Unauthenticated IDOR in the Easy Appointments WordPress plugin (versions ≤ 3.12.27) lets remote, unauthenticated attackers manipulate appointment records belonging to other users by substituting predictable object identifiers in plugin endpoints. The CWE-639 root cause - Authorization Bypass Through User-Controlled Key - means ownership checks are entirely absent at the pre-authentication layer, consistent with the 'Authentication Bypass' tag in the Patchstack report. No public exploit code or CISA KEV listing was identified at time of analysis; no public exploit identified at time of analysis.
Broken authentication in Easy Digital Downloads WordPress plugin (versions ≤ 3.6.7) by Sandhills Development LLC allows unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), producing limited integrity and availability impact. The attack requires no credentials or user interaction over the network, earning a CVSS 6.5 Medium score - though Patchstack's 'Information Disclosure' tag introduces a potential confidentiality dimension not reflected in the base CVSS C:N designation, suggesting real impact may be slightly higher than the score implies. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Broken access control in WP ERP plugin (versions 1.17.5 and below) allows subscriber-level WordPress users to access sensitive ERP data they are not authorized to view. The CVSS vector confirms PR:L - a valid authenticated session at the subscriber tier is sufficient - and C:H indicates the exposed data carries high confidentiality value, consistent with ERP payloads such as HR records, financial data, and customer information. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in Masteriyo LMS WordPress plugin versions up to and including 2.3.0 allows authenticated subscriber-level users to inject malicious scripts that execute in the browsers of higher-privileged users such as administrators. The scope change (S:C in CVSS) indicates that a low-privilege attacker can impact users outside their own session, making this a privilege escalation vector in practice - a subscriber could steal admin session cookies or trigger unauthorized actions on behalf of administrators. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
WP EasyPay WordPress plugin versions 4.5.0 and earlier permit any subscriber-level authenticated user to delete arbitrary site content due to a missing authorization check (CWE-862). The plugin fails to enforce capability verification before processing deletion requests, meaning any user holding the lowest standard WordPress role can permanently destroy posts, pages, or other content objects outside their normal permissions. No public exploit has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this straightforward to abuse on any site where user registration is open.
Unauthenticated broken access control in the Knit Pay WordPress payment plugin (versions <= 9.6.0.0) allows remote, unauthenticated attackers to perform unauthorized actions resulting in limited integrity and availability impact against affected WordPress installations. The CVSS vector (PR:N, AV:N, AC:L, UI:N) confirms no authentication or user interaction is required, lowering the exploitation barrier significantly. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, unauthenticated attack surface warrants prompt remediation on any publicly accessible WordPress deployment running this plugin.
Broken access control in the Autopay dla WooCommerce WordPress plugin (versions <= 2.2.27) permits unauthenticated remote attackers to invoke restricted plugin functionality without authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction against any default-configured WordPress site running the affected plugin. The resulting impact spans limited integrity and availability degradation - consistent with unauthorized manipulation of payment or order-related plugin endpoints - with no public exploit identified at time of analysis and no CISA KEV listing.
Stored Cross-Site Scripting in WishList Member X WordPress plugin (versions 3.32.0 and below) allows authenticated subscribers to inject persistent malicious scripts into content rendered in other users' browsers, including administrators. The CVSS Scope Changed (S:C) designation confirms the attack crosses the trust boundary from the subscriber's session into victims' browsing contexts. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low privilege requirement (subscriber-level account) widens the realistic attacker pool on membership-gated sites.
Stored Cross-Site Scripting in FunnelKit Funnel Builder PRO (WordPress plugin by WiseTR Inc.) versions 3.15.0.4 and earlier allows low-privileged authenticated users - likely customer-tier accounts - to inject malicious JavaScript payloads that execute in other users' browsers upon viewing affected content. The scope-changed CVSS vector (S:C) confirms the injected script breaks out of the vulnerable component's security boundary to affect other browser sessions, enabling session hijacking, credential theft, or unauthorized admin actions. No public exploit code and no CISA KEV listing have been identified at time of analysis, but Patchstack reported this vulnerability and the attack complexity is low.
