Monthly
Delegated 'users:update' permission in Arcane (getarcaneapp/arcane) 2.5.0 and earlier allows an authenticated holder of that permission to overwrite the global administrator's password via PUT /users/{adminId} and then authenticate as the admin, achieving complete administrator account takeover. The UpdateUser handler (backend/api/handlers/users.go:317-323) and the underlying user service (user_service.go:174) set the target user's PasswordHash from the request body and Save unconditionally, with no comparison of caller privilege against target privilege, even though users:update is deliberately intended to sit below the RequireGlobalAdmin-gated role assignment and role CRUD operations. Exploitation is remote, requires no user interaction, and needs no extra configuration beyond the precondition that an administrator has created a custom role (e.g. 'User Manager') containing users:update and assigned it to the attacker's account; deployments that never delegate that permission are not exposed, and no public exploit was identified at time of analysis (CVSS 8.8, PR:L).
Frontend Admin by DynamiApps (the acf-frontend-form-element WordPress plugin) through version 3.29.13 assigns privileges incorrectly, letting a submitted frontend form escalate the submitting user's role - most seriously to administrator - which on WordPress equates to full site compromise. The provided CVSS 3.1 vector scores this 9.8 as network-reachable with no privileges required (PR:N), while our independent assessment scores it 8.8 with PR:L, because the real-world precondition is that a Frontend Admin form capable of affecting roles (for example a user-registration or profile-edit form) is published and reachable by the attacker; sites that expose such a form to anonymous visitors are effectively unauthenticated targets, whereas sites gating it behind login require at least a low-privilege account first. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so there is no confirmation of active exploitation, though the low complexity and high payoff make opportunistic scanning plausible.
Privilege escalation in the Fluent CRM WordPress plugin version 3.2.5 and earlier allows an authenticated low-privileged user - such as a subscriber or self-registered account - to elevate their privileges and gain control over site resources, with a CVSS 3.1 score of 8.8 and high impact to confidentiality, integrity, and availability. Exploitation is not anonymous: it requires a valid low-privilege WordPress account plus an active vulnerable plugin installation, but no user interaction is needed (PR:L, UI:N) and no non-default configuration is named in the advisory. No public exploit identified at time of analysis; this is a genuine priority, not a high-CVSS-but-low-real-risk issue.
Privilege escalation in the Fluent CRM WordPress plugin (all versions through 3.2.5) allows a low-privileged account to elevate itself to higher privileges, including administrator-equivalent capabilities, by abusing an incorrectly assigned privilege (CWE-266). The vendor-supplied vector scores this 9.8 (AV:N/AC:L/PR:N/UI:N), but the independent vector analysis assigns PR:L, meaning the realistic starting point is an authenticated low-privileged WordPress account, and that prerequisite is the one condition that most changes the real-world risk; the exact vulnerable endpoint and required account level are not detailed in the available data. No public exploit code has been identified at time of analysis, and Fluent CRM is not listed in CISA KEV; the sole public reference is the Patchstack advisory. Sites running Fluent CRM 3.2.5 or earlier should treat this as high priority because WordPress administrator takeover typically yields full site compromise, data theft, and persistent backdooring.
Improved privilege escalation via insecure default DCOM permissions in Mitsubishi Electric GENESIS64 (10.97.3 and prior), along with ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI (all 10.97.3 and prior) and MC Works64 (all versions), lets a holder of the product's administrator account launch and operate DCOM objects locally or remotely that would normally require UAC elevation, enabling disclosure, tampering, destruction or deletion of internal data and potential denial of service. Exploitation requires authenticated access to that administrator account (CVSS PR:H), so risk is concentrated in insider, credential-theft, or compromised admin-session scenarios rather than unauthenticated mass exploitation; the network-reachable vector and high confidentiality, integrity and availability impact (assessed CVSS:3.1 base 9.x, vendor CVSS:4.0 9.4) still make this a serious privilege-management flaw. No public exploit code has been identified at time of analysis and the issue is not listed on CISA KEV.
Privilege escalation in the WordPress plugin Frontend Dashboard (M A Vinoth Kumar), affecting versions through 3.0.7, lets remote attackers obtain elevated account capabilities through incorrect privilege assignment (CWE-266). Patchstack scores the flaw 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the assessed vector is PR:L, meaning exploitation in practice most likely requires an existing low-privileged account (for example a subscriber) to elevate from, which typically presupposes that open user registration is enabled on the target site. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; exploitation is bounded to WordPress sites actually running this plugin within the affected version range.
