Blind PayPal Verification vulnerability discovered by Pedro Pinho in WordPress Plugin RegistrationMagic versions 6.0.9.5...

WordPress Subscriptions for WooCommerce plugin < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture Token vulnerability

Payment Bypass via Attacker-Supplied PayPal Capture Token vulnerability discovered by Pedro Pinho in WordPress Plugin Subscriptions for WooCommerce versions 2.0.1...

WordPress WP Hotel Booking plugin < 2.3.2 - Unauthenticated PayPal Payment Bypass vulnerability

Unauthenticated PayPal Payment Bypass vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Hotel Booking versions 2.3.2...

WordPress WP Hotel Booking plugin < 2.3.3 - Unauthenticated Payment Bypass via Price Manipulation vulnerability

Unauthenticated Payment Bypass via Price Manipulation vulnerability discovered by reconnaissance in WordPress Plugin WP Hotel Booking versions 2.3.3...

WordPress Simple Membership plugin < 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification vulnerability

Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Simple Membership versions 4.7.7...

WordPress Events Made Easy plugin < 3.1.2 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Haitam Lazaar in WordPress Plugin Events Made Easy versions 3.1.2...

CVE-2026-18323: Improper Neutralization of Input During Web Page Generation

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field Save and Continue Draft in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-18328: Improper Neutralization of Input During Web Page Generation

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'errordescription' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This...

CVE-2026-71507

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access ...

CVE-2026-71506

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated attackers with invoice-deletion rights to permanently delete any payment record by bypassing the intended payment-issuance rights check. Attackers can exploit...

CVE-2026-71507 Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access ...

CVE-2026-71507

Dolibarr before 24.0.0 is affected by a broken object-level authorization flaw in the REST API company bank account write routes. An authenticated user holding only third-party creation rights can create, replace, or delete bank account details of any company without needing read access to that c...

EUVD-2026-65080

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access ...

CVE-2026-71507 Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access ...

CVE-2026-71507 Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access ...