Stack overflow denial-of-service in msgpack-java through 0.9.12 allows unauthenticated remote attackers to crash individual deserialization requests by sending crafted payloads containing deeply nested MessagePack arrays or maps. The root cause is unbounded recursion in `MessageUnpacker.unpackValue()` (lines 646-664), which processes nested structures without any depth limit, exhausting the JVM thread stack and throwing an unhandled `StackOverflowError`. No public exploit or active exploitation has been identified; impact is limited to per-request availability disruption rather than full service termination.
Missing authentication in WWBN AVideo's Live plugin allows unauthenticated remote attackers to inject arbitrary socket notification messages to any administrator whose live stream key is known. The endpoint `/plugin/Live/socketMessageLiveOwner.json.php` validates that the stream *owner* holds admin privileges but performs no caller authentication (`User::isLogged()` is never invoked) and enforces no CSRF token, meaning the caller-identity check is entirely absent. No patch was available at time of publication; VulnCheck reported the issue against commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier.
Missing authorization in WWBN AVideo's Bookmark plugin exposes chapter names from password-protected videos to unauthenticated network attackers. The `getBookmarks.json.php` PHP endpoint accepts a video ID parameter and returns bookmark/chapter metadata without verifying that the requester holds the video password or any session credential, bypassing the password-protection model entirely for this data class. Exploitation is trivial given network access and a valid video ID; no KEV listing or public POC exists at time of analysis.
Missing authorization in the PlayerSkins mediaSession.json.php endpoint of WWBN AVideo exposes protected video metadata to unauthenticated network attackers. By supplying a video ID parameter to this endpoint, any remote attacker can retrieve the title and owner email address of password-protected videos without providing credentials, defeating the access-control intent of password protection. No public exploit or KEV listing is identified at time of analysis, and the CVSS 4.0 score of 6.9 reflects a narrowly scoped confidentiality impact limited to metadata rather than video content.
Unauthenticated information disclosure in WWBN AVideo exposes internal menu configuration data via the plugin/TopMenu/menus.json.php endpoint, which lacks any authentication check. Remote unauthenticated attackers can send a plain GET request to retrieve all menu data, including names of admin-only and inactive menus that are intentionally hidden from the public navbar. No public exploit or active exploitation has been identified, but the endpoint requires zero preconditions against any network-accessible AVideo instance through the affected commit.
Unauthenticated information disclosure in WWBN AVideo through commit c3edcc274c exposes inactive admin menu items and embedded secret query parameters via the unprotected `plugin/TopMenu/menuItems.json.php` PHP endpoint. Any network-reachable attacker can POST a `menuId` parameter to retrieve admin-tool URLs that are hidden from the public navbar, including secret tokens or keys embedded directly in those URLs. While the direct impact is limited confidentiality exposure (CVSS 4.0 VC:L), the leaked secret query parameters represent a stepping stone that could enable follow-on attacks against otherwise-obscured admin functionality. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated information disclosure in WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 exposes owner user identifiers and personalized ad creative URLs for password-protected videos via the unguarded adsInfo API endpoint. Any network-accessible attacker can call the adsInfo endpoint with an arbitrary videos_id parameter and receive the video owner's internal user ID and ad-targeting data without credentials. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Missing authorization in WWBN AVideo's video_from_program API endpoint allows unauthenticated network attackers to enumerate private playlist contents - including names, owner information, and video titles for password-protected playlists - without any credentials. All AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1 are affected; the server-side API performs no ownership or session validation before returning playlist metadata. No active exploitation is listed in CISA KEV and no public exploit code has been identified, but the zero-complexity network vector makes this trivially exploitable against any reachable instance.
Missing authorization in WWBN AVideo's ImageGallery list.json.php endpoint allows unauthenticated attackers to enumerate password-protected gallery file listings and retrieve the exposed image files directly without credentials. All AVideo installations through commit c3edcc274c389816d434acadac07ee78eaf330c1 are affected when the ImageGallery plugin is active. No public exploit code or active exploitation has been identified at time of analysis, though the attack requires no technical sophistication and is trivially automatable.