Incorrect privilege assignment in Docker Hub's account-to-organization conversion feature lets an authenticated user bind a personal access token they control to a different Docker Hub account without the token secret ever being rotated or revoked. The unchanged PAT then continues to authenticate successfully - now as the recipient user - granting pull, push, and delete operations, within its existing scopes, across every repository that user can access, including organization repositories. Docker rates this 9.4 under CVSS 4.0 and our independent assessment characterizes it as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, but exploitation is not unauthenticated: the attacker must already hold a valid Docker Hub account and a PAT, and the damage is bounded by that token's scopes; no public exploit code has been identified at time of analysis.
Authenticated database users can escalate privileges and execute arbitrary operating-system commands on hosts running SIMATIC WinCC V7.5 (all versions), V8.0 before Update 11, and V8.1 before Update 7 because the application assigns excessive permissions to a database role (CWE-266). Exploitation requires a remote attacker to already hold valid database credentials and network reachability to the WinCC database service, but no user interaction is needed; no public exploit code has been identified at time of analysis. Siemens rates the issue 8.7, and while the impact is high, our independent assessment classifies it as a credible operational-technology priority rather than an emergency because the prerequisite of authenticated database access and network segmentation limits the realistic attack surface.
Unauthenticated privilege escalation in the Tonda Membership plugin for WordPress (published by Select Themes) affects all versions up to and including 1.0.1, allowing a remote attacker with no credentials and no user interaction to obtain elevated privileges on an affected site. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) rates confidentiality, integrity and availability impact as High, so successful abuse can effectively hand over site-level control. The only practical precondition is that the vulnerable plugin be installed and active on a standard WordPress installation; no public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied. Patchstack is credited as the reporting source and its advisory is the single reference provided.
Privilege escalation in the AIWU WordPress plugin (ai-copilot-content-generator) through version 1.5.9 lets a low-privileged Subscriber account elevate itself to a higher role, up to administrator, by abusing incorrect privilege assignment (CWE-266) in the plugin. Sites are fully exposed when the WordPress 'Anyone can register' option is enabled, since an attacker can self-provision the required Subscriber account; where registration is closed, the attacker must already hold or be granted such an account. Our independent assessment scores this as CVSS 9.8 with PR:L (Subscriber required), which conflicts with the supplied PR:N vector, so the unauthenticated framing should be verified against the Patchstack advisory; no public exploit identified at time of analysis, and no confirmed active exploitation (no CISA KEV listing).
Delegated 'users:update' permission in Arcane (getarcaneapp/arcane) 2.5.0 and earlier allows an authenticated holder of that permission to overwrite the global administrator's password via PUT /users/{adminId} and then authenticate as the admin, achieving complete administrator account takeover. The UpdateUser handler (backend/api/handlers/users.go:317-323) and the underlying user service (user_service.go:174) set the target user's PasswordHash from the request body and Save unconditionally, with no comparison of caller privilege against target privilege, even though users:update is deliberately intended to sit below the RequireGlobalAdmin-gated role assignment and role CRUD operations. Exploitation is remote, requires no user interaction, and needs no extra configuration beyond the precondition that an administrator has created a custom role (e.g. 'User Manager') containing users:update and assigned it to the attacker's account; deployments that never delegate that permission are not exposed, and no public exploit was identified at time of analysis (CVSS 8.8, PR:L).
Frontend Admin by DynamiApps (the acf-frontend-form-element WordPress plugin) through version 3.29.13 assigns privileges incorrectly, letting a submitted frontend form escalate the submitting user's role - most seriously to administrator - which on WordPress equates to full site compromise. The provided CVSS 3.1 vector scores this 9.8 as network-reachable with no privileges required (PR:N), while our independent assessment scores it 8.8 with PR:L, because the real-world precondition is that a Frontend Admin form capable of affecting roles (for example a user-registration or profile-edit form) is published and reachable by the attacker; sites that expose such a form to anonymous visitors are effectively unauthenticated targets, whereas sites gating it behind login require at least a low-privilege account first. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so there is no confirmation of active exploitation, though the low complexity and high payoff make opportunistic scanning plausible.
Privilege escalation in the Fluent CRM WordPress plugin version 3.2.5 and earlier allows an authenticated low-privileged user - such as a subscriber or self-registered account - to elevate their privileges and gain control over site resources, with a CVSS 3.1 score of 8.8 and high impact to confidentiality, integrity, and availability. Exploitation is not anonymous: it requires a valid low-privilege WordPress account plus an active vulnerable plugin installation, but no user interaction is needed (PR:L, UI:N) and no non-default configuration is named in the advisory. No public exploit identified at time of analysis; this is a genuine priority, not a high-CVSS-but-low-real-risk issue.