Contributor-level stored Cross-Site Scripting in the Hubbub Lite WordPress plugin (versions <= 1.36.3) allows an authenticated attacker with Contributor role to inject persistent malicious JavaScript that executes in the browsers of higher-privileged users - including administrators - who subsequently view the affected content. The changed scope in the CVSS vector (S:C) confirms the payload escapes the contributor's own session context and can be used to hijack administrator sessions or perform unauthorized actions on their behalf. No public exploit code or active exploitation has been identified at time of analysis.
Sensitive data exposure in PeproDev Ultimate Invoice (WordPress plugin, versions ≤ 2.2.6) allows unauthenticated remote attackers to access confidential invoice data - including likely customer PII and financial records - without authentication, contingent on some user interaction (CVSS UI:R). The root cause (CWE-201) is the inclusion of sensitive information in plugin-generated output or endpoint responses that lack proper access control. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
SQL injection in the Tickera - Sell Tickets & Manage Events WordPress plugin (all versions through 3.6.0.1) enables authenticated attackers with staff-level access to append arbitrary SQL clauses via the unescaped `tc_order_status_filter` parameter, exposing the full contents of the WordPress database to read access. The flaw originates in the Better Attendees and Tickets addon, with three vulnerable call sites identified in source at lines 238, 252, and 260 of the addon index. No public exploit code and no CISA KEV listing are present at time of analysis, but the straightforward nature of the injection and the staff-level authentication bar make this a realistic internal threat.
SQL injection in the Registrations For The Events Calendar WordPress plugin (versions up to and including 3.2) enables authenticated Contributors with event-edit access to extract sensitive database content by embedding malicious SQL subqueries within JSON object keys sent to the rtec_records_edit AJAX handler. The root flaw is improper use of esc_sql() - which wraps mysqli_real_escape_string - to sanitize column identifiers in a dynamically constructed UPDATE statement; this escaping function only handles quote and backslash characters, leaving spaces, parentheses, equals signs, and hyphens unescaped, which are precisely the characters needed to break out of the SQL identifier context. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and accessible privilege tier (Contributor) make this a concrete extraction risk on multi-user WordPress sites.
SQL Injection in the AI Copilot - Content Generator WordPress plugin (versions up to and including 1.5.4) exposes WordPress database contents to authenticated attackers with as little as subscriber-level access. The vulnerability resides in the unsanitized `order[0][dir]` parameter passed to an AJAX handler that lacks both input escaping and prepared statements, allowing appended SQL queries to extract sensitive information. No public exploit code or CISA KEV listing is identified at time of analysis, but the nonce exposure mechanism - which emits the required `waic-nonce` in front-end HTML whenever a `[waic_form]` or `[aiwu-form]` shortcode is rendered - lowers the practical exploitation bar for contributor-level users who can publish shortcodes.
Stored Cross-Site Scripting in the Equalize Digital Accessibility Checker WordPress plugin (all versions through 1.46.0) permits authenticated contributors to inject persistent malicious scripts via the 'html' parameter of the plugin's REST API endpoint, which executes in the browser of any subsequent visitor to the affected post. The attack surface is the unguarded `/accessibility-checker/v1/post-scan-results/{id}` endpoint, protected only by the low-privilege `edit_post` WordPress capability, making exploitation trivial for any contributor-level account on multi-author sites. No public exploit has been identified and the plugin is absent from CISA KEV, but the low authentication bar and persistent payload nature elevate real-world risk beyond the medium CVSS score suggests for sites with multiple editors.
Stored Cross-Site Scripting in the Grid/List View for WooCommerce WordPress plugin (versions ≤ 3.0.9) enables authenticated contributors to inject persistent malicious scripts via the unsanitized 'position' shortcode attribute, executing against every visitor who loads an affected page. The plugin's all_page="1" shortcode attribute compounds severity by forcing the widget to render site-wide, meaning a single injected post can target all visitors rather than only those on shop or category pages. No public exploit or CISA KEV listing identified at time of analysis; a patch has been committed to the WordPress plugin repository.