Unauthenticated information disclosure in WWBN AVideo exposes private playlist data for any user when an attacker supplies a target's user identifier to the playlistsFromUser.json.php endpoint. The root flaw is improper cache keying that fails to scope responses to the requesting user's session, allowing Favorite and Watch Later playlists to leak across user contexts. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated information disclosure in WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 exposes password-protected video metadata to anonymous remote attackers via a missing authorization check on the videosAndroid.json.php endpoint. Any unauthenticated guest can retrieve sensitive owner data - including email addresses, last login timestamps, filenames, and hashIds - with a trivial GET request, bypassing the password-protection intent entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication, zero-complexity attack surface makes opportunistic mass harvesting straightforward.
Out-of-bounds read in Freeciv 3.1.0-3.2.5 allows a crash or limited heap memory exposure when a user loads a maliciously crafted savegame file with an invalid unit activity index. The flaw exists in `sg_load_player_unit()` in both savegame2.c and savegame3.c, where the activity index `ei` is used to index into `loading->activities.order[]` without first validating it falls within `[0, loading->activities.size)`. No public exploit has been identified and the vulnerability is not on the CISA KEV list; vendor-released patch Freeciv 3.2.6 is available.
Unbounded audio extraction in vLLM 0.10.2-0.27.x enables remote denial of service against NanoNemotronVL model deployments. The root cause is an asymmetric protection gap: `_extract_audio_from_videos` in `nano_nemotron_vl.py` calls `load_audio_pyav` without the size or duration guard parameters enforced on the direct audio upload path, bypassing the `VLLM_MAX_AUDIO_DECODE_DURATION_S` and `VLLM_MAX_AUDIO_DECODE_BYTES` environment variable limits entirely. An attacker submitting a maliciously compressed video via the multimodal inference API forces the server to allocate gigabytes of memory during audio decoding, crashing the service. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patch is available in vLLM 0.28.0.
Integer overflow in msgpack-java's MessageUnpacker.skipValue() allows unauthenticated remote attackers to inject attacker-controlled data into deserialized fields by supplying a MAP32 container with an element count at or above 0x40000000. When the parser multiplies this count by 2 to traverse key-value pairs, the 32-bit result wraps, causing the cursor to halt prematurely and subsequent field reads to draw from attacker-supplied bytes rather than legitimate data. No vendor-released patch has been identified in available references; the issue is tracked at GitHub issue #1014 and disclosed by VulnCheck.
Stored Cross-Site Scripting in the WP Highlight Box WordPress plugin (through version 1.0) allows authenticated users with the contributor role or higher to inject persistent malicious scripts via unescaped shortcode attributes. When a page containing the crafted shortcode is viewed by higher-privileged users such as editors or administrators, the injected script executes in their browser context, enabling session hijacking, privilege escalation, or unauthorized administrative actions. No vendor-released patch has been identified at time of analysis, leaving all known deployments exposed.
Stored cross-site scripting in the Custom Menu Wizard Widget WordPress plugin (≤3.3.1) allows authenticated users holding contributor-level access or higher to inject arbitrary JavaScript via unsanitized shortcode attributes. The payload persists in post content and executes in the browser of any visitor - including administrators - who subsequently views the compromised page, enabling session hijacking or unauthorized privilege escalation within the WordPress site. No public exploit code or CISA KEV listing is associated with this CVE, and EPSS is negligible at 0.15% (5th percentile).
Stored Cross-Site Scripting in the Masteriyo LMS WordPress plugin (versions before 3.4.1) allows authenticated users with the instructor role to inject persistent malicious scripts into course editor fields, targeting higher-privileged users such as site administrators. When an admin opens the affected course in the editor, the stored payload executes in their browser context, enabling session hijacking and full administrative account takeover. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and EPSS remains low at 0.15%, suggesting opportunistic exploitation is not yet prevalent.
SQL injection in the MPG - Multiple Page Generator WordPress plugin (all versions through 4.2.1) allows authenticated attackers holding only subscriber-level accounts to append arbitrary SQL into existing database queries via a crafted URL path, enabling full exfiltration of the WordPress database including password hashes, user PII, and stored credentials. The flaw originates in SpintaxController.php and Helper.php where URL-path parameters are interpolated into queries without adequate escaping or use of WordPress's prepare() API; the code path is only reachable when the [mpg_spintax] shortcode is rendered in site-wide components such as footers or template parts. No public exploit code has been identified at time of analysis, and an upstream fix has been committed to the WordPress plugin SVN repository (changeset 3687328) as reported by Wordfence.