Privilege escalation in the Fluent CRM WordPress plugin (all versions through 3.2.5) allows a low-privileged account to elevate itself to higher privileges, including administrator-equivalent capabilities, by abusing an incorrectly assigned privilege (CWE-266). The vendor-supplied vector scores this 9.8 (AV:N/AC:L/PR:N/UI:N), but the independent vector analysis assigns PR:L, meaning the realistic starting point is an authenticated low-privileged WordPress account, and that prerequisite is the one condition that most changes the real-world risk; the exact vulnerable endpoint and required account level are not detailed in the available data. No public exploit code has been identified at time of analysis, and Fluent CRM is not listed in CISA KEV; the sole public reference is the Patchstack advisory. Sites running Fluent CRM 3.2.5 or earlier should treat this as high priority because WordPress administrator takeover typically yields full site compromise, data theft, and persistent backdooring.
Improved privilege escalation via insecure default DCOM permissions in Mitsubishi Electric GENESIS64 (10.97.3 and prior), along with ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI (all 10.97.3 and prior) and MC Works64 (all versions), lets a holder of the product's administrator account launch and operate DCOM objects locally or remotely that would normally require UAC elevation, enabling disclosure, tampering, destruction or deletion of internal data and potential denial of service. Exploitation requires authenticated access to that administrator account (CVSS PR:H), so risk is concentrated in insider, credential-theft, or compromised admin-session scenarios rather than unauthenticated mass exploitation; the network-reachable vector and high confidentiality, integrity and availability impact (assessed CVSS:3.1 base 9.x, vendor CVSS:4.0 9.4) still make this a serious privilege-management flaw. No public exploit code has been identified at time of analysis and the issue is not listed on CISA KEV.
Privilege escalation in the WordPress plugin Frontend Dashboard (M A Vinoth Kumar), affecting versions through 3.0.7, lets remote attackers obtain elevated account capabilities through incorrect privilege assignment (CWE-266). Patchstack scores the flaw 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the assessed vector is PR:L, meaning exploitation in practice most likely requires an existing low-privileged account (for example a subscriber) to elevate from, which typically presupposes that open user registration is enabled on the target site. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; exploitation is bounded to WordPress sites actually running this plugin within the affected version range.
Incorrect privilege assignment in Docker Hub's account-to-organization conversion feature lets an authenticated user bind a personal access token they control to a different Docker Hub account without the token secret ever being rotated or revoked. The unchanged PAT then continues to authenticate successfully - now as the recipient user - granting pull, push, and delete operations, within its existing scopes, across every repository that user can access, including organization repositories. Docker rates this 9.4 under CVSS 4.0 and our independent assessment characterizes it as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, but exploitation is not unauthenticated: the attacker must already hold a valid Docker Hub account and a PAT, and the damage is bounded by that token's scopes; no public exploit code has been identified at time of analysis.
Authenticated database users can escalate privileges and execute arbitrary operating-system commands on hosts running SIMATIC WinCC V7.5 (all versions), V8.0 before Update 11, and V8.1 before Update 7 because the application assigns excessive permissions to a database role (CWE-266). Exploitation requires a remote attacker to already hold valid database credentials and network reachability to the WinCC database service, but no user interaction is needed; no public exploit code has been identified at time of analysis. Siemens rates the issue 8.7, and while the impact is high, our independent assessment classifies it as a credible operational-technology priority rather than an emergency because the prerequisite of authenticated database access and network segmentation limits the realistic attack surface.
Unauthenticated privilege escalation in the Tonda Membership plugin for WordPress (published by Select Themes) affects all versions up to and including 1.0.1, allowing a remote attacker with no credentials and no user interaction to obtain elevated privileges on an affected site. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) rates confidentiality, integrity and availability impact as High, so successful abuse can effectively hand over site-level control. The only practical precondition is that the vulnerable plugin be installed and active on a standard WordPress installation; no public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied. Patchstack is credited as the reporting source and its advisory is the single reference provided.
Privilege escalation in the AIWU WordPress plugin (ai-copilot-content-generator) through version 1.5.9 lets a low-privileged Subscriber account elevate itself to a higher role, up to administrator, by abusing incorrect privilege assignment (CWE-266) in the plugin. Sites are fully exposed when the WordPress 'Anyone can register' option is enabled, since an attacker can self-provision the required Subscriber account; where registration is closed, the attacker must already hold or be granted such an account. Our independent assessment scores this as CVSS 9.8 with PR:L (Subscriber required), which conflicts with the supplied PR:N vector, so the unauthenticated framing should be verified against the Patchstack advisory; no public exploit identified at time of analysis, and no confirmed active exploitation (no CISA KEV listing).