CVE-2026-81026

MasterStudy LMS WordPress plugin versions prior to 3.7.40 contain an unauthenticated payment bypass via PayPal IPN (Instant Payment Notification). The plugin fails to verify the amount, receiver, currency, or status of an incoming payment notification before marking the corresponding order as com...

EUVD-2026-68062

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by...

EUVD-2026-68064

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs...

CVE-2026-80311 Stripe Payment Forms by WP Full Pay < 8.5.5 - Cross-Customer Subscription Cancellation via IDOR

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonging to other...

CVE-2026-81200 MasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...

CVE-2026-81026 MasterStudy LMS < 3.7.40 - Unauthenticated Payment Bypass via PayPal IPN

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by...

CVE-2026-80488 WP Ultimate CSV Importer < 9.0 - Admin+ SQLi via AIOSEO Import Fields

The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks...

CVE-2026-81342

MasterStudy LMS WordPress Plugin versions prior to 3.7.43 are affected by an unauthenticated open redirect . The plugin fails to validate a redirect parameter supplied during user registration before using it, allowing an attacker to redirect users to arbitrary external URLs. The vulnerability re...

EUVD-2026-68063

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...

EUVD-2026-68061

The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks...

CVE-2026-81200

CVE-2026-81200 affects the MasterStudy LMS WordPress plugin in versions before 3.7.42 . The flaw is an improper access restriction (IDOR) in the order information handling: any user holding the instructor role can enumerate order IDs to read other users' billing details—name, email address, phone...

CVE-2026-81342 MasterStudy LMS < 3.7.43 - Unauthenticated Open Redirect

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs...

CVE-2026-80488

WP Ultimate CSV Importer WordPress plugin versions before 9.0 contain a SQL injection vulnerability in the AIOSEO Import Fields feature. Imported field values are not properly sanitised or escaped before being used in a SQL statement, allowing high-privilege users (admin and above) to execute arb...

CVE-2026-80311

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 contains an insecure direct object reference (IDOR) flaw: it does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it. This allows a user with a confirmed ...

CVE-2026-77010

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin (through 1.0.3 ) fails to perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code. This allows unauthenticated users to obtain a signed meeting join link for any classro...

CVE-2026-77012 Icollect <= 1.0.0 - Unauthenticated Arbitrary File Read, SSRF and Path Traversal File Write via Default Publishing Password

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given, allowing unauthenticated attackers to read arbitrary files from the...

CVE-2026-77786

Rank Math SEO for WordPress, before version 1.0.277 , fails to verify that the user requesting an automated SEO fix holds the WordPress capability required for the settings being changed. The specific fix-site-seo ability allows users with the Editor role (or higher) to modify site-wide core Word...

CVE-2026-77786 Rank Math SEO < 1.0.277 - Editor+ Core Settings Modification via fix-site-seo Ability

The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to...

CVE-2026-77704 Amelia 1.2.32 - 2.4.8 - Amelia Customer+ Appointment Status Update and Self-Approval

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their ow...

CVE-2026-77012

CVE-2026-77012 affects the 爱采集数据采集和发布插件 (Icollect) WordPress plugin, versions through 1.0.0 . The root cause is a hardcoded default publishing password on an unauthenticated endpoint combined with missing validation of URLs and destination paths. This allows unauthenticated attackers to perform a...