Authenticated SQL injection in the Smart Marketing SMS and Newsletters Forms WordPress plugin (versions ≤5.1.24) allows subscriber-level users to append arbitrary SQL to existing database queries, extracting sensitive data from the WordPress database. The vulnerability resides in insufficient input escaping on a user-supplied parameter before it reaches an existing SQL query, requiring only a low-privilege account and the plugin's sync/mapping feature to be in its typical operational state. No public exploit or active exploitation has been identified; the fix is available via WordPress SVN changeset 3663923.
Unauthenticated attackers can overwrite the holiday/unavailability schedule in the Rox Appointment Booking WordPress plugin (all versions before 1.2.0) due to a complete absence of capability or authorization checks on the schedule-save endpoint. This gives any remote attacker the ability to either inject blackout dates to deny all future bookings (availability disruption) or clear existing closed dates to expose periods the site owner explicitly blocked. No public exploit has been identified and EPSS sits at 0.14% (3rd percentile), indicating minimal observed exploitation activity, though the attack vector requires zero authentication and no user interaction.
CSRF vulnerability in the BEAR WordPress plugin before 1.2.2 allows unauthenticated remote attackers to modify arbitrary taxonomy terms by tricking a logged-in privileged user into visiting a specially crafted page. The plugin fails to verify a CSRF nonce and omits capability checks before processing taxonomy update requests, meaning a single malicious page visit by an authenticated administrator is sufficient to trigger unauthorized data modification. No public exploit has been identified at time of analysis, and EPSS sits at 0.10% (1st percentile), indicating very low observed exploitation pressure.
Stored Cross-Site Scripting in the Amelia Booking WordPress plugin (≤2.4.9) enables authenticated Contributor-level users with Elementor access to inject persistent JavaScript into booking-related pages via the unsanitized `load_manually` parameter across multiple Elementor widget render() methods. The injected payload executes in every subsequent visitor's browser session, producing cross-user, scope-changed impact. No public exploit has been identified at time of analysis, but the partial-then-full patch history across two separate changesets indicates the vendor required multiple iterations to close all affected widgets.
Unauthenticated service disruption in Flowise before 3.1.4 allows any network attacker to forcibly abort active chatflow predictions belonging to other users. The /api/v1/text-to-speech/abort endpoint accepts caller-supplied chatflowId and chatId without verifying ownership, enabling targeted interruption of in-progress AI workflow sessions. No active exploitation (KEV) or public exploit code is confirmed at time of analysis; the attack is trivially low-complexity but requires a running target session and knowledge of valid identifiers.
ESMTP parameter injection in aiosmtplib before 5.1.3 allows unauthenticated network attackers to smuggle arbitrary SMTP extension parameters into MAIL FROM and RCPT TO command lines by supplying crafted email addresses containing angle brackets and spaces. Exploitation enables forging AUTH= sender identities on cooperating SMTP servers or injecting DSN parameters (NOTIFY, ORCPT) to redirect delivery status notifications to attacker-controlled addresses. No public standalone exploit or CISA KEV listing has been identified at time of analysis, though the attack technique is trivially constructable from the commit tests published alongside the patch.
Cross-workspace credential IDOR in Flowise versions up to and including 3.1.3 allows an authenticated low-privilege user in one workspace to invoke third-party provider API calls using credential secrets belonging to a different workspace. The POST /api/v1/node-load-method/:name endpoint is mounted without route-level permission checks and resolves credentials by raw database ID via getCredentialData() without verifying that the credential's workspaceId matches the caller's active workspace - a check that all other credential-read paths in Flowise correctly enforce. Statically confirmed affected load methods include Google Drive listFiles, Google Sheets listSpreadsheets, and AWS DynamoDB KV Storage listTables; the raw decrypted credential secret is not returned to the attacker, but provider-returned resource metadata is. Fixed in version 3.1.4; no public exploit identified at time of analysis.