Stored Cross-Site Scripting in the Brands for WooCommerce WordPress plugin (versions through 3.8.8) allows authenticated contributors to permanently embed arbitrary JavaScript into pages via the unsanitized 'style' shortcode attribute, executing in any visitor's browser upon page load. The scope change (S:C) in the CVSS vector confirms cross-boundary impact: the attacker operates at contributor privilege level but the payload compromises site visitors' browser sessions. A plugin trac changeset (revision 3608899) indicates an upstream fix has been committed. No public exploit or CISA KEV listing identified at time of analysis.
Stored cross-site scripting in the Lpagery (Bulk Page Generator) WordPress plugin, versions up to and including 2.5.7, allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript via crafted post titles. The vulnerability stems from the lpagery_add_filter_text_template_post() function echoing a raw post_title directly into an inline JavaScript single-quoted string literal on every admin page load, with no encoding applied. When an administrator accesses an admin page bearing the ?lpagery_template parameter pointing to the attacker's post, the injected payload executes in the admin's browser context, enabling session hijacking or unauthorized privileged actions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Webpushr Push Notifications WordPress plugin (versions ≤4.39.0) allows authenticated contributors to permanently inject arbitrary JavaScript into WordPress pages via the notification title and body parameters. The injected payload persists in post meta storage and executes in any victim's browser - including administrators - upon visiting an affected page, enabling session hijacking, credential theft, or privilege escalation to admin-level access. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored Cross-Site Scripting in the WP Shortcode by MyThemeShop WordPress plugin (versions up to and including 1.4.17) allows authenticated contributors to permanently embed malicious JavaScript into WordPress pages via the unsanitized 'title' parameter of the [tab] shortcode. The mts_tabs() function in wp-shortcode.php renders this attribute verbatim between HTML anchor tags, causing any visitor who loads an injected page to execute attacker-controlled script in their browser. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; however, the contributor-level access requirement meaningfully lowers the bar on multi-author WordPress deployments.
Stored Cross-Site Scripting in the Header Footer Script Adder WordPress plugin (all versions through 2.1) allows any authenticated user holding author-level access or above to persistently inject arbitrary JavaScript via the 'asm_code' Snippet Meta field. The injected payload executes automatically in the browsers of any user who visits an affected page, enabling session hijacking, credential theft, or malicious redirects across the site's visitor base. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Broken Access Control in the Style Kits WordPress plugin (versions <= 2.6.5) permits authenticated users holding Contributor-level roles to execute privileged actions without proper authorization checks, as classified under CWE-862 (Missing Authorization). Reported by Patchstack and tracked as EUVD-2026-48095, the flaw is remotely exploitable with low attack complexity and no user interaction, exposing partial confidentiality, integrity, and availability of affected WordPress installations. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in Sunshine Photo Cart WordPress plugin (versions <= 3.6.10.1) enables subscriber-level authenticated users to perform actions or access resources beyond their intended permissions. The flaw is classified under CWE-862 (Missing Authorization), meaning the plugin fails to enforce proper authorization checks on certain endpoints accessible to low-privileged accounts. With partial confidentiality, integrity, and availability impact confirmed by the CVSS C:L/I:L/A:L metrics, affected photography business sites with open subscriber registration face meaningful risk of data exposure or unauthorized functional access. No public exploit has been identified at time of analysis.
Authentication bypass in the Premium Packages - Sell Digital Products Securely WordPress plugin (wpdm-premium-packages) through version 7.0.4 allows remote unauthenticated attackers to obtain valid WordPress session cookies for any non-administrator user who owns an order. The root flaw is the `download()` function accepting an attacker-controlled `wpdmppdl` parameter decoded with only base64 and JSON - no HMAC, nonce, or cryptographic signature - and then issuing authentication cookies after a domain check that is entirely attacker-supplied on both sides, making it trivially bypassed. No public exploit has been identified at time of analysis and the vulnerability is not confirmed as actively exploited in CISA KEV.
