WordPress FluentForms <= 5.1.16 - Broken Access Control

The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/fluentform/v1/global-settings REST API endpoint in all versions up to, and including,...

CVE-2026-18364

The zportals WordPress plugin versions prior to 6.4.2 is vulnerable to an unauthorized settings modification. The root cause is the failure to perform capability or nonce checks on several AJAX actions . This allows users with low-privileged subscriber-level accounts to modify the plugin's stored...

CVE-2026-18364 Zportals < 6.4.2 - Subscriber+ Arbitrary Plugin Settings Update

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings...

WordPress zportals plugin < 6.4.2 - Subscriber+ Arbitrary Plugin Settings Update vulnerability

Subscriber+ Arbitrary Plugin Settings Update vulnerability discovered by Erwan LR WPScan in WordPress Plugin Zportals versions 6.4.2...

CVE-2026-61746 InvenTree: Plugin-settings GET endpoints are readable without authentication

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints...

EUVD-2026-84057

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints...

CVE-2026-11355 DT LMS <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions

The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX handlers including dtlmssavepocsettings, dtlmssaveskinsettings, and dtlmssaveoptionssettings in versions up to, and including, 1.1. Thes...

WordPress DT LMS – elearning, WordPress LMS Plugin plugin <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification vulnerability

Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification vulnerability discovered by adhikara13 in WordPress Plugin DT LMS – elearning, WordPress LMS Plugin versions = 1.1...

CVE-2026-77008

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its settings, allowing unauthenticated users to overwrite them and repoint every online classroom, along with the shared secret those sessions...

CVE-2026-17587: Missing Authorization

The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-15345

The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.11.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

PT-2026-73105

The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.11.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2025-10308

The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings...

PT-2026-71961

The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings...

CVE-2026-73326

CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level authorization. Attackers can manipulate plugin configuration...

EUVD-2026-57416

CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level authorization. Attackers can manipulate plugin configuration...

CVE-2026-73326

CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level authorization. Attackers can manipulate plugin configuration...

CVE-2026-73326

CVE-2026-73326 affects CamaleonCMS, where four unprotected plugin-administration endpoints (attack, front_cache, cama_meta_tag, cama_contact_form) allow an authenticated, low-privilege user to access and modify plugin settings without admin authorization. The underlying issue is missing authoriza...

CVE-2026-73326 CamaleonCMS Missing Authorization via Plugin Administration Endpoints

CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level authorization. Attackers can manipulate plugin configuration...

PT-2026-71258

CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level authorization. Attackers can manipulate plugin configuration...