Broken access control in Flowise before 3.1.4 exposes organization owners' bcrypt password hashes and temporary tokens to any authenticated organization member via the GET /api/v1/organizationuser endpoint. The endpoint authenticates callers but performs no authorization check, allowing a low-privilege member to query any user ID and retrieve the owner's full user record - including stored credential hashes - enabling offline password cracking and subsequent full administrative account takeover. No public exploit or CISA KEV listing has been identified at time of analysis; VulnCheck reported the issue with a fix confirmed in version 3.1.4.
Side-channel leakage in Microchip's AN1044, AN953, and SW300052 cryptographic reference implementations allows a physically proximate attacker with specialized measurement equipment to extract secret cryptographic keys through power, electromagnetic, or timing analysis. Affected through revision A (AN1044, AN953) and version 2.6 (SW300052), these application notes and associated library are commonly used by embedded developers implementing cryptography on Microchip microcontrollers, meaning extracted keys could compromise the security of devices and downstream systems they protect. No public exploit code is identified at time of analysis, but the attack methodology - Differential Power Analysis (DPA), Simple Power Analysis (SPA) - is well-documented in hardware security literature and reproducible by skilled researchers with commodity equipment.
Persistent credential retention in the Temporary Login Without Password WordPress plugin (before 1.9.9) allows a temporary user to generate a WordPress Application Password during their valid session window, which continues to authenticate via the REST API and XML-RPC indefinitely after the administrator revokes or expires the temporary account. Because the plugin's primary use case provisions Administrator-level access to temporary users, a trust-model breach occurs: the administrator believes access has been withdrawn, while the temporary user silently retains full admin-equivalent API access. No public exploit has been identified at time of analysis and EPSS is 0.14% (4th percentile), but the post-exploitation consequence - undetected persistent admin access - is disproportionate to the low score.
IURegistryFilter.sys, the kernel-mode registry filter driver bundled with IOBit Uninstaller 15.5.0.11, can be crashed by any local low-privileged user by sending a crafted IOCTL to the sub_11838 dispatch handler, which dereferences a null pointer in kernel context and produces a system-wide crash (BSOD). The attack surface is broader than a single product: the advisory explicitly states that the identical IURegistryFilter.sys driver ships across multiple other IObit product families, meaning all such products on an affected host are vectors. A published proof-of-concept exploit exists (CVSS 4.0 E:P), and no vendor patch is available - the vendor did not respond to coordinated disclosure.
Unauthenticated sensitive information exposure in the Royal Addons for Elementor WordPress plugin (all versions ≤1.7.1066) allows any remote attacker to enumerate arbitrary postmeta values from all published posts via a blind, character-by-character substring oracle. The critical enabler is that the AJAX nonce protecting the search endpoint is publicly emitted in page HTML via wp_localize_script whenever any Royal Elementor widget loads - no session, login, or prior action is required to obtain it. Postmeta data can include private field values, API keys, or other sensitive content stored by themes and other plugins, making the practical impact site-dependent but potentially significant beyond the CVSS 5.3 base score.
Unauthenticated option-overwrite in DT LMS <=1.1 allows any remote attacker to modify arbitrary plugin settings stored in the WordPress wp_options table by calling three unprotected AJAX handlers - dtlms_save_poc_settings, dtlms_save_skin_settings, and dtlms_save_options_settings - that are registered on wp_ajax_nopriv_* with no nonce validation, no capability check, and no input filtering before update_option() is invoked. Confirmed by Wordfence with direct source-code references; a patch commit (changeset 3585901) is present in the WordPress plugin repository but the exact released version number is not stated in available data. No public exploit code and no CISA KEV listing identified at time of analysis.
Server-side request forgery in OpenStatus's status-page proxy allows remote attackers to manipulate custom domain resolution, causing the application server to issue forged HTTP requests to unintended internal or external targets. The vulnerable code path in `resolve-custom-domain-rewrite.ts` used attacker-influenced hostname data during URL rewriting without validating that the resolved target corresponded to a legitimate page slug. The patch (commit 86f370c) introduces `applyPageSlugPrefix` to normalize custom domain prefixes to their corresponding page slugs before any internal URL composition occurs, closing the forgery path. No public exploit has been identified at time of analysis, and exploitation requires passive user interaction per the CVSS 4.0 vector.
