CVE-2026-8688

The Advance Nav Menu Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-8688: Missing Authorization

The Advance Nav Menu Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-2386: Incorrect Authorization

The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 6.4.7. This is due to the tpaecreatepage AJAX handler authorizing users only with...

WordPress <=4.2.2 由竞争条件导致的权限提升

WordPress采用了一种功能丰富、易于扩展的角色和能力模型，其中每个用户都被指定一种角色，从权限最低的订阅者到有无限权力的超级管理员。我们知道，即使订阅者也是有权访问WordPress管理员控制面板的，该面板位于/admin目录。相对于管理员而言，订阅者可以使用的面板选项极为有限，因为会受到相应权限的限制。在默认情况下，订阅者只有“readpage”和“readpost”权限，可以读取文章和网页。...