CVE-2026-72829

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope-cap bypass in UsersController's create and update methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin check that reads access.api.super...

CVE-2026-72833

The Grav API plugin (getgrav/grav-plugin-api) versions 1.0.6–1.0.11 contain a privilege-escalation vulnerability. A scoped API key minted on a super-admin account bypasses the scope cap on four isSuperAdmin()-gated write endpoints (GroupsController, AccountsConfigController, PreferencesController...

PT-2022-15017 · WordPress +1 · Wordpress +1

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.8.3 WordPress versions prior to 3.7.37 Description: The issue concerns a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin ro...