Missing authorization in AVideo's like.json.php endpoint allows any authenticated user to submit like interactions on password-protected or group-restricted videos they are not permitted to watch. The like counter for access-controlled content is incremented without the server verifying the requesting user's view permission, constituting a CWE-862 integrity bypass affecting all AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1. No public exploit code has been identified at time of analysis, and real-world impact is bounded to engagement metric manipulation rather than content disclosure.
Private playlist schedule metadata in WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) is exposed via missing ownership validation in the Playlists_schedules/list.json.php and Live/calendar.json.php PHP endpoints. Both unauthenticated requesters and low-privilege users holding canStream rights can supply arbitrary playlist identifiers to retrieve private schedule names, descriptions, timestamps, and playlist identifiers with no ownership verification performed server-side. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; real-world impact is bounded by the read-only, metadata-only nature of the disclosure.
starlette-admin 0.16.1-0.17.1 exposes a column-level authorization bypass in its list API: when a developer explicitly configures searchable_fields as an empty list to prohibit field filtering entirely, the allowlist enforcement logic silently skips the check rather than denying all filter requests, allowing authenticated users to submit structured where predicates against any database column. This undermines a deliberate access-control decision by the application owner, potentially exposing sensitive column values that were intended to be hidden from the admin filter interface. No public exploit code has been identified and the vulnerability requires valid credentials (PR:L per CVSS 4.0 vector), limiting realistic exploitation to insiders or compromised accounts.
Missing authorization in WWBN AVideo's commentAddNew.json.php endpoint permits authenticated users to post comments on password-protected and group-restricted videos regardless of whether they can access the content. The flaw affects all releases through commit c3edcc274c389816d434acadac07ee78eaf330c1 of the self-hosted PHP video platform. An attacker holding any valid session can submit crafted POST requests to pollute comment threads on restricted videos, defeating both password and group-membership access controls without gaining actual view access to the content.
Missing authorization in WWBN AVideo's videoAddViewCount.json.php endpoint allows authenticated users to manipulate view counts and watch-time statistics on videos they are not permitted to access. Affected versions span all commits through c3edcc274c389816d434acadac07ee78eaf330c1 of the WWBN AVideo open-source PHP video platform. An attacker with any valid account can submit crafted requests with arbitrary video IDs to inflate engagement metrics on restricted or private content, undermining the integrity of access-controlled video libraries. No public exploit code or active exploitation has been identified at time of analysis.
Missing authorization in WWBN AVideo's playListAddVideo.json.php endpoint allows authenticated users to add password-protected videos to their own playlists without possessing the watch permissions those videos require. The flaw, identified through commit c3edcc274c389816d434acadac07ee78eaf330c1, stems from the server trusting submitted video and playlist IDs without verifying whether the requesting user is authorized to access the referenced video content. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
SureRank SEO WordPress plugin before version 1.10.1 inadvertently exposes registered user email addresses through structured data markup (e.g., JSON-LD schema) rendered on public-facing pages by default. Any unauthenticated visitor can retrieve the email address of any WordPress user who has published content simply by examining page source or structured data. No public exploit identified at time of analysis; the EPSS score of 0.15% (4th percentile) confirms very low observed exploitation probability.
Payment verification bypass in the Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 enables unauthenticated attackers to obtain confirmed paid bookings for appointments and events without submitting any payment. The plugin trusts the gateway name embedded in the public booking POST request rather than verifying actual payment receipt server-side, and will mark a booking as fully paid even when the named gateway has never been configured on the site. No public exploit has been identified at time of analysis and EPSS sits at 0.15% (4th percentile), but the attack requires no credentials, no special tools, and trivially bypasses the site's entire revenue collection mechanism.
Unauthenticated information disclosure in the WPBot WordPress chatbot plugin before 8.6.0 allows any remote attacker to bulk-harvest the name, email address, and phone number of every visitor stored in the plugin's chat session history. The vulnerable AJAX action responsible for listing chat sessions applies neither a nonce check nor a WordPress capability gate, leaving it fully accessible to unauthenticated HTTP requests. No public exploit or KEV listing has been identified at time of analysis, but exploitation requires only basic knowledge of the WordPress AJAX interface and the affected action name.
