237 matches found
CVE-2026-18357
The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any customer of the store, such as billing names, order IDs and statuse...
EUVD-2026-54877
The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any customer of the store, such as billing names, order IDs and statuse...
CVE-2026-18357 WPC Order Tip for WooCommerce < 3.3.1 - Unauthenticated Order Data Disclosure
The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any customer of the store, such as billing names, order IDs and statuse...
CVE-2026-18357
The CVE affects the WPC Order Tip for WooCommerce WordPress plugin prior to version 3.3.1. A reporting feature fails to perform authorization or nonce checks, enabling unauthenticated attackers to retrieve sensitive customer order data (e.g., billing names, order IDs, statuses, fee amounts, and o...
CVE-2026-14839
The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...
CVE-2026-14226
The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site,...
CVE-2026-14226 Easy Appointments < 3.12.28 - Subscriber+ Sensitive Information Disclosure via REST Appointments Listing
The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site,...
CVE-2026-14226
The Easy Appointments WordPress plugin (up to version 3.12.26) exposes an appointment-listing REST endpoint that does not enforce a sufficient capability, restricting access to a capability held by all authenticated users. This allows subscriber-level users to read all bookings on the site, inclu...
CVE-2026-17166
The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an...
CVE-2026-17166
The CVE concerns The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar (WordPress) with an authorization bypass in all versions up to and including 5.3.7. The root cause is that the plugin does not properly verify that a user is authorized to perform ...
CVE-2026-17166
The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an...
CVE-2026-12973
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to...
EUVD-2026-45887
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to...
CVE-2026-12973
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to...
PT-2026-61582
Network-AI npm: network-ai versions 5.12.2 through 5.13.3 fail to apply the configured authorization check checkAuth/secret to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET...
CVE-2026-13798
creationtimestamp| type| source ---|---|--- 2026-07-01 05:09:13+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116842990988360734 2026-07-02 07:18:59+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:15:10+00:00| seen|...
CVE-2026-12416
creationtimestamp| type| source ---|---|--- 2026-06-24 08:03:01+00:00| seen| https://bsky.app/profile/securitycyberuk.bsky.social/post/3mozhayscl62p 2026-06-24 09:00:33+00:00| seen| https://infosec.exchange/users/offseq/statuses/116804264395356312 2026-06-24 09:00:35+00:00| seen|...
CVE-2026-10521
creationtimestamp| type| source ---|---|--- 2026-06-23 07:36:29+00:00| seen| https://infosec.exchange/users/certvde/statuses/116798271507262478 2026-06-23 07:45:43+00:00| seen| https://infosec.exchange/users/certvde/statuses/116798307883543003 2026-06-23 11:20:33+00:00| seen|...
CVE-2026-12726
A flaw was found in the AWX GitHub webhook integration. When processing GitHub pullrequest webhooks, the controller stores the pullrequest.statusesurl value from the webhook payload without validating that it points to a trusted GitHub API endpoint. If a job template is configured with a GitHub...
CVE-2026-12726
A flaw was found in the AWX GitHub webhook integration. When processing GitHub pullrequest webhooks, the controller stores the pullrequest.statusesurl value from the webhook payload without validating that it points to a trusted GitHub API endpoint. If a job template is configured with a GitHub...