Path traversal in the CDN for Joomla Pro extension for Joomla allows an attacker to check file paths outside the intended site directory via the versioning feature, exposing whether arbitrary files exist and their modification timestamps. The vulnerability has a local attack vector per its CVSS score of 6.2, indicating exploitation likely requires local access or specific configuration, and no active exploitation or public exploit code has been identified.
Arbitrary constructor injection in React Router's SSR hydration deserializer (deserializeErrors()) affects npm/react-router versions 6.4.0 through 7.17.x when used in Framework Mode or Data Mode with manual SSR/hydration. When application code permits attacker-supplied input to overwrite the __type or __subType fields embedded in server-side serialized error objects, the client-side hydration process can be manipulated into instantiating arbitrary constructors available on the global window object, triggering unintended outbound network requests from the victim's browser. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available in version 7.18.0.
Cross-site scripting in React Router's unstable RSC (React Server Components) error handling path allows network-based attackers to execute arbitrary JavaScript in a victim's browser via attacker-controlled redirect targets. Affected are React Router npm versions 7.11.0 through 7.17.x when the unstable RSC APIs are explicitly enabled; the vulnerability arises because the RSCErrorHandler component failed to validate the protocol of redirect URLs before assigning them to window.location.href or injecting them into a meta http-equiv='refresh' tag. This is a follow-up to GHSA-8646-j5j9-6r62, indicating the prior fix left a residual code path unvalidated. No public exploit code or CISA KEV listing is identified at time of analysis.
Cross-site scripting in the Keyboard Shortcuts extension for Joomla (versions 1.0.0-3.2.5) by Regular Labs allows injection of arbitrary JavaScript via the shortcut configuration interface, executing in the browser context of any user who subsequently triggers the affected shortcut. The Changed Scope (S:C) in the CVSS vector confirms script execution crosses into the victim's session context, enabling session hijacking, credential theft, or unauthorized site actions. No public exploit identified at time of analysis; EPSS at 0.21% (11th percentile) and SSVC exploitation status of 'none' both indicate low-probability opportunistic targeting.
HTML injection in JetBrains IntelliJ IDEA before version 2026.2 enables silent user activity tracking through maliciously crafted IDE notifications. A remote attacker who can influence notification content - such as through a malicious plugin, crafted project file, or server response reflected as a notification - can inject arbitrary HTML payloads that silently load remote resources, beaconing user activity without any visible indication to the developer. No public exploit has been identified at time of analysis, and the CVSS 4.3 Medium score reflects a limited confidentiality-only impact with no integrity or availability consequence.
Stored Cross-Site Scripting in the WPShopmart Tabs WordPress plugin (versions 2.5 and below) allows an authenticated Shop Manager to inject persistent malicious JavaScript into tab content fields, which then executes in the browsers of any user who visits the affected page - including administrators. The scope change (S:C in the CVSS vector) confirms the payload crosses trust boundaries from the attacker's session into victims' browser contexts. No public exploit code and no CISA KEV listing have been identified at time of analysis, limiting immediate urgency, though the high-privilege requirement provides meaningful friction against opportunistic exploitation.
Stored Cross-Site Scripting in the Machete WordPress plugin (versions <= 5.2) allows authenticated users with Author-level privileges to inject malicious scripts into content that executes in victims' browsers when viewed. The vulnerability is classified as CWE-79 and carries a CVSS 5.9 score reflecting the scope change (S:C) typical of stored XSS, where payload execution occurs in a separate security context from where it was injected. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the attack vector is network-accessible with low complexity once attacker-controlled credentials are obtained.
Stored Cross-Site Scripting in the Custom Links in Elementor Image Carousel WordPress plugin (versions <= 1.1.1) enables authenticated attackers holding at least Author-level privileges to inject arbitrary JavaScript into carousel image link fields. The injected payload executes in any visitor's browser when they load a page containing the affected Elementor widget, crossing a scope boundary into the victim's session. No public exploit is identified at time of analysis, and the plugin's niche footprint limits widespread impact despite the network-accessible attack vector.
