WordPress Flutterwave WooCommerce plugin <= 3.3.0 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Jakub Herman in WordPress Plugin Flutterwave WooCommerce versions = 3.3.0...

WordPress Piraeus Bank WooCommerce Payment Gateway plugin 3.2.0 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Jakub Herman in WordPress Plugin Piraeus Bank WooCommerce Payment Gateway versions 3.2.0...

CVE-2026-73398: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions...

CVE-2026-32468: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway = 2.11.14 versions...

PT-2026-77046

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway = 2.11.14 versions...

PT-2026-77131

Unauthenticated Insecure Direct Object References IDOR in Razorpay for WooCommerce = 4.8.7 versions...

PT-2026-77119

Unauthenticated Broken Authentication in Flutterwave WooCommerce = 3.3.0 versions...

PT-2026-77118

Name of the Vulnerable Software and Affected Versions Piraeus Bank WooCommerce Payment Gateway version 3.2.0 Description The software contains a broken authentication mechanism that allows unauthenticated access. Recommendations At the moment, there is no information about a newer version that...

New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging

Summary Unauthenticated payment webhook endpoints could read and log the entire request body before validating the webhook signature. When a payment webhook was enabled, an unauthenticated attacker could send oversized requests to public callback endpoints and force excessive memory use and log...

EUVD-2026-60241

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation in router/api-router.go and the...

CVE-2026-64868 New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation in router/api-router.go and the...

CVE-2026-64868 New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation in router/api-router.go and the...

PT-2026-76685

Name of the Vulnerable Software and Affected Versions New API versions prior to 1.0.0-rc.11 Description Unauthenticated payment webhook endpoints read and log full request bodies before performing signature validation. This occurs in router/api-router.go and the payment controllers. An...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-100881)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100881 advisory. A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. This vulnerability was fixed in Firefo...

WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload

Exploit Title: WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload Google Dork: N/A Date: 2026-07-15 Exploit Author: Mohammad Hossein Sadeghian Vendor Homepage: https://wordpress.org/plugins/payment-gateway-pix-for-woocommerce/ Software Link:...

CVE-2026-13167: Missing Authorization

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

CVE-2026-12998: Authorization Bypass Through User-Controlled Key

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.55.0.2 via the 'draft' parameter due to missing validation on a user controlled key. This makes it possible for...

CVE-2026-8840

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...

CVE-2026-8840

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...

CVE-2026-8840 Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...