Price manipulation and payment-method bypass in the Rox Appointment Booking WordPress plugin (versions before 1.2.0) allows unauthenticated remote attackers to submit booking requests with attacker-controlled prices - including zero - and to select payment methods not sanctioned by the site operator, resulting in confirmed bookings with no or reduced financial obligation. The root cause is absent server-side validation: the plugin trusts client-supplied total and payment-method values rather than recalculating them from its own pricing configuration. No public exploit code has been identified at time of analysis, and EPSS sits at 0.14%, reflecting low observed exploitation interest. Vendor-released patch version 1.2.0 is available.
Missing authorization in WWBN AVideo's remindMe.json.php endpoint allows authenticated users to create scheduler reminders for private live schedules they are not permitted to view. The generated email job leaks the private schedule's title back to the attacker, constituting an information disclosure via IDOR (CWE-639). Affected through commit c3edcc274c389816d434acadac07ee78eaf330c1 with no specific patched version confirmed at time of analysis; no public exploit code or CISA KEV entry exists.
Unauthenticated API abuse in the WPBot WordPress plugin before 8.5.7 allows any remote attacker to invoke the plugin's AI provider relay endpoints without credentials or a nonce, causing the site's configured third-party API keys (e.g., OpenAI) to issue requests and accrue charges on the site owner's account. The root cause is a complete absence of WordPress capability checks and nonce verification on multiple `wp_ajax_nopriv`-eligible AJAX actions. No public exploit code or CISA KEV listing exists at time of analysis; vendor-released patch 8.5.7 is confirmed available.
Unauthenticated information disclosure in the Rox Appointment Booking WordPress plugin (versions prior to 1.2.3) exposes full customer PII - name, email address, phone number, booking details, and payment status - to any remote attacker without credentials. The vulnerability combines a missing authorization check on the booking confirmation endpoint with predictable sequential numeric booking identifiers, making trivial mass enumeration of all customer records possible via simple HTTP iteration. No active exploitation has been identified (CISA KEV absent, EPSS 0.14%), but the attack is fully automatable and imposes GDPR breach-notification obligations on affected site operators.
Reflected XSS in QloApps back-office (through version 1.7.0) allows an unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session by inducing an authenticated admin to submit a specially crafted POST request to back-office list controller endpoints. The root cause, confirmed by the GitHub patch diff, is the Smarty template `list_header.tpl` interpolating `$smarty.post` filter parameters directly into HTML input `value` attributes without the `|escape:'html':'UTF-8'` modifier - affecting at minimum five distinct interpolation points across date-range and text-filter inputs. Successful exploitation enables session-scoped impact including administrative credential harvesting and unauthorized back-office actions; no public exploit code or active exploitation has been identified at time of analysis.
Unrestricted object method dispatch in the Product XML Feed Manager for WooCommerce WordPress plugin (before 3.1.1) allows authenticated contributor-level users to delete arbitrary WooCommerce products without owning them. The plugin's product shortcode neither restricts which methods can be invoked on a product object nor verifies the requesting user's capability over the targeted product - a textbook CWE-862 missing authorization flaw. No public exploit code has been identified at time of analysis, and the EPSS score of 0.13% (3rd percentile) reflects very low current observed exploitation probability.
Sprout Invoices WordPress plugin before 20.8.16 allows any authenticated user - including low-privilege subscribers - to overwrite private notes on invoice records belonging to other users by exploiting an unguarded AJAX action. The plugin performs no capability or ownership check before processing the write request, making the integrity violation trivially reachable by any site account holder. No public exploit is identified and EPSS stands at 0.13% (3rd percentile), indicating low observed exploitation interest.
Cross-site request forgery in the BEAR WordPress plugin before 1.2.2 allows an unauthenticated remote attacker to overwrite the plugin's meta field configuration by tricking a logged-in administrator into visiting a crafted page. The plugin fails to verify a WordPress CSRF nonce before processing the configuration-save action, enabling forged requests to execute silently within an admin's authenticated session. Vendor-released fix is available in version 1.2.2; no active exploitation or public proof-of-concept code has been confirmed.