Monthly
Authorization bypass in the Cozy Blocks WordPress plugin (all versions through 2.2.17) exposes WooCommerce product metadata intentionally hidden from the public - including names, prices, stock status, and image URLs of draft, pending, private, and catalog-hidden products - to unauthenticated visitors. The root cause is that multiple block renderers unconditionally emit a sidebarNonce into public page HTML regardless of visitor authentication state, allowing anyone to harvest a valid nonce and satisfy the AJAX handler's sole authorization check. No public exploit code or CISA KEV listing has been identified at time of analysis, though exploitation mechanics are trivially simple given that the credential is embedded in publicly readable HTML.
Authorization policy bypass in Ash (Elixir framework) versions 3.29.0-3.32.1 permits any application actor to modify records protected by resource policies when using the atomic update path. The root cause is that `Ash.Actions.Update.UpdateMany` selected the atomic strategy under `authorize?: true` without invoking the authorization layer, causing the resulting SQL MERGE to update all primary-key-matched rows without applying policy filters. No public exploit code has been identified at time of analysis, but the published patch commit and GHSA advisory provide sufficient detail to reconstruct the bypass; the fix is vendor-confirmed in version 3.32.2.
Sulu CMS versions prior to 2.6.25 and 3.0.8 allow authenticated admin users to generate or revoke public preview links for any page, article, or snippet - including content in webspaces they are explicitly forbidden from viewing - because PreviewLinkManager::generate() and PreviewLinkManager::revoke() omit the VIEW permission check before executing. The resulting preview URLs are publicly accessible via an opaque token with no authentication required, meaning the attacker or any recipient of the link can read otherwise-restricted CMS content. No public exploit has been identified at time of analysis, but the attack path is straightforward and directly reproducible from the published commit diff and GitHub security advisory.
Missing authorization on Devtron's webhook API token endpoint allows any authenticated user - regardless of privilege level - to retrieve plaintext super-admin JWT tokens, yielding full platform control. The GET /orchestrator/api-token/webhook endpoint in versions through 2.2.0 performs no authorization check beyond validating that a session exists, meaning a low-privilege operator account is sufficient to extract credentials that grant unrestricted administrative access. No patch version has been confirmed in the available references, and no public exploit or CISA KEV listing has been identified at time of analysis.
Storage exhaustion via missing authorization preflight in Kirby CMS 5.0.0-5.5.1 allows authenticated panel users with restricted file permissions to indefinitely fill temporary upload storage. Kirby's REST API chunk upload handler in src/Api/Upload.php persisted chunk data to site/cache/.uploads before running permission checks, enabling users who lack files.create, files.replace, or users.update permissions to repeatedly submit Upload-Length headers and accumulate orphaned chunks retained for 24 hours. Repeated abuse can prevent legitimate users from uploading files or block site logic that writes to storage. No public exploit has been identified at time of analysis, and final content-path permission checks remained intact, preventing unauthorized file promotion to site content directories.
Missing Authorization in the WPExperts Post SMTP WordPress plugin (versions 4.0.0 through beta.1) permits low-privilege authenticated users to perform settings changes that should be restricted to administrators. The flaw, rooted in CWE-862, means certain plugin actions lack adequate capability checks before execution, allowing role-inappropriate operations against the plugin's SMTP configuration. Impact is confined to integrity and availability - an attacker can alter mail server settings or disrupt outbound email delivery - with no confidentiality impact identified. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in the Booking and Rental Manager WordPress plugin (versions <= 2.7.6) allows subscriber-level authenticated users to perform privileged write operations they should not be authorized to execute. The flaw, rooted in CWE-862 (Missing Authorization), means any registered site user - the lowest non-guest WordPress role - can manipulate booking or rental data with high integrity impact. No public exploit code has been identified at time of analysis, but the low privilege bar makes this attractive to any account-holding attacker on a WooCommerce-based rental or booking site.
Broken access control in the OwnerRez API WordPress plugin (versions <= 1.2.6) permits subscriber-level users to invoke API endpoints or perform actions reserved for higher-privileged roles such as editors or administrators. Reported by Patchstack and tracked under CWE-862 (Missing Authorization), the flaw enables an authenticated but low-privilege WordPress user to read, modify, or potentially delete vacation-rental booking data managed through the OwnerRez integration. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation complexity keeps real-world risk non-trivial for any multi-tenant WordPress deployment hosting this plugin.
Broken access control in Fluent Forms Pro Add On Pack (versions 6.2.12 and earlier) exposes privileged plugin functionality to unauthenticated remote attackers, allowing unauthorized integrity-impacting actions without any credentials or user interaction. The CVSS 3.1 score of 7.5 (High) reflects a network-accessible, low-complexity attack path confirmed by Patchstack, the reporting vendor. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the PR:N/AC:L combination makes this theoretically automatable at scale.
Missing authorization in Xibo CMS prior to 4.4.3 exposes super admin-restricted module settings and full module entity data to authenticated users holding the Module View privilege, via the Module::settingsForm endpoint. The disclosure is read-only - no configuration changes are possible - but the leak of privileged system configuration to lower-trust accounts represents a vertical privilege escalation in the confidentiality dimension. Vendor patch 4.4.3 is available; no public exploit or active exploitation has been identified.
