Wordpress Plugin EUVD-2026-49211

| CVE-2026-59535 HIGH

Missing Authorization (CWE-862)

2026-07-27 Patchstack

GHSA-69qp-4jx5-xv9x

WordPress Authentication Bypass Wordpress Plugin Thrive Product Manager Thrive Themes Coupon

7.3

CVSS 3.1 · Vendor: Patchstack

Share

Severity by source

Vendor (Patchstack) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

2

Analysis Generated

Jul 27, 2026 - 14:57 vuln.today

CVE Published

Jul 27, 2026 - 13:59 cve.org

HIGH 7.3

DescriptionCVE.org

Unauthenticated Broken Access Control in Thrive Product Manager <= 10.9.2 versions.

AnalysisAI

Unauthenticated broken access control in Thrive Product Manager plugin for WordPress versions up to and including 10.9.2 permits remote attackers to access or modify product-related functionality without authentication. The missing authorization checks can lead to low-impact confidentiality, integrity, and availability compromises, such as viewing or tampering with product data. No active exploitation has been confirmed, and no public exploit code is known at this time.

More in Wordpress Plugin

View all

CVE-2023-6553 CRITICAL Act Now POC

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1

CVE-2024-5084 CRITICAL Act Now POC

The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil

CVE-2024-44000 CRITICAL Emergency POC

Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote

CVE-2020-36847 CRITICAL Act Now POC

The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner

CVE-2025-27007 CRITICAL Emergency POC

The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut

CVE-2016-1209 CRITICAL Emergency POC

The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via

CVE-2024-4443 CRITICAL Act Now POC

The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based

CVE-2024-1698 CRITICAL Act Now POC

SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a

CVE-2023-6875 CRITICAL Emergency POC

The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i

CVE-2024-1512 CRITICAL Emergency POC

The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base

CVE-2024-4295 CRITICAL Act Now POC

The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in

CVE-2024-50498 CRITICAL Emergency POC

Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u

Same weakness CWE-862 – Missing Authorization

View all

CVE-2023-52163 HIGH POC

CVE-2025-6205 CRITICAL POC

CVE-2025-20362 HIGH POC

CVE-2017-9232 CRITICAL POC

CVE-2023-6875 CRITICAL POC

CVE-2024-4898 CRITICAL POC

CVE-2023-32117 CRITICAL POC

CVE-2020-36719 CRITICAL POC

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2013-2465 CRITICAL POC

CVE-2011-3544 CRITICAL POC

CVE-2022-40684 CRITICAL POC

CVE-2025-61882 CRITICAL POC

CVE-2024-0012 CRITICAL POC

CVE-2023-46805 HIGH POC

Share

EUVD-2026-49211 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy