CVE-2025-11455

The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/wp-retina-2x/v1/replace REST API in all versions up to, and including, 7.2.0 This makes it possible for authenticated attackers, with Author-level access an...

CVE-2025-11455 Perfect Images <= 7.2.0 - Missing Authorization to Authenticated (Author+) Image Replacement

The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/wp-retina-2x/v1/replace REST API in all versions up to, and including, 7.2.0 This makes it possible for authenticated attackers, with Author-level access an...

Essential Blocks < 6.4.0 - Information Disclosure

Gutenberg Essential Blocks WordPress plugin 6.4.0 contains an information disclosure caused by unrestricted access to a public REST route exposing non-public WooCommerce sales metrics, letting unauthenticated users read product sales data. id: CVE-2026-13153 info: name: Essential Blocks 6.4.0 -...

CVE-2025-11455: tigroumeow: The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability…

The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/wp-retina-2x/v1/replace REST API in all versions up to, and including, 7.2.0 This makes it possible for authenticated attackers, with Author-level access an...

CVE-2020-10257

/ \ \ / / || \ \ / |/ \ | | | \ V /| |/ / / / || | / /| \ / / | / || /// ||/|/// by darkcast CVE-2020-10257: WordPress TRX Addons Plugin Unauthenticated Remote Code Execution RCE Vulnerability Affected Plugin: TRX Addons Vulnerability Type: Unauthenticated Remote Code Execution RCE CVSS Score:...

CVE-2026-112347

Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/pageid route and the savepagedata, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware...

EUVD-2026-113951

Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/pageid route and the savepagedata, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware...

CVE-2026-112347 Kirki WordPress Plugin < 6.4.1 Broken Object-Level Access Control via Page API

Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/pageid route and the savepagedata, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware...

CVE-2026-112347

The Kirki plugin for WordPress (versions before 6.4.1) is susceptible to a broken object-level access control vulnerability in its page REST API. The flaw resides in the PageController.php file, specifically within the save_page_data, duplicate, and delete handlers for the PUT /wp-json/kirki/v1/p...

CVE-2026-112347 Kirki WordPress Plugin < 6.4.1 Broken Object-Level Access Control via Page API

Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/pageid route and the savepagedata, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware...

CVE-2026-110732

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin is vulnerable to Missing Authorization in versions up to and including 3.8.6 . The issue stems from the MCP module's OAuth 2.1 Dynamic Client Registration endpoint (/wp-json/mcp/v1/oauth/register) using a permission_callback of ...

WP2Shell-Scanner

WP2Shell Scanner A command line tool that checks whether a WordPress site is exposed to WP2Shell CVE-2026-63030 and CVE-2026-60137. It reads the WordPress version and REST API surface over read-only requests and reports a verdict. It does not exploit anything. !WARNING For authorised testing only...

PT-2026-133558

Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/page id route and the save page data, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middlewar...

CVE-2026-109516

The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The /wp-json/woo-telegram/v1/main/ REST endpoint is registered with permissioncallback = 'returntrue' and performs no Telegram...

CVE-2026-109516 Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token

The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The /wp-json/woo-telegram/v1/main/ REST endpoint is registered with permissioncallback = 'returntrue' and performs no Telegram...

EUVD-2026-112584

The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The /wp-json/woo-telegram/v1/main/ REST endpoint is registered with permissioncallback = 'returntrue' and performs no Telegram...

EUVD-2026-112503

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted poststatus and posttype values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/queryresult REST endpoint...

CVE-2026-118804

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted poststatus and posttype values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/queryresult REST endpoint...

CVE-2026-118804 Bricks Broken Access Control via query_result Endpoint

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted poststatus and posttype values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/queryresult REST endpoint...

CVE-2026-118804

Bricks Builder version 2.4.3 and earlier is vulnerable to a broken access control flaw. Unauthenticated attackers can exploit the POST /wp-json/bricks/v1/query_result REST endpoint by providing a publicly obtainable nonce and crafted post_status and post_type values within the originalQueryVars p...