Kernel denial-of-service in Silicon Labs' silabser.sys Windows 8 driver for CP210x USB-to-UART bridge devices allows any local unprivileged user to trigger a kernel crash by supplying incorrect driver settings. The root cause is CWE-369 (Divide by Zero) inside a kernel-mode driver, meaning exploitation produces a Blue Screen of Death (BSOD) and full system reboot. No public exploit code or active exploitation has been identified at time of analysis.
Directory traversal in knowns through 0.33.0 exposes arbitrary host filesystem paths to unauthenticated remote attackers via the workspace browse endpoint's unsanitized `path` query parameter. Attackers can walk the directory tree to map project directories, configuration file locations, and other filesystem structures without any credentials or special privileges. No public exploit has been identified at time of analysis, and impact is bounded to directory enumeration - file content cannot be read through this vector alone.
Renovate's `minimumReleaseAge` supply-chain defense control is not enforced for digest-type dependency updates, allowing a newly published - potentially malicious - package digest to immediately trigger a pull request and CI pipeline execution before the configured stability waiting period elapses. All Renovate versions before 44.3.1 and Mend Renovate CE/EE images before 15.4.0 are affected when repositories combine the `minimumReleaseAge` setting with digest-pinned dependencies such as GitHub Actions commit SHAs, Docker images, Go modules, or NuGet packages. No public exploit has been identified at time of analysis, but the flaw directly undermines an intentionally configured supply-chain defense, making it high-priority for organizations that depend on this control.
Hard-coded API credentials embedded in DrEryk Gabinet's ticket reporting component allow any network-accessible attacker to authenticate directly to the ticket system API in versions before 11.5.0. Once the static credentials are known - through reverse engineering or public disclosure by CERT-PL - an attacker can perform privileged ticket operations including reading and modifying records beyond what the application's own permission model permits. No public exploit code or active exploitation has been identified at time of analysis; the fix is available in version 11.5.0.
Path traversal in JoomShaper's SP Property Joomla extension (all versions before 4.1.4) allows unauthenticated remote attackers to escape the intended gallery directory due to missing directory confinement checks in the gallery management controller tasks. The CVSS 4.0 vector (PR:N, UI:N, AV:N) confirms exploitation requires no privileges or user interaction, though impact is constrained to low-severity integrity and availability effects on both the vulnerable and subsequent systems with no confidentiality exposure. No public exploit or active exploitation has been identified at time of analysis.
Buffer overflow in Bosch Sensortec COINES SDK versions 2.0 through 2.11 allows a malicious or compromised sensor evaluation board, connected to a host machine via USB or BLE, to overflow the host application's heap or stack by streaming an excessive volume of sensor samples. The root cause is that `coines_read_stream_sensor_data()` unconditionally performs a `memcpy` of the full ring buffer content without verifying whether the caller-provided destination buffer can accommodate it, because the internal `comm_intf_process_stream_response()` silently discards the requested `number_of_samples` bound. No public exploit has been identified at time of analysis, but successful exploitation could yield arbitrary code execution on the host developer machine.
Arbitrary code execution on Dell ThinOS 10 (all versions prior to 2605_10.2616) is possible when an unauthenticated attacker gains physical access to a thin client endpoint and exploits the absence of cryptographic integrity verification during code download (CWE-494). The vulnerability allows substitution of a malicious payload during the device's update or provisioning process, resulting in full system compromise with high confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis; the physical access prerequisite (AV:P) substantially constrains the attacker population.
Code injection in AppFlowy 0.11.8 allows arbitrary code execution through insufficient URI and local path validation in the application's file-launch and URL-handling subsystems. The vulnerability exists in the Flutter-based desktop/mobile productivity app's afLaunchUri, _afLaunchLocalUri (url_launcher.dart), OpenFilex.open, and localPathRegex (common_patterns.dart) components, where inadequate sanitization of URI schemes or local file paths enables an attacker to trigger execution of arbitrary code. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CWE-94 classification confirms the root cause as a code injection pattern rather than a memory-safety issue.
