WordPress wpForo Forum plugin <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Forum Post Modification via 'guestposting' Parameter vulnerability discovered by Jared Reyes in WordPress Plugin wpForo Forum versions = 2.4.16...

CVE-2026-4659

creationtimestamp| type| source ---|---|--- 2026-04-17 09:15:54+00:00| seen| Telegram/AZQnk1q88GRrPNbtJYRdzFvYzsq1JKqTcpasHMe998GraXQ 2026-04-17 11:00:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjorhb7jcn26 2026-04-17 12:54:29+00:00| seen|...

CVE-2026-6482

creationtimestamp| type| source ---|---|--- 2026-04-17 07:01:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjoe3ogr4h2s 2026-04-17 07:16:22+00:00| seen| Telegram/tG2JfBYkK87mHaeOPjoo4KUhb5Z5XakpvfcfSoidkAS14Y 2026-04-24 11:01:07+00:00| seen|...

CVE-2026-5807

creationtimestamp| type| source ---|---|--- 2026-04-17 06:50:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjodhxzg7k2r 2026-04-17 07:16:22+00:00| seen| Telegram/tG2JfBYkK87mHaeOPjoo4KUhb5Z5XakpvfcfSoidkAS14Y 2026-04-17 12:54:36+00:00| seen|...

CVE-2026-5234

creationtimestamp| type| source ---|---|--- 2026-04-17 06:35:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjocmzk6ie2b 2026-04-17 10:32:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mjopuy3kwk2r...

EUVD-2026-23347

The wpForo Forum plugin for WordPress is vulnerable to unauthorized modification of data due to the use of extract$args, EXTROVERWRITE on user-controlled input in the edit method of classes/Posts.php in all versions up to, and including, 2.4.16. The postedit action handler in Actions.php passes...

CVE-2026-5502

creationtimestamp| type| source ---|---|--- 2026-04-17 06:26:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjoc6n2zx22k 2026-04-17 18:32:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mjpkpbryxp26...

CVE-2026-4666

The wpForo Forum plugin for WordPress is vulnerable to unauthorized modification of data due to the use of extract$args, EXTROVERWRITE on user-controlled input in the edit method of classes/Posts.php in all versions up to, and including, 2.4.16. The postedit action handler in Actions.php passes...

CVE-2026-4666 wpForo Forum <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter

The wpForo Forum plugin for WordPress is vulnerable to unauthorized modification of data due to the use of extract$args, EXTROVERWRITE on user-controlled input in the edit method of classes/Posts.php in all versions up to, and including, 2.4.16. The postedit action handler in Actions.php passes...

CVE-2026-4666 wpForo Forum <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter

The wpForo Forum plugin for WordPress is vulnerable to unauthorized modification of data due to the use of extract$args, EXTROVERWRITE on user-controlled input in the edit method of classes/Posts.php in all versions up to, and including, 2.4.16. The postedit action handler in Actions.php passes...

CVE-2026-4666

CVE-2026-4666 affects the WordPress plugin wpForo Forum ≤ 2.4.16. The vulnerability arises from using extract($args, EXTR_OVERWRITE) on user-controlled input in Posts::edit(), with the post_edit action passing $_REQUEST['post'] to that method. An attacker can inject post[guestposting]=1 to overri...

CVE-2026-4666

The wpForo Forum plugin for WordPress is vulnerable to unauthorized modification of data due to the use of extract$args, EXTROVERWRITE on user-controlled input in the edit method of classes/Posts.php in all versions up to, and including, 2.4.16. The postedit action handler in Actions.php passes...

CVE-2026-40255

creationtimestamp| type| source ---|---|--- 2026-04-17 00:16:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjnnij7teu2f...

PT-2026-33582

Name of the Vulnerable Software and Affected Versions AMD CPUs affected versions not specified Description A transient execution vulnerability exists within AMD CPUs that allows a local user-privileged attacker to leak data via the floating point divisor unit. This issue, known as Floating Point...

PT-2026-36793

Name of the Vulnerable Software and Affected Versions Totolink N300RH version 3.2.4-B20220812 Description A buffer overflow can be triggered remotely via the POST Request Handler component. The issue exists in the setUpgradeFW function within the '/cgi-bin/cstecgi.cgi' endpoint when manipulating...

PT-2026-33481

CVE-2026-33093 Anviz CX7 Firmware is vulnerable to an unauthenticated POST to the device that captures a photo with the front facing camera, exposing visual information about the … https://t.co/qyxdCA6QG6...

PT-2026-33509

Name of the Vulnerable Software and Affected Versions xrdp versions prior to 0.10.6 Description An open source RDP server contains a heap-based buffer overflow in the EGFX graphics dynamic virtual channel implementation. This occurs due to insufficient validation of client-controlled size...

Vaadin Flow and the axios npm supply-chain compromise

On March 31, 2026, compromised versions of the popular axios HTTP client library 1.14.1 and 0.30.4 were published to NPM via a hijacked maintainer account. The malicious versions injected [email protected], a cross-platform RAT dropper that connected to a command-and-control server. The...

WordPress OneSignal - Web Push Notifications plugin <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Post Meta Deletion via 'post_id' vulnerability

WordPress OneSignal - Web Push Notifications plugin = 3.8.0 - Missing Authorization to Authenticated Subscriber+ Post Meta Deletion via 'postid' vulnerability discovered by Muhammad Sharief in WordPress Plugin OneSignal – Web Push Notifications versions = 3.8.0...

BIT-DJANGO-2026-4292 Privilege abuse in ModelAdmin.list_editable

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using ModelAdmin.listeditable incorrectly allowed new instances to be created via forged POST data. Earlier, unsupported Django series such as 5.0.x, 4.1.x, and 3.2.x were not evaluated a...