CVE-2026-17018: Authorization Bypass Through User-Controlled Key

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

CVE-2026-73033: Improper Limitation of a Pathname to a Restricted Directory

Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscanintegrity...

CVE-2026-18786: Improper Authentication

The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible f...

📄 TrueBooker 1.2.3 Unauthenticated Password Reset

A proof of concept exploit for an authentication bypass vulnerability in TrueBooker version 1.2.3. The vulnerability affects the WordPress TrueBooker Appointment Booking and Scheduler System plugin and allows an unauthenticated attacker to reset the password of an arbitrary user account. The...

PT-2026-71573

Name of the Vulnerable Software and Affected Versions FluentCommunity versions prior to 2.7.6 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary w...

CVE-2026-18960: Improper Authentication

The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API...

PT-2026-69337

Name of the Vulnerable Software and Affected Versions Eventin WordPress plugin versions prior to 4.1.20 Description Insufficient validation of a template path setting allows users with editor-level access and above to include and execute arbitrary local PHP files. This is a Local File Inclusion L...

CVE-2026-15229: Incorrect Authorization

The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price including zero and, by selecting a specific payment method, obtain an instantly-approved reservation...

CVE-2026-17021: Missing Authorization

The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings...

WavePlayer Plugin Arbitrary File Upload Code Execution

The vulnerability of the waveplayercreatelocalcopy function in the WordPress content management system’s plugin, WavePlayer, allows for unlimited loading of malicious files. Exploiting this vulnerability enables a remote attacker to load arbitrary files and execute arbitrary code by loading a...

PT-2026-69382

Name of the Vulnerable Software and Affected Versions Duplicate Post WordPress plugin versions prior to 1.5.5 Description Insufficient per-object authorization checks in bulk copy and delete operations allow users with assigned plugin access to permanently delete arbitrary posts on the site,...

PT-2026-69339

Name of the Vulnerable Software and Affected Versions Advanced Excerpt WordPress plugin versions prior to 4.5 Description Stored Cross-Site Scripting XSS occurs because the plugin fails to sanitize and escape a settings value before it is rendered on the site front end. This allows administrators...

CVE-2026-14941: Missing Authorization

The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related AJAX actions, allowing users with minimal permissions such as Subscribers to invoke administrative settings handlers, update Customer Reviews for WooCommerc...

CVE-2026-13170: Improper Limitation of a Pathname to a Restricted Directory

The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level access and above to include and execute arbitrary local PHP files...

PT-2026-69338

Name of the Vulnerable Software and Affected Versions AutoNetTV Relay WordPress plugin versions prior to 3.0.14 Description The plugin fails to perform capability or authentication checks before setting a WordPress administrator authentication cookie during its scheduled content-synchronization...

PT-2026-69366

Name of the Vulnerable Software and Affected Versions File Manager WordPress plugin versions prior to 6.9.1 Description Lack of authorization checks on a REST API route allows unauthenticated users to access the file activity log. This leads to the disclosure of file operations performed on the...

PT-2026-69340

Name of the Vulnerable Software and Affected Versions HT Contact Form WordPress plugin versions prior to 2.9.3 Description An authorization bypass exists in the endpoint that returns saved form drafts. This allows unauthenticated users to access and read personal data stored within these drafts,...

CVE-2026-16985: Unrestricted Upload of File with Dangerous Type

The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the uploadfiles capability Author and above to write an executable PHP file into the uploads directory and achiev...

PT-2026-69355

Name of the Vulnerable Software and Affected Versions Squeeze WordPress plugin versions prior to 1.7.12 Description Insufficient validation of file types or extensions during attachment-update actions allows users with the upload files capability, such as those with Author privileges and above, t...

CVE-2026-17540: Improper Access Control

The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's...