Dell ThinOS 10 firmware allows a low-privileged attacker with physical device access to overwrite the Security Version Number (SVN) with an older value, enabling a downgrade rollback to earlier firmware versions that lack current security protections. All releases prior to 2605_10.2616 are affected. By reverting the device to a prior vulnerable firmware state, an attacker can bypass protection mechanisms enforced in newer firmware - including security controls, hardening measures, or patched vulnerabilities - achieving full confidentiality, integrity, and availability compromise of the thin client.
Absolute-path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to read sensitive files outside the intended directory scope, potentially exposing credentials, configuration data, or other platform secrets. The CVSS vector assigns C:H/I:H/A:H, though IBM's own description limits the stated impact to information disclosure - an inconsistency worth verifying with the vendor advisory. No public exploit code or active exploitation has been identified at time of analysis.
Absolute path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-level privileges to traverse the file system beyond intended boundaries and read sensitive information from the underlying host or container. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates straightforward network exploitation requiring only a valid low-privilege account with no user interaction. IBM has released a patch via their support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in the Youzify WordPress plugin (versions ≤ 1.3.7) allows any authenticated subscriber to download arbitrary files from the hosting server. The flaw stems from insufficient sanitization of user-supplied file path input (CWE-22), enabling directory traversal sequences to escape the intended download scope. An attacker with a low-privilege WordPress account can retrieve sensitive server files - including wp-config.php containing database credentials - with no public exploit identified at time of analysis.
Denial of service in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to disrupt service availability by exploiting a path traversal weakness (CWE-22). The affected component is the DataStage data-integration service running on IBM's Cloud Pak for Data platform. An authenticated user (PR:L) can supply crafted path input to reach files or resources outside intended directories, degrading or crashing the service; no public exploit has been identified at time of analysis, and the issue is not in CISA KEV.
Arbitrary file read in GeoVision GV-LPC2211 v1.13 allows authenticated remote users to exfiltrate any file accessible to the root-run web service by supplying unsanitized absolute path parameters to BKDownloadLink.cgi. The CGI handler fails entirely to restrict the filename input, making the vulnerability straightforward to exploit by any valid credential holder. No public exploit or active exploitation has been identified, and no patched firmware version is confirmed in available sources.
Arbitrary file read in IBM Langflow OSS 1.0.0 through 1.11.5 allows a remote authenticated attacker to access files outside their authorized scope due to improper access control (CWE-284). The CVSS vector confirms PR:L, meaning exploitation requires valid credentials but no elevated privileges, making this a post-authentication authorization flaw rather than an authentication bypass. No public exploit has been identified at time of analysis, and a vendor patch is available at IBM support node 7286657.
Improper authorization in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-privilege credentials to cause a high-impact denial of service, with scope change indicating the disruption extends beyond the DataStage component into the broader Cloud Pak for Data platform. The root cause (CWE-285) indicates the authorization layer fails to enforce adequate access controls on operations that can disrupt service continuity, meaning any authenticated user may invoke privileged destructive actions without detection. IBM has released a patch; no public exploit code has been identified at time of analysis.
Full-read Server-Side Request Forgery in Transmute's URL import endpoint (versions prior to 1.3.0) allows authenticated users - or guest users if that feature is enabled - to direct the Transmute server to fetch arbitrary internal or cloud-local HTTP resources, with the fetched content stored and fully retrievable via the files API. The HTTP downloader follows redirects without validating whether target addresses resolve to private or link-local network space (e.g., cloud instance metadata services), making this a full-read SSRF rather than a blind one and elevating the practical confidentiality impact significantly. Vendor-released patch is version 1.3.0; no public exploit identified at time of analysis.
Stack buffer overflow in GeoVision GV-LPC2211 firmware V1.13 allows any authenticated, low-privilege user to remotely crash the SSVR service by sending crafted fragmented SSVR protocol data. Both the GV-LPC2011 and GV-LPC2211 models share the affected codebase per CPE data. Impact is limited to availability loss - no code execution or data disclosure has been demonstrated, and no public exploit code has been identified at time of analysis.
