CVE-2026-78139 Notifima < 3.1.4 - Subscriber+ Stock Alert Unsubscription via IDOR

The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product...

CVE-2026-78125

The LearnPress & Sepay Payment WordPress plugin, in versions prior to 4.0.3 (specifically up to and including 4.0.2 ), contains an unauthenticated order status disclosure vulnerability. The root cause is a lack of authorization checks on one of its REST endpoints , which allows attackers to discl...

EUVD-2026-66876

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

CVE-2026-76549 UpdraftPlus < 1.26.7 - Backup Restoration via CSRF

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a...

CVE-2026-19715

The WP OAuth Server ( Login with WordPress ) WordPress plugin, in versions prior to 6.3.1 , contains a vulnerability where it fails to restrict access to its debug log file. When debug logging is enabled , the log is stored at a fixed and publicly reachable location . This allows unauthenticated ...

CVE-2026-77016 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Deletion via Candidate Profile Mass Assignment

The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server...

CVE-2026-77016

The Workeera Remote Tech Job Board WordPress plugin (versions before 1.0.6 ) is vulnerable to arbitrary file deletion . The root cause is a mass assignment flaw where the plugin does not restrict which values can be written to a user's own candidate profile, combined with a failure to validate or...

CVE-2026-77016 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Deletion via Candidate Profile Mass Assignment

The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server...

CVE-2026-19715 WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

EUVD-2026-66878

The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server...

CVE-2026-76549

The UpdraftPlus: WP Backup & Migration Plugin for WordPress, in versions before 1.26.7 , is vulnerable to a Cross-Site Request Forgery (CSRF) flaw. The root cause is a lack of CSRF checks in one of the plugin's backup management actions. This allows an attacker to trick a logged-in administrator ...

EUVD-2026-66877

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a...

WordPress UpdraftPlus: WP Backup & Migration Plugin plugin < 1.26.7 - Backup Restoration vulnerability

Backup Restoration vulnerability discovered by Jashid Sany in WordPress Plugin UpdraftPlus versions 1.26.7...

CVE-2026-16567

The Document Embedder WordPress plugin versions before 2.3.1 is vulnerable to an unauthenticated private document download. The flaw exists because the plugin fails to verify a document's status prior to issuing a download token and streaming the file. This allows unauthenticated attackers to dow...

WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by TruongLV1 From FPT Night Wolf in WordPress Plugin Mobile App for WooCommerce versions = 0.4.62...

CVE-2026-19225

The Defender Security WordPress plugin, in versions prior to 6.2.0 , contains a vulnerability where a network-wide setting is not restricted to network administrators. This flaw allows an administrator of any single site within a multisite network to achieve Remote Code Execution (RCE) across the...

CVE-2026-16569 ShopApper <= 0.4.62 - Subscriber+ Arbitrary Product Stock Update

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber...

CVE-2026-19223

The Smush WordPress plugin (versions before 4.3.2 ) contains a vulnerability where it fails to restrict a network-wide setting to network administrators. This flaw allows an administrator of any individual site on a multisite network to execute arbitrary code across the entire network. Informatio...

EUVD-2026-66874

The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

WordPress Defender Security plugin < 6.2.0 - Admin+ Network-Wide RCE vulnerability

Admin+ Network-Wide RCE vulnerability discovered by Jakub Herman in WordPress Plugin Defender Security versions 6.2.0...