Authorization bypass in the Cozy Blocks WordPress plugin (all versions through 2.2.17) exposes WooCommerce product metadata intentionally hidden from the public - including names, prices, stock status, and image URLs of draft, pending, private, and catalog-hidden products - to unauthenticated visitors. The root cause is that multiple block renderers unconditionally emit a sidebarNonce into public page HTML regardless of visitor authentication state, allowing anyone to harvest a valid nonce and satisfy the AJAX handler's sole authorization check. No public exploit code or CISA KEV listing has been identified at time of analysis, though exploitation mechanics are trivially simple given that the credential is embedded in publicly readable HTML.
Authorization policy bypass in Ash (Elixir framework) versions 3.29.0-3.32.1 permits any application actor to modify records protected by resource policies when using the atomic update path. The root cause is that `Ash.Actions.Update.UpdateMany` selected the atomic strategy under `authorize?: true` without invoking the authorization layer, causing the resulting SQL MERGE to update all primary-key-matched rows without applying policy filters. No public exploit code has been identified at time of analysis, but the published patch commit and GHSA advisory provide sufficient detail to reconstruct the bypass; the fix is vendor-confirmed in version 3.32.2.
Sulu CMS versions prior to 2.6.25 and 3.0.8 allow authenticated admin users to generate or revoke public preview links for any page, article, or snippet - including content in webspaces they are explicitly forbidden from viewing - because PreviewLinkManager::generate() and PreviewLinkManager::revoke() omit the VIEW permission check before executing. The resulting preview URLs are publicly accessible via an opaque token with no authentication required, meaning the attacker or any recipient of the link can read otherwise-restricted CMS content. No public exploit has been identified at time of analysis, but the attack path is straightforward and directly reproducible from the published commit diff and GitHub security advisory.
Missing authorization on Devtron's webhook API token endpoint allows any authenticated user - regardless of privilege level - to retrieve plaintext super-admin JWT tokens, yielding full platform control. The GET /orchestrator/api-token/webhook endpoint in versions through 2.2.0 performs no authorization check beyond validating that a session exists, meaning a low-privilege operator account is sufficient to extract credentials that grant unrestricted administrative access. No patch version has been confirmed in the available references, and no public exploit or CISA KEV listing has been identified at time of analysis.
Storage exhaustion via missing authorization preflight in Kirby CMS 5.0.0-5.5.1 allows authenticated panel users with restricted file permissions to indefinitely fill temporary upload storage. Kirby's REST API chunk upload handler in src/Api/Upload.php persisted chunk data to site/cache/.uploads before running permission checks, enabling users who lack files.create, files.replace, or users.update permissions to repeatedly submit Upload-Length headers and accumulate orphaned chunks retained for 24 hours. Repeated abuse can prevent legitimate users from uploading files or block site logic that writes to storage. No public exploit has been identified at time of analysis, and final content-path permission checks remained intact, preventing unauthorized file promotion to site content directories.
Missing Authorization in the WPExperts Post SMTP WordPress plugin (versions 4.0.0 through beta.1) permits low-privilege authenticated users to perform settings changes that should be restricted to administrators. The flaw, rooted in CWE-862, means certain plugin actions lack adequate capability checks before execution, allowing role-inappropriate operations against the plugin's SMTP configuration. Impact is confined to integrity and availability - an attacker can alter mail server settings or disrupt outbound email delivery - with no confidentiality impact identified. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in the Booking and Rental Manager WordPress plugin (versions <= 2.7.6) allows subscriber-level authenticated users to perform privileged write operations they should not be authorized to execute. The flaw, rooted in CWE-862 (Missing Authorization), means any registered site user - the lowest non-guest WordPress role - can manipulate booking or rental data with high integrity impact. No public exploit code has been identified at time of analysis, but the low privilege bar makes this attractive to any account-holding attacker on a WooCommerce-based rental or booking site.
Broken access control in the OwnerRez API WordPress plugin (versions <= 1.2.6) permits subscriber-level users to invoke API endpoints or perform actions reserved for higher-privileged roles such as editors or administrators. Reported by Patchstack and tracked under CWE-862 (Missing Authorization), the flaw enables an authenticated but low-privilege WordPress user to read, modify, or potentially delete vacation-rental booking data managed through the OwnerRez integration. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation complexity keeps real-world risk non-trivial for any multi-tenant WordPress deployment hosting this plugin.
Broken access control in Fluent Forms Pro Add On Pack (versions 6.2.12 and earlier) exposes privileged plugin functionality to unauthenticated remote attackers, allowing unauthorized integrity-impacting actions without any credentials or user interaction. The CVSS 3.1 score of 7.5 (High) reflects a network-accessible, low-complexity attack path confirmed by Patchstack, the reporting vendor. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the PR:N/AC:L combination makes this theoretically automatable at scale.
Missing authorization in Xibo CMS prior to 4.4.3 exposes super admin-restricted module settings and full module entity data to authenticated users holding the Module View privilege, via the Module::settingsForm endpoint. The disclosure is read-only - no configuration changes are possible - but the leak of privileged system configuration to lower-trust accounts represents a vertical privilege escalation in the confidentiality dimension. Vendor patch 4.4.3 is available; no public exploit or active exploitation has been identified.