Cross-user file disclosure in IBM Langflow OSS 1.0.0-1.11.5 allows any authenticated low-privileged user to read files uploaded by other users by supplying arbitrary storage path identifiers in flow component inputs. The File/Read File component, when invoked via the /api/v1/run/advanced/{flow_id} endpoint, accepts user or flow storage namespace identifiers without verifying the requester owns the referenced namespace - a classic IDOR (CWE-639). No public exploit code has been identified at time of analysis, and IBM has released a patch.
Filesystem exhaustion denial of service in IBM WebSphere Application Server 8.5 and 9.0 allows an unauthenticated adjacent-network attacker to crash the server by sending specially crafted HTTP requests to an administrative endpoint that lacks authentication (CWE-306). Repeated triggering fills the host filesystem, disrupting all applications deployed on the instance and preventing logging or recovery operations. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; IBM has released a patch.
Open WebUI's OAuth token exchange endpoint (present in versions 0.8.0 through 0.8.x) bypasses the `OAUTH_ALLOWED_DOMAINS` email domain allowlist that the normal OAuth login callback enforces, allowing a user whose domain was removed from the allowlist to continue obtaining valid sessions via the alternate endpoint. The flaw is rooted in code duplication: the token exchange endpoint re-implemented identity lookup but omitted the authorization policy checks present in the primary callback. No public exploit is identified at time of analysis; vendor-released patch is available in 0.9.0.
SQL injection in the JasperReports reporting engine of OpenNMS Meridian and Horizon allows any authenticated ROLE_USER to execute arbitrary SQL against the OpenNMS PostgreSQL database by supplying a crafted DATE_FORMAT parameter to two default-enabled asset-management reports via the REST API. The database exposure includes SNMP community strings, provisioning credentials, and notification credentials for every monitored device - high-value intelligence enabling lateral movement across the managed network. No public exploit is identified at time of analysis, but the upstream patch diff on GitHub PR #8832 publicly names the vulnerable parameters and report IDs, substantially lowering the bar for exploit development.
Keycloak's Device Authorization Grant flow (RFC 8628) fails to enforce brute-force account lockout during token redemption, allowing an attacker holding an active device authorization session for a locked account to complete the flow and obtain valid access and refresh tokens. Affected deployments include Red Hat Build of Keycloak and Red Hat Single Sign-On 7 across all versions flagged in the CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the flaw silently undermines a core security control intended to stop credential-stuffing and persistent account compromise.
Guest-authenticated users on GeoVision GV-LPC2211 and GV-LPC2011 firmware V1.13 can invoke the SSVR firmware-upgrade mode without holding the authorization required for that privileged function (CWE-862), immediately dropping live camera services before any firmware image is submitted or validated. The affected devices are IP-based license plate recognition cameras used in physical security, traffic monitoring, and municipal surveillance deployments. No public exploit code has been identified at time of analysis, but the network-accessible attack vector with only low-privilege credentials required makes the disruption trivially easy for any user holding a Guest account.
Broken access control in the Salon Booking System WordPress plugin (≤10.31.5) allows unauthenticated remote attackers to reach plugin functionality that should require authorization, resulting in low-level integrity modification and availability disruption against affected WordPress installations. The root cause is CWE-862 (Missing Authorization) - the plugin fails to verify user capabilities before executing privileged actions, a pattern typically seen in unprotected AJAX handlers or REST endpoints. No public exploit or CISA KEV listing exists at time of analysis, but the zero-complexity unauthenticated attack vector makes automated scanning trivial.
Plaintext credential disclosure in GeoVision GV-LPC2211 V1.13 allows an authenticated Guest-level user to retrieve the full persistent device configuration - including administrative and standard user passwords in cleartext - via the SSVR service endpoint. The root cause is a missing authorization check (CWE-862): the device fails to restrict configuration retrieval to privileged roles, allowing the Guest role to access sensitive data it should never reach. While direct CVSS impact is confidentiality-only, exposure of admin credentials enables full device takeover as a secondary step, elevating practical risk for physical-security deployments. No public exploit has been identified at time of analysis.
