EUVD-2026-66877

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a...

WordPress UpdraftPlus: WP Backup & Migration Plugin plugin < 1.26.7 - Backup Restoration vulnerability

Backup Restoration vulnerability discovered by Jashid Sany in WordPress Plugin UpdraftPlus versions 1.26.7...

CVE-2026-77016

The Workeera WordPress plugin (versions before 1.0.6 ) is vulnerable to arbitrary file deletion due to a mass assignment flaw in the candidate profile functionality. The plugin fails to restrict which values can be written to a user's own profile and does not validate or contain the stored file p...

CVE-2026-76549 UpdraftPlus < 1.26.7 - Backup Restoration via CSRF

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a...

CVE-2026-19715 WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

EUVD-2026-66876

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

CVE-2026-76549

The UpdraftPlus: WP Backup & Migration Plugin for WordPress (versions before 1.26.7 ) is vulnerable to a Cross-Site Request Forgery (CSRF) . The flaw exists because the plugin lacks proper CSRF checks in one of its backup management actions. An attacker could trick a logged-in administrator into ...

CVE-2026-77016 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Deletion via Candidate Profile Mass Assignment

The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server...

CVE-2026-77016 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Deletion via Candidate Profile Mass Assignment

The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server...

CVE-2026-19715

The WP OAuth Server ( Login with WordPress ) WordPress plugin in versions before 6.3.1 is vulnerable to an unauthenticated information disclosure. When debug logging is enabled, the plugin writes to a debug log stored at a fixed and publicly reachable location without restricting access. This all...

CVE-2026-16567

The Document Embedder WordPress plugin, in versions before 2.3.1 , is vulnerable to an unauthenticated private document download. The flaw occurs because the plugin fails to verify a document's status before issuing a download token and streaming the file. This allows an unauthenticated attacker ...

EUVD-2026-66873

The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

CVE-2026-19225 Defender Security < 6.2.0 - Admin+ Network-Wide RCE via Hub Connector on Multisite

The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

CVE-2026-19223 Smush < 4.3.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite

The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

CVE-2026-19223

The Smush WordPress plugin (versions before 4.3.2 ) contains a vulnerability where it fails to restrict a network-wide setting to network administrators. This flaw allows an administrator of any single site within a multisite network to execute arbitrary code across the entire network. The root c...

EUVD-2026-66875

The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is not a Super Admin to download a full backup of the entire network, including every site's data...

CVE-2026-16567 Document Embedder < 2.3.1 - Unauthenticated Private Document Download via Token Oracle

The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...

CVE-2026-16567 Document Embedder < 2.3.1 - Unauthenticated Private Document Download via Token Oracle

The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...

WordPress JetBackup plugin 3.1.18.8-3.1.23.3 - Admin+ Multisite Network Backup Download vulnerability

Admin+ Multisite Network Backup Download vulnerability discovered by Akshat Parikh SN1PER in WordPress Plugin Backup Guard versions 3.1.18.8-3.1.23.3...

CVE-2026-19454

The JetBackup WordPress plugin (versions prior to 3.1.23.5 ) contains an incorrect authorization flaw. The plugin fails to perform a proper multisite authorization check before serving backup archives and job logs. This allows an administrator of the network's main site who lacks Super Admin priv...