PT-2026-79367

Name of the Vulnerable Software and Affected Versions LitExtension WordPress plugin versions prior to 1.2.6 Description The plugin fails to verify a nonce a unique token used to prevent replay attacks before performing an administrative action that overwrites the store-migration connector's...

CVE-2026-19085: Authorization Bypass Through User-Controlled Key

The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable...

PT-2026-79307

Name of the Vulnerable Software and Affected Versions Duplicate Post WordPress plugin versions prior to 1.5.6 Description Insufficient validation occurs when duplicating posts, as the plugin fails to verify if the user has permission to read the content before the duplication process. This allows...

PT-2026-79366

Name of the Vulnerable Software and Affected Versions Eventin WordPress plugin versions prior to 4.1.21 Description Insufficient validation of user-supplied webhook URLs stored on events and a failure to verify event ownership allow users with contributor-level access and above to trigger blind...

PT-2026-79301

Name of the Vulnerable Software and Affected Versions Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin versions prior to 5.0.14 Description An unauthenticated store REST endpoint fails to restrict access to per-vendor commission configurations. This allows any...

PT-2026-79306

Name of the Vulnerable Software and Affected Versions Drag and Drop Multiple File Upload for Contact Form 7 versions prior to 1.3.9.9 Description An issue exists where the plugin fails to validate the final name of an uploaded file after stripping characters from it. This allows unauthenticated...

PT-2026-79299

Name of the Vulnerable Software and Affected Versions Drag and Drop Multiple File Upload for Contact Form 7 versions prior to 1.3.9.9 Description Insufficient escaping of a setting used as an HTML tag name in front-end output allows users with administrator access to perform a Stored Cross-Site...

PT-2026-79504

Name of the Vulnerable Software and Affected Versions AutomatorWP versions prior to 5.8.5 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated users with subscriber-level access or higher can...

PT-2026-79503

Name of the Vulnerable Software and Affected Versions Themify Builder versions prior to 7.8.1 Description The plugin fails to properly verify user authorization when performing certain actions. This allows unauthenticated attackers to modify stored styling data, specifically padding and margin...

PT-2026-79300

Name of the Vulnerable Software and Affected Versions Link Whisper Free WordPress plugin versions prior to 0.9.7 Description Authenticated users with the Editor role or higher can perform SQL injection attacks because the plugin fails to properly sanitize and escape the domain parameter before...

PT-2026-79533

Name of the Vulnerable Software and Affected Versions Post Duplicator versions prior to 3.0.12 Description The Post Duplicator plugin for WordPress allows unauthorized modification of data because the duplicate post function fails to verify if a user possesses the edit others posts capability. Th...

PT-2026-79531

Name of the Vulnerable Software and Affected Versions Post Duplicator versions prior to 3.0.12 Description An authorization bypass exists due to the duplicate post permissions permission callback verifying only the duplicate posts capability while failing to check for publish posts or other...

PT-2026-81176

Name of the Vulnerable Software and Affected Versions WP Project Manager Pro versions prior to 4.0.2 Description Insufficient escaping of user-supplied parameters and lack of proper preparation in SQL queries allow authenticated attackers with Subscriber-level access and above to perform SQL...

PT-2026-79298

Name of the Vulnerable Software and Affected Versions NewPath WildApricotPress Add-on versions prior to 1.0.1 Description The NewPath WildApricotPress Add-on WordPress plugin fails to enforce privacy restrictions for members-only fields on an unauthenticated REST route. This allows anonymous...

PT-2026-79304

Name of the Vulnerable Software and Affected Versions Media Library Assistant versions prior to 3.40 Description Users with the Author role can perform SQL injection, a technique used to manipulate backend databases, because a search parameter is not validated before being concatenated into a SQL...

PT-2026-79505

Name of the Vulnerable Software and Affected Versions AutomatorWP versions prior to 5.8.5 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated users with subscriber-level access or higher can...

PT-2026-79530

Name of the Vulnerable Software and Affected Versions The kk Star Ratings – Rate Post & Collect User Feedbacks versions prior to 5.4.10.4 Description Unauthenticated attackers can execute arbitrary shortcodes because the software fails to properly validate the payload value before it is processed...

PT-2026-79371

Name of the Vulnerable Software and Affected Versions Limit Login Attempts Reloaded versions prior to 3.3.5 Description The plugin fails to perform case-insensitive comparisons when checking logins against the username denylist and does not consider the account email address. This allows blocked...

PT-2026-79370

Name of the Vulnerable Software and Affected Versions Passster WordPress plugin versions prior to 4.3.9 Description The plugin fails to correctly match its public endpoint paths when determining which REST API requests should bypass global password protection. This occurs because the system...

CVE-2026-13176: Server-Side Request Forgery (SSRF)

The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts...