By-Poloss..-..CVE-2026-12432-PoC

CVE-2026-12432: WP Full Stripe Free = 8.4.4 Published : June 26, 2026 Last Updated : June 27, 2026 Researcher : Netwurm - VTDR e.V.i.G. Vulnerability Description The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.4.3 via the...

EUVD-2026-111404

A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/resultmanager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading ...

CVE-2026-118128

A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/resultmanager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading ...

CVE-2026-118128 a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition

A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/resultmanager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading ...

CVE-2026-118128

A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/resultmanager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading ...

CVE-2026-118128 a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition

A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/resultmanager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading ...

CVE-2026-118128

The a2aproject a2a-js software (versions up to 1.1.0 ) is vulnerable to a race condition within the Task Status Update Handler component. Specifically, the flaw exists in the ResultManager.applyStatusUpdate function located in the file src/server/result_manager.ts. This vulnerability can be explo...

CVE-2026-118128 a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition

A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/resultmanager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading ...

PT-2026-127246

A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/result manager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading...

CVE-2026-106010

The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default...

EUVD-2026-104096

The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default...

CVE-2026-106010: Missing Authorization

The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default...

PT-2026-117241

Name of the Vulnerable Software and Affected Versions BDM Digital Payment Gateway WordPress plugin versions prior to 1.3.13 Description The plugin fails to verify credentials on its public payment-status update route and treats unset credentials as valid. This allows unauthenticated attackers to...

CVE-2026-89289 Fast Courier <= 5.2.3 - Unauthenticated Order Fulfillment Update via order-status-update REST Endpoint

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id...

CVE-2026-89289

The Fast Courier WordPress plugin (versions

CVE-2026-89289 Fast Courier <= 5.2.3 - Unauthenticated Order Fulfillment Update via order-status-update REST Endpoint

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id...

CVE-2026-97219

The MStore API WordPress plugin before version 4.22.1 is vulnerable to a payment bypass due to a lack of restriction on which fields of an order a customer can update. This allows any authenticated user with a self-registerable account to modify the status of their own unpaid orders to a paid or ...

CVE-2026-101139

A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotel...

CVE-2026-101139 Webkul Bagisto Invoice Mass Status Update state authorization

A vulnerability was detected in Webkul Bagisto up to 2.4.6. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The explo...

CVE-2026-101139 Webkul Bagisto Invoice Mass Status Update state authorization

A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotel...