CVE-2026-74848: Inconsistent Interpretation of HTTP Requests

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes. This issue affects Apache APISIX: from 2.12.0 through 3.17.0. Users ar...

CVE-2026-19715: Exposure of Sensitive Information to an Unauthorized Actor

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

PT-2026-82387

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user e.g. a customer/subscriber to...

PT-2026-82509

When the ClickHouse plugin uses Native protocol the default with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never...

PT-2026-82420

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its...

PT-2026-82601

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description A signature verification issue exists in the gpg runner.verify detached function. The system accepts revoked and expired keys because it only checks the VALIDSIG status and fails to inspect...

CVE-2026-13414: Missing Authorization

The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain and exposed to anonymous visitors on others, allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a...

PT-2026-82654

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.6 Description The Tutor LMS WordPress plugin contains a template injection issue caused by insufficient validation of request data. This allows unauthenticated users to overwrite internal variables during templa...

CVE-2026-81701: Improper Verification of Cryptographic Signature

opensslencrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths...

CVE-2026-81719: Improper Control of Generation of Code

opensslencrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The...

PT-2026-82421

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...

PT-2026-82388

Name of the Vulnerable Software and Affected Versions ShopApper Mobile App Builder Service for WooCommerce WordPress plugin versions prior to 0.4.63 Description The plugin fails to verify user permissions before performing stock-update operations via a REST endpoint. This allows any authenticated...

PT-2026-82390

The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

PT-2026-82453

Unauthenticated Cross Site Scripting XSS in Realtyna Organic IDX plugin = 5.4.1 versions...

PT-2026-82837

Name of the Vulnerable Software and Affected Versions WPMU DEV Dashboard versions prior to 5.0.2 Description An authentication bypass exists in the Hub Single Sign-On SSO flow, potentially affecting an estimated 350,000 WordPress sites. The issue stems from HMAC canonicalization confusion—a...

PT-2026-82445

Name of the Vulnerable Software and Affected Versions ACPT Pro - Custom Post Types Plugin for WordPress versions prior to 2.0.64 Description An unauthenticated privilege escalation issue allows an attacker to create a WordPress administrator account. This flaw has been exploited in the wild via t...

CVE-2026-78139: Authorization Bypass Through User-Controlled Key

The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product...

PT-2026-82429

The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user Subscriber and above to read the Finale Lite WordPress plugin before 2.21.0's campaign...

PT-2026-82427

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers...

CVE-2026-81714: Improper Verification of Cryptographic Signature

opensslencrypt pip: openssl-encrypt versions = 1.4.8 use suffix-tolerant fingerprint matching in enrolltrustkey when binding a plugin-signing trust anchor. An operator who confirms a short forgeable, 32-bit GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which...