CVE-2026-81766 Really Simple Security < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation via rsp_upgrade_install_plugin

The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute...

CVE-2026-81766 Really Simple Security < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation via rsp_upgrade_install_plugin

The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute...

CVE-2026-81766

The Really Simple Security WordPress plugin (versions before 9.8.0 ) is vulnerable to an arbitrary plugin installation flaw. Due to insufficient authorization checks during the plugin installation process, a subsite administrator on a multisite network can install and execute arbitrary code withi...

EUVD-2026-68160

The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute...

PT-2026-83528

The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute...

CVE-2026-81766: Improper Privilege Management

The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute...

CVE-2026-10522

The MemberHero WordPress plugin (versions through 6.9 ) contains a vulnerability where it fails to restrict account fields during the frontend registration process. This flaw allows unauthenticated attackers to register new users with arbitrary roles , such as Administrator , potentially leading ...

CVE-2026-10522 Simple User Registration <= 6.9 - Unauthenticated Privilege Escalation to Administrator

The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthenticated attackers to register a new user with an arbitrary role, including Administrator, leading to a full site takeover. Version 6.9 is...

CVE-2026-81767

Unauthenticated Broken Access Control in Simple Payment = 2.5.2 versions...

CVE-2026-81767 WordPress Simple Payment plugin <= 2.5.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Simple Payment = 2.5.2 versions...

CVE-2026-81767

CVE-2026-81767 affects the WordPress Simple Payment plugin in versions 2.5.2 and earlier , presenting an unauthenticated Broken Access Control flaw. The CVSS 3.1 base score is 7.5 (HIGH) , with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, indicating an attacker requires no credentials or user...

CVE-2026-81767 WordPress Simple Payment plugin <= 2.5.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Simple Payment = 2.5.2 versions...

EUVD-2026-67734

Unauthenticated Broken Access Control in Simple Payment = 2.5.2 versions...

WordPress Simple Membership plugin < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name vulnerability

Unauthenticated Stored XSS via PayPal Subscription Subscriber Name vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Simple Membership versions 4.7.8...

WordPress Simple Payment plugin <= 2.5.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by JunHee CHO in WordPress Plugin Simple Payment versions = 2.5.2...

PT-2026-83153

Unauthenticated Broken Access Control in Simple Payment = 2.5.2 versions...

CVE-2026-81767: Missing Authorization

Unauthenticated Broken Access Control in Simple Payment = 2.5.2 versions...

EUVD-2026-66768

Simple Machines Forum SMF through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit th...

CVE-2026-43621

Simple Machines Forum SMF through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit th...

CVE-2026-43621 Simple Machines Forum < 2.1.7 Authorization Confusion via Profile::load()

Simple Machines Forum SMF through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit th...