PT-2026-86383

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create...

CVE-2026-18357

The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any customer of the store, such as billing names, order IDs and statuse...

CVE-2026-18357 WPC Order Tip for WooCommerce < 3.3.1 - Unauthenticated Order Data Disclosure

The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any customer of the store, such as billing names, order IDs and statuse...

EUVD-2026-54877

The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any customer of the store, such as billing names, order IDs and statuse...

CVE-2026-18357

The WPC Order Tip for WooCommerce WordPress plugin versions before 3.3.1 is vulnerable to an unauthenticated order data disclosure vulnerability. The issue stems from a failure to perform proper authorisation or nonce checks within one of its reporting features. This allows an unauthenticated att...

CVE-2026-14839

The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...

CVE-2026-14226

The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site,...

CVE-2026-14226 Easy Appointments < 3.12.28 - Subscriber+ Sensitive Information Disclosure via REST Appointments Listing

The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site,...

CVE-2026-14226

The Easy Appointments WordPress plugin (versions before 3.12.28 ) is vulnerable to a sensitive information disclosure because one of its appointment-listing REST endpoints lacks sufficient capability requirements. The endpoint only verifies a capability held by every authenticated user, allowing ...

PT-2026-66383

The Easy Appointments WordPress plugin through 3.12.26 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site,...

CVE-2026-17166

The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an...

CVE-2026-17166

The CVE concerns The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar (WordPress) with an authorization bypass in all versions up to and including 5.3.7. The root cause is that the plugin does not properly verify that a user is authorized to perform ...

CVE-2026-17166

The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an...

CVE-2026-12973

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to...

EUVD-2026-45887

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to...

CVE-2026-12973

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to...

PT-2026-61582

Network-AI npm: network-ai versions 5.12.2 through 5.13.3 fail to apply the configured authorization check checkAuth/secret to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET...

PT-2026-61530

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to...

CVE-2026-13798

creationtimestamp| type| source ---|---|--- 2026-07-01 05:09:13+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116842990988360734 2026-07-02 07:18:59+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:15:10+00:00| seen|...

CVE-2026-12416

creationtimestamp| type| source ---|---|--- 2026-06-24 08:03:01+00:00| seen| https://bsky.app/profile/securitycyberuk.bsky.social/post/3mozhayscl62p 2026-06-24 09:00:33+00:00| seen| https://infosec.exchange/users/offseq/statuses/116804264395356312 2026-06-24 09:00:35+00:00| seen|...