WordPress Flatsome theme < 3.20.13 - Unauthenticated Unpublished Post Disclosure vulnerability

Unauthenticated Unpublished Post Disclosure vulnerability discovered by Huseyin Mertoglu in WordPress Theme Flatsome versions 3.20.13...

CVE-2026-117487

The Flatsome WordPress theme (versions before 3.20.13 ) contains a vulnerability where the flatsome_ajax_apply_shortcode AJAX action lacks necessary capability or nonce checks for unauthenticated users. This allows unauthorized individuals to disclose the content of unpublished posts , including ...

CVE-2026-118412

Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled to sign in again through OpenID and read unpublished entries. The OpenID sign-in path did not check whether the account was enabled. Only sites that enable the non-default OpenID...

CVE-2026-118412 Apache Roller: Disabled accounts can sign in through OpenID

Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled to sign in again through OpenID and read unpublished entries. The OpenID sign-in path did not check whether the account was enabled. Only sites that enable the non-default OpenID...

CVE-2026-118412

Apache Roller versions 5.1.0 through 6.1.6 are vulnerable to an improper authentication flaw. The root cause is that the OpenID sign-in path fails to verify if an account has been disabled by an administrator. Affected systems that enable the non-default OpenID authentication mode may allow users...

CVE-2026-118412 Apache Roller: Disabled accounts can sign in through OpenID

Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled to sign in again through OpenID and read unpublished entries. The OpenID sign-in path did not check whether the account was enabled. Only sites that enable the non-default OpenID...

EUVD-2026-123513

Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled to sign in again through OpenID and read unpublished entries. The OpenID sign-in path did not check whether the account was enabled. Only sites that enable the non-default OpenID...

CVE-2026-118412

Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled to sign in again through OpenID and read unpublished entries. The OpenID sign-in path did not check whether the account was enabled. Only sites that enable the non-default OpenID...

CVE-2026-118408

Apache Roller versions 4.0 through 6.1.6 are vulnerable to a Missing Authorization issue. The vulnerability exists because the entry preview functionality verifies that a user is logged in but fails to verify if the user has a specific role in the weblog being previewed. This allows any authentic...

CVE-2026-118408 Apache Roller: Unpublished entries of other weblogs readable through preview

Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previewed. The attacker must know the weblog...

CVE-2022-1388

Old exploit I forgot to publish...

CVE-2026-118412: Apache Software Foundation Apache Roller: Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled…

Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled to sign in again through OpenID and read unpublished entries. The OpenID sign-in path did not check whether the account was enabled. Only sites that enable the non-default OpenID...

PT-2026-145178

Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previewed. The attacker must know the weblog...

CVE-2026-118408: Apache Software Foundation Apache Roller: Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a…

Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previewed. The attacker must know the weblog...

PT-2026-145182

Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled to sign in again through OpenID and read unpublished entries. The OpenID sign-in path did not check whether the account was enabled. Only sites that enable the non-default OpenID...

WordPress Secure Custom Fields plugin < 6.9.8 - Contributor+ Unpublished Post Title and Status Disclosure vulnerability

Contributor+ Unpublished Post Title and Status Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin Secure Custom Fields versions 6.9.8...

CVE-2026-118528

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not validate that the requesting user owns the referenced listing before returning its metadata via an AJAX action, allowing authenticated attackers with Subscriber-level access and above t...

EUVD-2026-118934

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not validate that the requesting user owns the referenced listing before returning its metadata via an AJAX action, allowing authenticated attackers with Subscriber-level access and above t...

WordPress Advanced Custom Fields (ACF®) plugin < 6.8.11 - Contributor+ Unpublished Post Title and Status Disclosure vulnerability

Contributor+ Unpublished Post Title and Status Disclosure vulnerability discovered by vuxvinh in WordPress Plugin Advanced Custom Fields versions 6.8.11...

WordPress PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin 3.9.0-4.3.0 - Subscriber+ Unpublished Content Disclosure vulnerability

Subscriber+ Unpublished Content Disclosure vulnerability discovered by trangdld in WordPress Plugin PublishPress Revisions versions 3.9.0-4.3.0...