Denial of service in Apache ActiveMQ Artemis and Apache Artemis message brokers allows authenticated clients holding MANAGE permission to crash broker processing threads by submitting crafted management-via-messaging requests that trigger unsafe Java deserialization. The deserializer processes method parameters the broker never actually uses, permitting gadget-chain payloads that consume excessive CPU and pin the thread pool. Both the legacy ActiveMQ Artemis lineage (1.3.0-2.44.0) and the newer Apache Artemis project (2.50.0-2.56.0) are affected; no public exploit or active exploitation has been identified at time of analysis.
Denial of service in Apache ActiveMQ Artemis and Apache Artemis allows an authenticated client to exhaust shared broker thread resources by attaching a consumer with a crafted wildcard message selector that triggers excessive computational evaluation during message delivery. Affected versions span Apache ActiveMQ Artemis 1.0.0-2.44.0 and Apache Artemis 2.50.0-2.56.0, with a vendor-confirmed fix released in version 2.57.0 on September 9, 2026. No public exploit code or active exploitation has been identified at time of analysis.
mruby 4.0.0's Prism-based compiler front end (mrbgems/mruby-compiler) passes NULL pointers returned by zero-length allocations into memcpy() and memcmp(), so parsing a crafted Ruby source file such as an operator assignment whose write name is exactly "=" (for example eval('[.m M:+=')) causes undefined behavior and a possible interpreter crash. The impact is availability-only: an attacker who can get the target to compile or eval untrusted mruby source can interrupt the hosting process. No public exploit code or CISA KEV listing is known, EPSS is only 0.15% (5th percentile), and an upstream fix commit (c6866eed) exists, but the description's claim of a practical crash conflicts with the commit's own note that only sanitizer builds actually report the condition.
Pacemaker Configuration System (PCS) on Red Hat Enterprise Linux 8, 9, and 10 exposes an arbitrary file-read primitive to local members of the 'haclient' group via the `pcs host auth --token` command. The pcsd daemon reads the attacker-specified file path with root privileges, base64-encodes up to 256 bytes of content, and transmits it through cluster node communication channels the attacker controls - enabling exfiltration of short sensitive files such as API tokens, symmetric keys, or credential snippets that are otherwise inaccessible to the attacker. No public exploit has been identified at time of analysis, but the attack requires only local access and group membership, making it a realistic insider-privilege escalation threat in multi-tenant HA environments.
Memory exhaustion denial of service in HashiCorp Consul's native RPC listener allows a network-adjacent client holding a valid mTLS certificate - but no ACL token - to crash or severely degrade Consul servers by exhausting server memory before ACL authorization is evaluated. Both open-source Consul and Consul Enterprise are affected across multiple release tracks. Vendor-released patches are available in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4; no public exploit or CISA KEV listing has been identified at time of analysis.
Open WebUI versions 0.8.0 through 0.11.0 contain an authorization bypass in the OAuth token exchange endpoint that allows users to obtain valid sessions without triggering the role management logic enforced by the normal OAuth login callback. Users whose identity provider roles would cause Open WebUI to deny or demote them on standard login can instead present a provider access token directly to the `/token_exchange` endpoint and receive a session at their existing (unauthorized) role level. Fixed in v0.11.1; no public exploit identified at time of analysis.
Stored Cross-Site Scripting in the EventON WordPress plugin (versions ≤ 2.5.7) allows authenticated subscribers to inject malicious JavaScript that executes in the browsers of other users, including administrators. The vulnerability stems from insufficient input sanitization and output encoding in subscriber-accessible event fields, enabling privilege escalation via script execution in a privileged session. No public exploit code or active exploitation has been confirmed at time of analysis.
Broken authentication in IMPress for IDX Broker WordPress plugin (versions ≤ 3.3.0) allows unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), resulting in limited integrity and availability impact. The CVSS vector (PR:N, AV:N, AC:L) confirms exploitation requires no credentials and no user interaction against default plugin configurations. No active exploitation or public exploit code has been identified at time of analysis, though the unauthenticated nature and low complexity lower the barrier for opportunistic attacks against WordPress sites running the vulnerable plugin.
