CVE-2026-77786 Rank Math SEO < 1.0.277 - Editor+ Core Settings Modification via fix-site-seo Ability

The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to...

CVE-2026-77704 Amelia 1.2.32 - 2.4.8 - Amelia Customer+ Appointment Status Update and Self-Approval

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their ow...

WordPress HEL Online Classroom: AI-powered Online Classrooms plugin <= 1.0.3 - Unauthenticated Plugin Settings Update vulnerability

Unauthenticated Plugin Settings Update vulnerability discovered by kimsunghoon in WordPress Plugin HEL Online Classroom: AI-powered Online Classrooms versions = 1.0.3...

EUVD-2026-68059

The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to...

CVE-2026-77010 HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Moderator Join URL Disclosure and Class Access Code Bypass

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code, allowing unauthenticated users to obtain a signed meeting join link for any classroom,...

CVE-2026-77786

The Rank Math SEO WordPress plugin, in versions prior to 1.0.277 , contains an incorrect authorization vulnerability. The plugin fails to verify if a user requesting an automated SEO fix possesses the specific capabilities required by WordPress for the underlying settings. This allows users with ...

CVE-2026-77010 HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Moderator Join URL Disclosure and Class Access Code Bypass

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code, allowing unauthenticated users to obtain a signed meeting join link for any classroom,...

CVE-2026-77010

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin (versions prior to 1.0.4 ) contains an improper access control vulnerability. The plugin fails to perform sufficient authorization checks on its REST API routes and inconsistently enforces per-class access codes . This securi...

CVE-2026-77704

The Booking for Appointments and Events Calendar WordPress plugin (versions 1.2.32-2.4.8 ) is vulnerable to an incorrect authorization issue. The plugin fails to verify if a user possesses the required capabilities before allowing them to modify an appointment's status. This flaw enables customer...

EUVD-2026-68058

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their ow...

CVE-2026-77012

The 爱采集数据采集和发布插件 WordPress plugin (versions

CVE-2026-77704 Amelia 1.2.32 - 2.4.8 - Amelia Customer+ Appointment Status Update and Self-Approval

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their ow...

WordPress Rank Math SEO plugin < 1.0.277 - Editor+ Core Settings Modification vulnerability

Editor+ Core Settings Modification vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Rank Math SEO versions 1.0.277...

WordPress Booking for Appointments and Events Calendar plugin 1.2.32-2.4.8 - Amelia Customer+ Appointment Status Update and Self-Approval vulnerability

Amelia Customer+ Appointment Status Update and Self-Approval vulnerability discovered by Louise in WordPress Plugin Amelia versions 1.2.32-2.4.8...

CVE-2026-77012 Icollect <= 1.0.0 - Unauthenticated Arbitrary File Read, SSRF and Path Traversal File Write via Default Publishing Password

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given, allowing unauthenticated attackers to read arbitrary files from the...

WordPress Appointment Booking Calendar Plugin and Scheduling Plugin plugin 1.5.6-1.6.2 - Unauthenticated Booking Price Manipulation vulnerability

Unauthenticated Booking Price Manipulation vulnerability discovered by Nguyen Phuoc Thinh - HPT Vietnam Corporation in WordPress Plugin BookingPress versions 1.5.6-1.6.2...

CVE-2026-76586

The Appointment Booking Calendar Plugin and Scheduling Plugin for WordPress (versions 1.5.6-1.6.2 ) is vulnerable to an unauthenticated booking price manipulation via PayPal payment confirmation. The root cause is a failure to verify the amount actually paid against the server-side staged price d...

CVE-2026-77007

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin (versions

EUVD-2026-68054

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected...

CVE-2026-76586 BookingPress 1.5.6 - 1.6.2 - Unauthenticated Booking Price Manipulation via PayPal Payment Confirmation

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a...