56 matches found
WordPress Teddy Bear Customize Addon plugin <= 1.0.5 - Unauthenticated Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload vulnerability discovered by 0xBassia in WordPress Plugin Teddy Bear Customize Addon versions = 1.0.5...
WordPress Teddy Bear Customize Addon plugin <= 1.0.5 - Unauthenticated Account Takeover vulnerability
Unauthenticated Account Takeover vulnerability discovered by 0xBassia in WordPress Plugin Teddy Bear Customize Addon versions = 1.0.5...
CVE-2026-14562
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachments, allowing unauthenticated attackers to disclose other customers' order and attachment data...
CVE-2026-14559
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address...
CVE-2026-14560
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server...
WordPress Teddy Bear Customize Addon plugin <= 1.0.5 - Unauthenticated Order Data Disclosure vulnerability
Unauthenticated Order Data Disclosure vulnerability discovered by 0xBassia in WordPress Plugin Teddy Bear Customize Addon versions = 1.0.5...
EUVD-2026-75958
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address...
EUVD-2026-75960
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachments, allowing unauthenticated attackers to disclose other customers' order and attachment data...
CVE-2026-14562 Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Order Data Disclosure
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachments, allowing unauthenticated attackers to disclose other customers' order and attachment data...
CVE-2026-14560 Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server...
CVE-2026-14559 Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Account Takeover
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address...
CVE-2026-14560 Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server...
CVE-2026-14562
The teddy-bear-customize-addon WordPress plugin, affecting versions through 1.0.5 , contains an unauthenticated order data disclosure vulnerability. The root cause is a failure to perform authorization or ownership checks before returning WooCommerce order metadata and URLs of customer-uploaded a...
CVE-2026-14560
The teddy-bear-customize-addon WordPress plugin (versions
EUVD-2026-75959
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server...
CVE-2026-14559 Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Account Takeover
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address...
CVE-2026-14559
The teddy-bear-customize-addon WordPress plugin (versions ≤ 1.0.5 ) contains an unauthenticated account takeover vulnerability. The root cause is a failure to verify a user's password during the authentication process. This allows unauthenticated attackers to log in as any registered user, includ...
CVE-2026-14562 Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Order Data Disclosure
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachments, allowing unauthenticated attackers to disclose other customers' order and attachment data...
PT-2026-89773
Name of the Vulnerable Software and Affected Versions teddy-bear-customize-addon WordPress plugin versions prior to 1.0.6 Description The plugin fails to properly validate uploaded files by relying on a client-supplied content type and preserving the original filename. This allows unauthenticated...
PT-2026-89774
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachments, allowing unauthenticated attackers to disclose other customers' order and attachment data...