Unauthenticated broken access control in the BuddyForms WordPress plugin (ThemeKraft, versions ≤ 2.9.0) permits remote unauthenticated attackers to invoke restricted plugin functionality without valid credentials, yielding limited integrity and availability impact. The root cause is CWE-862 (Missing Authorization) - the plugin omits the required WordPress capability checks before executing certain operations, leaving those actions reachable by any network requestor. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis, but the zero-authentication barrier keeps real-world risk elevated relative to the Medium CVSS score alone.
Stored Cross-Site Scripting in the WP Docs WordPress plugin (versions ≤2.3.1) allows authenticated subscribers to inject malicious scripts that execute in the browsers of other users, including administrators. The CVSS vector (PR:L/UI:R/S:C) confirms this is a subscriber-initiated, stored XSS with scope change, meaning a low-privilege account can affect higher-privilege sessions. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the Robokassa Payment Gateway for WooCommerce plugin (versions ≤1.8.9) allows unauthenticated remote attackers to invoke restricted plugin actions, resulting in limited integrity and availability impact on affected WordPress e-commerce stores. The root cause is CWE-862 (Missing Authorization): the plugin fails to perform capability checks before executing sensitive operations, as reported by Patchstack (EUVD-2026-75513). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated content injection in the Simple Cloudflare Turnstile WordPress plugin (versions <= 1.42.1) allows remote attackers without any credentials to inject arbitrary content into affected WordPress sites. Reported by Patchstack and classified under CWE-94 (Code Injection), the flaw exposes sites to partial confidentiality and integrity compromise (CVSS C:L/I:L) via a network-accessible attack requiring no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in the import_contacts function of the Groundhogg WordPress CRM plugin (versions ≤ 4.7.1) allows authenticated low-privilege users to read arbitrary files from the web server by supplying directory traversal sequences in a file path parameter. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms the flaw is network-exploitable with no complexity or interaction requirements beyond holding a basic WordPress account. Because WordPress plugins execute in the web server process context, the most critical exposure is likely reading wp-config.php, which contains database credentials and secret keys, enabling secondary attacks well beyond the medium 6.5 base score.
Stored XSS in Redux Framework (WordPress plugin) through version 4.5.13.1 allows authenticated Subscriber-level users to inject arbitrary JavaScript into their user profile Slider field, which then executes in an Administrator's browser when the admin views that profile. Three compounding weaknesses enable this: the `user_meta_save()` function skips sanitization of scalar (non-array) values, the `Redux_Slider::render()` method writes slider values into unquoted HTML attributes without escaping, and PHP loose-type comparison in `clean_default()` permits crafted strings like `1 tabindex=0 autofocus onfocus=alert(1) x=` to pass numeric validation. Vendor-released patch 4.5.14 was published September 07, 2026; no public exploit code or active exploitation (CISA KEV) is confirmed at time of analysis.
Stored cross-site scripting in the Aruba HiSpeed Cache WordPress plugin (all versions ≤ 3.0.14) allows authenticated Contributor-level users to inject persistent JavaScript via post content that executes in any visitor's browser when they access the affected page. The scope change in the CVSS vector (S:C) correctly reflects that execution occurs in victims' browser contexts - enabling session hijacking, credential theft, or further site compromise against administrators who visit the page. No public exploit code and no active exploitation have been identified at time of analysis.
Stored cross-site scripting in the Easy Google Fonts WordPress plugin (versions ≤ 2.0.4) allows authenticated attackers with Author-level access to inject arbitrary JavaScript that executes in victims' browsers. The flaw stems from the plugin registering the `control_selectors` post meta field with `show_in_rest: true` and no `sanitize_callback`, then writing that unsanitized value directly into `<style>` tags rendered on the frontend. No public exploit or KEV listing is present at time of analysis, but the low privilege bar (Author) and automatic execution on page load make this an elevated concern for multi-author WordPress deployments.
Stored cross-site scripting in the Ninja Forms - Scheduled Exports WordPress plugin (all versions through 3.0.3) allows any authenticated subscriber-level user to inject persistent malicious scripts via the REST API parameters interval, format, and emailTo, which then execute in the browsers of any user who visits the affected page. The root cause is a REST endpoint registered without a permission_callback that relies solely on nonce validation rather than WordPress capability checks, meaning the lowest default user role can reach it. No public exploit has been identified at time of analysis, but the subscriber-level entry barrier makes this meaningful on any site with open user registration.