Cross-site scripting in the HashThemes Demo Importer WordPress plugin (versions up to and including 1.4.2) allows a high-privileged attacker to inject malicious scripts into author-related fields that execute in other users' browsers when the affected content is viewed. The vulnerability carries a scope change (S:C), meaning a compromised author context can impact administrative sessions, potentially enabling session hijacking or unauthorized actions on behalf of a victim admin. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Cross-site scripting in the Photo Gallery by Supsystic WordPress plugin (versions ≤ 1.16.3) allows a high-privileged administrator to inject malicious scripts that execute in the browser context of other users visiting affected gallery pages. The CVSS scope-changed flag (S:C) indicates the injected payload escapes the administrative context and impacts the browsers of non-admin visitors or editors. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS signal was not provided in source data.
Cross-site scripting in WP-Polls WordPress plugin versions 2.77.3 and earlier allows authenticated administrators to inject persistent malicious JavaScript into poll configurations, which then executes in the browsers of site visitors who encounter the affected polls. The vulnerability requires administrator-level access to trigger, but the scope change (S:C in CVSS) means the impact crosses from the privileged admin context into the front-end visitor context, enabling session hijacking or content manipulation against unprivileged users. No public exploit code and no CISA KEV listing have been identified at time of analysis.
JetBrains GoLand before version 2026.2 writes sensitive configuration values to log files by default, exposing credentials and secrets to anyone with read access to IDE log output. The CWE-532 flaw affects Go developers whose project configurations contain API keys, VCS credentials, or cloud tokens - values the IDE silently captures in plaintext log entries during normal use. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept exists; the low CVSS score of 3.5 reflects the limited impact and the requirement for low privilege and user interaction.
Improper input validation in facil.io's WebSocket Frame Parser (versions up to 0.7.4) allows remote unauthenticated attackers to send crafted WebSocket frames that trigger a flaw in the `websocket_on_protocol_error` function, yielding limited confidentiality, integrity, and availability impact. A proof-of-concept exploit has been publicly published, lowering the technical barrier for exploitation. The project maintainer was notified via GitHub issue but has not responded, leaving the vulnerability unpatched at time of analysis.
Credential extraction in OpenStack Ironic Python Agent (IPA) allows a tenant with bootc deploy_interface access to steal operator-level OCI registry pull secrets by exploiting a Linux PID namespace escape. Affected deployments running IPA >=10.2.0 <10.2.3, >=11.0.0 <11.2.1, or >=11.3.0 <11.5.1 are at risk when the bootc deploy_interface is enabled and operator-side registry credentials are configured. The attack violates the tenant-to-operator trust boundary by reading host authentication material through /proc/1/root inside a privileged container, with no public exploit identified at time of analysis.
Stored/reflected cross-site scripting in Progress MOVEit Transfer (versions before 2025.1.5, and the 2026 branch from 2026.0.0 before 2026.0.3) allows an authenticated low-privilege user to inject script that executes in another user's browser session when the victim views the crafted content. Because MOVEit Transfer is an internet-facing managed file transfer platform, successful exploitation can hijack privileged sessions and manipulate transferred data. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Cross-site request forgery in the Cache Cleaner extension for Joomla allows an authenticated administrator with cache-management permission to be tricked into performing unauthorized URL purges due to inconsistent token validation. Affected versions 1.0.0 through 9.7.6 may experience limited confidentiality and integrity compromise. No public exploit or active exploitation has been identified, and the EPSS score is low (0.13%).
Cross-Site Request Forgery in WP Activity Log (WordPress plugin by Melapress, versions ≤ 5.6.4) enables unauthenticated remote attackers to perform unauthorized state-changing actions against the plugin by tricking an authenticated administrator into visiting a crafted page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) confirms network-reachable exploitation with no attacker privileges required, resulting in limited integrity and availability impact - notably, an attacker could forge requests to disable or clear activity logs, undermining the plugin's core security audit function. No public exploit or active exploitation has been identified at time of analysis.
