WordPress Simple Job Board - Unauthorized Data Access

The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetchquickjob function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be...

YMC Filter WordPress - Unauthenticated Post Disclosure

YMC Filter WordPress plugin 3.11.3 contains a broken access control vulnerability caused by improper authorization and lack of validation in a REST API endpoint, letting unauthenticated attackers retrieve private and non-public post content, exploit requires no authentication. id: CVE-2026-10823...

WordPress <= 5.2.4 - Unauthenticated View Private/Draft Posts

WordPress before 5.2.4 contains an information disclosure caused by mishandling of the static query property, letting unauthenticated users view certain content, exploit requires no authentication. id: CVE-2019-17671 info: name: WordPress = 5.2.4 - Unauthenticated View Private/Draft Posts author:...

PT-2026-146502

Name of the Vulnerable Software and Affected Versions Pagelayer versions 2.1.7 through 2.2.0 Description A missing authorization issue exists in the Abilities API within the main/abilitiesregister.php file. This flaw allows attackers with contributor-level permissions to bypass intended...

CVE-2025-54352

CVE-2025-54352 PoC Usage Steps to install and test the WordPress PoC: 1. Install a fresh version of WordPress using Docker: 1.1 Start the MySQL database container: docker run --name wp-db -e MYSQLDATABASE=wp-db -e MYSQLUSER=wpuser -e MYSQLPASSWORD=password -e MYSQLROOTPASSWORD=rootpass -d...

CVE-2026-119034

The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a post is publicly viewable before returning its approved comments through the review feature, allowing unauthenticated attackers to read approved comments on private, draft and password-protected posts, a...

CVE-2026-119034: Unknown Schema & Structured Data for WP & AMP: The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a post is publicly viewable…

The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a post is publicly viewable before returning its approved comments through the review feature, allowing unauthenticated attackers to read approved comments on private, draft and password-protected posts, a...

CVE-2026-105971

The Car Dealer Dealership and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of any private, draft, pending, future or trashed post by...

EUVD-2026-117351

The Car Dealer Dealership and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of any private, draft, pending, future or trashed post by...

CVE-2026-111740

The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts...

CVE-2026-111740

The Post Duplicator WordPress plugin, in versions before 3.0.17 , fails to verify if a requesting user has permission to view individual posts when returning a list of posts for a specific post type. This flaw allows users with a role as low as Contributor to access and read the titles and hierar...

EUVD-2026-116720

The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts...

CVE-2026-111740 Post Duplicator < 3.0.17 - Contributor+ Draft and Private Post Title Disclosure

The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts...

CVE-2026-82214

The Quick Event Manager WordPress plugin (versions 8.4.6-9.18 ) contains a vulnerability where it fails to verify the status or type of a requested post during a calendar export . This flaw allows unauthenticated users to access and read the content of draft and private posts . The vulnerability ...

CVE-2026-82214 Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure via ICS Download

The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export, allowing unauthenticated users to read the content of draft and private posts...

CVE-2026-82214 Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure via ICS Download

The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export, allowing unauthenticated users to read the content of draft and private posts...

PT-2026-134433

Name of the Vulnerable Software and Affected Versions Quick Event Manager WordPress plugin versions prior to 9.19 Description An issue exists where the plugin fails to verify the status or type of a requested post before returning its details via a calendar export. This allows unauthenticated use...

CVE-2026-82214: Unknown Quick Event Manager: The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before…

The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export, allowing unauthenticated users to read the content of draft and private posts...

PT-2026-133714

The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.5.4 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and...

CVE-2026-13747: tigroumeow Meow Gallery: The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.5.4…

The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.5.4 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and...