Stored cross-site scripting in the Builderall for WordPress plugin (versions ≤3.0.2) allows authenticated contributors to inject persistent JavaScript via the Photo Module's unsanitized 'attributes' setting, executing against any subsequent visitor to an affected page. The attack requires only contributor-level WordPress credentials and results in scope-changed impact against victim browsers, enabling session hijacking or malicious redirects. No public exploit code or active exploitation has been identified; Wordfence reported the issue with precise source-code references across multiple affected PHP files.
Stored XSS in the Builderall for WordPress plugin (all versions through 3.0.2) enables authenticated contributors to inject persistent JavaScript via the 'bg_video_service_url' page-builder setting, with payloads executing in the browsers of any subsequent visitor - including administrators - who loads an affected page. The flaw is rooted in absent input sanitization and output escaping across the plugin's AJAX handling, model storage, and rendering pipeline, as confirmed by Wordfence and Trac source references. No public exploit code has been identified at time of analysis, and exploitation is constrained by the requirement for at least contributor-level WordPress credentials.
Concrete CMS versions prior to 9.5.3 allow deactivated or email-unvalidated users to bypass account-status enforcement by authenticating through the OAuth callback path. When a user whose account has been deactivated or whose email address has not been verified holds an existing OAuth provider binding, the CMS completes the OAuth handshake, records a login event, and issues a fully-authenticated session without verifying whether the account is permitted to log in. No public exploit has been identified at time of analysis; the vendor (Concrete CMS security team) assigned a CVSS 4.0 score of 6.3 reflecting the constrained attack preconditions.
Unauthenticated event metadata disclosure in Concrete CMS 9.5.2 and earlier allows any visitor to enumerate private calendar event details via a sequential IDOR on the frontend lightbox endpoint. The controller at /ccm/calendar/view_event/{bID}/{occurrence_id} loads occurrence records directly from attacker-supplied integer IDs without verifying that the occurrence belongs to the calendar block referenced by bID or that the caller holds read permission on the owning calendar. This enables systematic disclosure of event titles, dates, descriptions, page links, and configured attributes across all calendars on the installation, including those intended to be access-restricted. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Hash type confusion in Concrete CMS (below 9.5.3) allows cross-purpose token redemption: a long-lived registration hash (60-day expiry) can be submitted to the password-change endpoint to take over an account, or a password-reset hash can activate an unverified account. This is an amplifier vulnerability - exploitation requires the attacker to first acquire a valid hash through a separate channel such as email interception, log exposure, or SSRF against an internal mail relay, making it a force-multiplier for hash disclosure rather than a standalone attack path. No public exploit is identified and the vendor-assigned CVSS 4.0 score of 6.3 with AC:H and AT:P reflects the conditional nature of exploitation.
Path traversal (Zip Slip class) in rclone's archive ZIP backend permits arbitrary file writes outside the intended destination directory when processing a malicious ZIP archive. Versions 1.72.0 through 1.75.0 are affected: the readZip function in backend/archive/zip/zip.go trusts central directory filenames from untrusted ZIP sources without confining path.Clean output to the archive namespace, allowing entries like ../../etc/cron.d/evil to propagate as Object.Remote() values and be written by fs/sync and fs/operations to attacker-chosen filesystem locations. A separate bug used strings.HasPrefix without a path separator, causing root 'foo' to incorrectly match sibling entries named 'foobar'. Vendor-released patch is available in version 1.75.1; no public exploit identified at time of analysis.
Broken access control in the IMPress for IDX Broker WordPress plugin (versions <= 3.3.0) allows authenticated subscriber-level users to perform actions or access data that should be restricted to higher-privileged roles. The flaw stems from missing authorization checks (CWE-862), enabling low-privilege WordPress accounts - such as those automatically created for site visitors or registered users - to cross privilege boundaries within the plugin's functionality. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.