GutenKit Blocks for WordPress exposes a site's stored Mailchimp API key and full audience configuration to any unauthenticated HTTP caller via two REST API endpoints registered without authorization checks in versions up to and including 2.4.12. Both /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests use permission_callback => '__return_true', stripping all access control and returning Mailchimp audience IDs, merge fields, interest categories, and subscriber counts alongside the raw API key. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but exploitation requires only a single unauthenticated HTTP GET request, making mass automated scanning trivially feasible on any site with the Mailchimp integration configured.
Broken access control in the Reviewer WordPress plugin (versions ≤ 3.14.2) allows subscriber-level authenticated users to perform actions beyond their intended authorization scope, resulting in limited integrity and availability impact on affected installations. Reported by Patchstack and tracked under EUVD-2026-48090, the flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Broken Access Control in the ListingPro WordPress plugin (versions up to and including 2.9.10) allows authenticated subscriber-level users to perform actions or access resources restricted to higher-privileged roles. The CVSS vector (PR:L/AV:N/AC:L) confirms network-reachable exploitation by any user holding a low-privilege WordPress account, with partial confidentiality and integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in the category of a real but moderately constrained risk.
Cross-Site Request Forgery in GiveWP WordPress donation plugin versions up to and including 4.16.3 enables unauthenticated remote attackers to forge requests on behalf of authenticated administrators, resulting in limited integrity and availability impact on the affected installation. The CVSS vector (PR:N/UI:R) confirms the attacker requires no server-side credentials but must social-engineer a logged-in victim into triggering the forged request. No active exploitation is confirmed - this CVE is absent from the CISA KEV catalog and no public exploit code has been identified at time of analysis.
Insecure Direct Object Reference in the Masteriyo LMS WordPress plugin (versions ≤ 2.3.1) allows authenticated subscriber-level users to bypass object-level authorization checks, enabling unauthorized manipulation of LMS objects such as courses, enrollments, or student records beyond their permitted scope. Reported by Patchstack and catalogued as EUVD-2026-48075, the flaw requires only the lowest registered WordPress user role to exploit. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the category of a credible but not actively-weaponized medium-severity risk.
Cross-Site Request Forgery in Simple Link Directory Pro WordPress plugin (≤15.0.8) enables a remote unauthenticated attacker to execute unauthorized state-changing actions on a victim's WordPress installation by tricking an authenticated administrator into clicking a crafted malicious link. The CVSS vector (PR:N/UI:R) confirms the attacker requires no credentials of their own, but must socially engineer an authenticated administrator to trigger the forged request. No public exploit code or active exploitation has been identified at time of analysis, and CVSS impact signals are limited to low integrity and availability degradation with no confidentiality loss.
Broken access control in the uListing WordPress plugin (versions <= 2.2.0) by Stylemix permits subscriber-level authenticated users to invoke plugin functionality reserved for higher-privileged roles. The root cause (CWE-862, Missing Authorization) means the plugin does not enforce role checks before executing sensitive operations, allowing low-privilege accounts to impact integrity and availability of listing data. No public exploit code or active exploitation has been identified at the time of analysis.
Broken access control in the eRoom WordPress plugin (versions ≤ 1.7.1) allows subscriber-level authenticated users to perform privileged actions beyond their intended scope, resulting in limited integrity and availability impact. Reported by Patchstack against CPE cpe:2.3:a:digitalme:eroom, the flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints accessible to the lowest default WordPress user role. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Path-based access control in @fastify/static is defeated by non-canonical URL paths, allowing unauthenticated attackers to retrieve files that the allowedPath callback was configured to deny. Affected are all versions through 10.1.1 of the plugin for the Fastify Node.js framework. Because the allowedPath callback receives the raw, un-normalized pathname - before dot segments and duplicate separators are resolved - an attacker can craft equivalent paths (e.g., using './' sequences or '//' separators) that bypass the callback's deny logic while the underlying file resolver still serves the intended file. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed.