Path traversal in rclone's Docker volume plugin ('rclone serve docker', versions 1.56.0 through 1.75.0) lets an attacker who can submit a VolumeDriver.Create request to the plugin socket make the privileged rclone process create a directory and mount an attacker-specified remote filesystem at an arbitrary host path. The attacker must already be in a high-privileged, socket-scoped position (PR:H) - normally the Docker daemon itself or, in a multi-tenant orchestration environment, a workload allowed to request named volumes - and no user interaction is required. Impact is bounded to unauthorized directory creation and remote-filesystem mounting over host paths rather than arbitrary code execution, and no public exploit code or confirmed active exploitation was identified at time of analysis; a vendor patch is available in 1.75.1.
Stored cross-site scripting in the WP2Social Auto Publish WordPress plugin (published in the repository as facebook-auto-publish) affects all versions up to and including 2.4.12, allowing an administrator-level user to persist arbitrary JavaScript into plugin admin settings so that it executes in the browser of anyone who later views the injected page. The flaw carries a CVSS v3.1 base score of 4.4 (AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) because it is gated behind high privilege and a non-default deployment posture: it only matters on WordPress multisite installations or on single-site installs where the unfiltered_html capability has been explicitly removed, since a normal single-site administrator already holds unfiltered_html and could inject markup legitimately. No public exploit code and no confirmed active exploitation were identified at time of analysis; this is a genuine but low-priority issue given the required administrative access and the non-default preconditions.
Stored cross-site scripting in the OTP Login & Register Woocommerce plugin for WordPress (versions up to and including 2.7.3) allows authenticated administrators to inject arbitrary web scripts via the 'fb-config' setting. Exploitation is practically limited to multisite installations where site administrators lack the unfiltered_html capability, potentially allowing them to target the network super administrator. No public exploit code has been identified, and the overall real-world risk is assessed as low despite the moderate CVSS score.
Authorization bypass in the Datalogics Ecommerce Delivery plugin for WordPress (all versions up to and including 2.6.65) lets any authenticated subscriber-level user exercise store-owner functions that should require higher privileges: creating and cancelling real shipping orders through the external logistics provider using the store's stored API token, rewriting arbitrary WooCommerce order post meta on any order, overwriting the plugin's own stored API token, and firing shipping-notification emails to customers. The issue is rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so the impact is integrity-only and limited to business-logic abuse rather than code execution. It requires only a low-privilege WordPress account plus a site running WooCommerce with the plugin and a configured logistics API token; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV), though stores with open subscriber registration carry the greatest exposure.
Authenticated users holding only subscriber-level access can permanently delete arbitrary WordPress posts - pages, courses, quizzes, and WooCommerce products - on sites running the Tutor LMS plugin through version 4.0.8. The flaw is an authorization bypass: a lesson-deletion handler reaches wp_delete_post( $id, true ) without verifying the caller has capability over the target post, and the multi-stage exploit chain (create an authored attachment via the profile-photo upload flow, create a Tutor topic reparented to that attachment, then invoke the deletion handler) is required to satisfy the plugin's ownership checks. Wordfence reports it, vendor code changesets are referenced, and no public exploit code or confirmed active exploitation was identified at time of analysis; scored 4.3 by the reporter and assessed by our team as AC:H with moderate-to-low real-world risk, since authentication is mandatory and impact is limited to destructive integrity loss rather than code execution or data exfiltration.
Missing authorization in the Flex Import plugin for WordPress (all versions up to and including 3.0) allows any authenticated user with subscriber-level access or above to invoke the license_activate_fleximp and license_deactivate_fleximp AJAX handlers, which perform neither a current_user_can() capability check nor validation of the 'wpnonce' value the client-side script supplies. A low-privileged attacker can persist an arbitrary or fraudulent license key, flipping the plugin's validation, suspension, and bundle status options, or delete the site's legitimate key and set fleximp_validation_status to false, disrupting the plugin's premium functionality. The impact is confined to license-state manipulation with no data disclosure, privilege escalation, or code execution; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (4.3), and no public exploit identified at time of analysis.
Authenticated users with subscriber-level access or higher can alter Empik-specific WooCommerce product metadata on any store running the Empik for WooCommerce plugin up to and including version 1.5.1, because the plugin's CSV import and product/offer import handlers execute without verifying user capabilities. The missing authorization check (CWE-862) allows modification of the _empik_logistic_klass, _empik_product_state, _empik_product_state_all_variants, and export/offer flag fields on arbitrary products, producing an integrity-only impact scored at CVSS 4.3 with no confidentiality or availability effect and no code execution. No public exploit has been identified at the time of analysis; exposure is greatest on sites with open user registration, where any self-registered subscriber account is sufficient to reach the vulnerable endpoints.
Authenticated attackers holding only subscriber-level access on a WordPress site running the Search Atlas SEO - Otto AI SEO Automation plugin (slug metasync) can tamper with the plugin's whitelabel settings because the affected code fails to verify that the caller is authorized to change them. By overwriting the whitelabel settings password to an attacker-chosen value, a low-privilege user can unlock the whitelabel, general, and advanced configuration tabs that are otherwise gated behind that password, giving them control over settings they should never reach. The flaw affects all versions up to and including 2.6.23 and is rated CVSS 4.3 (integrity-only impact, no confidentiality or availability loss); no public exploit code and no confirmed active exploitation were identified at time of analysis, and upstream code changes referencing the vulnerable routines have been published in the plugin's Trac changeset 3676919.
Missing authorization in the Partial Shipment for WooCommerce plugin (versions up to and including 3.4) allows any authenticated WordPress user with Subscriber-level access to read order item details - product names, quantities and shipped counts - belonging to any customer, and to modify the shipment status and shipped quantities of arbitrary orders via the plugin's AJAX endpoints. The three affected handlers (wxp_order_shipment, wxp_order_item_shipment, wxp_order_set_shipped) perform no capability check, no nonce verification, and no validation that the caller owns the supplied order_id, and the related wxp_order_status action can additionally trigger order status transitions. This is a broken-access-control flaw, not an authentication bypass; no public exploit code has been identified at time of analysis, and there is no KEV or EPSS signal, but practical exposure is raised on stores that allow customer/subscriber self-registration during WooCommerce checkout.
Missing authorization checks in the PDF Builder for WooCommerce WordPress plugin (all versions up to and including 2.0.11) allow any authenticated user holding Subscriber-level access or above to read invoice numbers, formatted invoice numbers, and creation timestamps for arbitrary WooCommerce orders by supplying attacker-chosen OrderNumber and InvoiceId values together with a garbage nonce. The prerequisite authentication is trivially met on stores that allow open customer registration, but the disclosure is confined to invoice metadata rather than full order or customer records, so impact is limited to low confidentiality (CVSS 4.3). No public exploit code has been identified at time of analysis, and an upstream fix is available via plugin repository changeset 3626297.
Missing authorization and nonce checks in the Metasync plugin (distributed as Search Atlas SEO - Otto AI SEO Automation for WordPress) up to and including version 2.6.23 allow any authenticated user with Subscriber-level access or higher to overwrite the site-wide 'metasync_options_instant_indexing' option. Because save_instant_indexing_settings() is hooked to admin_init and only tests for the presence of $_POST['submit'], an attacker with a low-privilege login can silently change which post types are auto-submitted to Google's Instant Indexing service; no public exploit code has been identified at time of analysis, no CISA KEV entry applies, and the impact is integrity-only (CVSS 4.3, I:L) with no data disclosure or denial of service.
Authenticated attackers with Subscriber-level or higher access on WordPress sites running the VW Writer Blog theme (versions up to and including 1.3.8) can reset all theme customizer settings to their defaults because the 'vw_writer_blog_reset_all_settings' function lacks a capability check. This integrity-only issue has low impact-no data disclosure, code execution, or site downtime-and requires a valid low-privilege account; sites with registration disabled are less exposed. No public exploit or active exploitation is identified at time of analysis.
Missing authorization in the SEO Booster plugin for WordPress through version 7.4.7 allows any authenticated user with Subscriber-level access or above to overwrite the plugin's Google Search Console integration options - seobooster_access_token, seobooster_google_email and seobooster_gsc_sites - and to clear the seobooster_needs_reauth flag by simply requesting a crafted /wp-admin/ URL. Because the vulnerable handle_oauth_callback() routine is registered on the standard admin_init hook and only takes attacker-supplied $_GET parameters, the flaw requires nothing more than a low-privileged account (CVSS 3.1 PR:L, no user interaction, no admin rights, no non-default configuration), which is trivial for an attacker to obtain on any site with self-service registration enabled. Impact is bounded to integrity of those plugin settings at CVSS 4.3 with no confidentiality or availability effect, and although the advisory carries an 'Authentication Bypass' tag the underlying issue is classic broken access control; no public exploit code was identified at time of analysis.
Authorization bypass in the BlockSpare plugin for WordPress allows authenticated users with Subscriber-level access to create arbitrary posts on sites running versions up to and including 4.2.6. The issue is caused by a permission callback that combines capability checks with AND instead of OR, letting low-privileged accounts pass the authorization gate; impact is integrity-only with no data disclosure or service disruption. No public exploit identified at time of analysis, but sites with open user registration can significantly expand the attacker pool because attackers can self-register as Subscribers.
Keycloak's OpenID Connect token refresh path can issue fresh access tokens on behalf of an OIDC client that an administrator has already disabled, because the server restores requested audiences from stored client IDs without re-checking whether that audience client is still enabled. An attacker who already possesses a valid, unexpired refresh token for the affected client can therefore keep obtaining usable access tokens after the client is turned off, but only against resource servers that validate the JWT locally (offline signature/claim checks) rather than calling Keycloak for introspection or userinfo. Scoring is low at CVSS 4.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N), no public exploit code was identified at time of analysis, and exploitation requires both a live refresh token and a client that was disabled after that token was issued.