CVE-2026-119763

The software changelog.com (prior to commit 7b35e829 ) is susceptible to a missing authorization vulnerability (CWE-862). This flaw allows unauthenticated attackers to access unpublished content through preview routes within the PostController , NewsIssueController , and NewsItemController . By e...

CVE-2026-119763 changelog.com before commit 7b35e829 Missing Authorization via Preview Routes

changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostController, NewsIssueController and NewsItemController. Attackers can enumerate hashid post IDs, sequential newsletter...

CVE-2026-80333

The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticated visitors to read the rendered content of non-published posts and pages of any type that WordPress would otherwise not serve...

CVE-2026-80333 Solace Extra < 1.7.2 - Unauthenticated Non-Published Post Content Disclosure via Preview Routes

The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticated visitors to read the rendered content of non-published posts and pages of any type that WordPress would otherwise not serve...

CVE-2026-80333 Solace Extra < 1.7.2 - Unauthenticated Non-Published Post Content Disclosure via Preview Routes

The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticated visitors to read the rendered content of non-published posts and pages of any type that WordPress would otherwise not serve...

CVE-2026-80333

The Solace Extra WordPress plugin versions prior to 1.7.2 contains a vulnerability where it fails to perform adequate authorization or post-status checks on its front-end preview routes. This flaw allows unauthenticated visitors to access and read the rendered content of non-published posts and p...

EUVD-2026-89636

The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticated visitors to read the rendered content of non-published posts and pages of any type that WordPress would otherwise not serve...

CVE-2026-80333: Exposure of Sensitive Information to an Unauthorized Actor

The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticated visitors to read the rendered content of non-published posts and pages of any type that WordPress would otherwise not serve...

PT-2026-103025

The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticated visitors to read the rendered content of non-published posts and pages of any type that WordPress would otherwise not serve...

GHSA-7F3R-GWC9-2995 view_component: Preview Route Can Dispatch Inherited Helper Methods

Summary The preview route derives an example name from the URL and calls it with publicsend. The code does not verify that the requested method is one of the preview examples explicitly defined by the preview class. As a result, inherited public methods on ViewComponent::Preview are...

PT-2026-39302

Name of the Vulnerable Software and Affected Versions view component versions 3.0.0 through 4.8.x Description The preview route derives an example name from the URL and invokes it using public send without verifying if the requested method is an explicitly defined preview example. This allows...