Authentication Bypass
Monthly
Clever Mega Menu for Visual Composer (WordPress plugin, versions through 1.0.1) allows any authenticated user with as little as Subscriber-level access to overwrite navigation menu item content and settings through an unprotected AJAX endpoint. The plugin fails to perform either a nonce check or a capability check before processing menu item metadata updates, meaning WordPress role-based access control over menu management is completely bypassed. A publicly available exploit exists via WPScan, though EPSS places exploitation probability at 0.14% (4th percentile) with no CISA KEV listing, indicating limited observed exploitation at time of analysis.
Simple Restrict WordPress plugin before 1.2.9 exposes restricted post and page content through the WordPress REST API due to an authorization bypass. The plugin enforces its own permission system on the front-end but falls back to a generic WordPress capability check on REST API routes, allowing any contributor-level or higher WordPress account to read content that was explicitly restricted via the plugin's access controls. No public exploit identified at time of KEV review, though a proof-of-concept is publicly available via WPScan; the EPSS of 0.13% at the 3rd percentile confirms negligible observed exploitation activity.
Meta Box WordPress plugin before 5.13.1 allows any user holding a Contributor-level role (or equivalent low-privilege account) to permanently delete arbitrary media attachments owned by other users, including administrators, due to a missing authorization check on the deletion endpoint. The root cause is CWE-862: the plugin performs the deletion operation without verifying whether the requesting user has ownership or administrative rights over the target attachment. Publicly available exploit code exists (sourced from WPScan), and while EPSS sits at a low 0.17% (6th percentile), the low attack complexity and wide availability of Contributor accounts on multi-author WordPress sites make this a realistic insider or compromised-account threat.
Insecure Direct Object Reference in FluentBoards WordPress plugin before 1.95.3 allows any authenticated user holding member access to at least one board to silently exfiltrate task titles, descriptions, and file attachments from all other boards on the site by supplying arbitrary board item identifiers in an import request. The server performs no authorization check to verify that requested items belong to boards the invoking user is permitted to access, making any board member a potential insider threat against sensitive project data. A public proof-of-concept is available via WPScan; however, EPSS sits at 0.13% (3rd percentile) and no CISA KEV entry exists, indicating limited observed exploitation despite disclosure.
Client policy enforcement in Red Hat Build of Keycloak can be bypassed by an authenticated user holding client management permissions, allowing non-compliant OAuth clients to persist in a realm despite administrator-configured security hardening. The bypass exploits improper client state evaluation during update operations: an attacker creates a public client - which passes policy validation - and then updates it to a confidential client type, skipping the re-evaluation that would normally reject a non-compliant confidential client. No public exploit code has been identified and this CVE is not listed in CISA KEV; however, the low attack complexity and broad deployment of Keycloak in enterprise IAM infrastructure elevate its practical significance.
Time-based authorization policy bypass in Red Hat Build of Keycloak permits any low-privileged authenticated user to inject a fabricated timestamp into their authorization request, causing Keycloak's Authorization Services engine to evaluate the forged value instead of the actual server clock. This fully defeats time-based access controls - such as business-hours restrictions - across affected Red Hat products including Keycloak, Single Sign-On 7, Data Grid 8, and JBoss EAP Expansion Pack. No public exploit code has been identified and this CVE is not listed in CISA KEV, but the CVSS High integrity impact accurately reflects that time-gated authorization controls are rendered entirely ineffective against any valid account holder.
The full-scope-disabled client-policy executor in Red Hat Build of Keycloak silently skips enforcement when the fullScopeAllowed attribute is absent from a client registration or update request, allowing a delegated user to create OAuth/OIDC clients with unrestricted scope access. Affected platforms span Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and JBoss EAP Expansion Pack. An attacker holding delegated registration privileges (CVSS PR:L) can exploit this to issue tokens containing unauthorized role mappings, effectively escalating their effective permissions within any application trusting those tokens. No public exploit code or CISA KEV entry has been identified at time of analysis.
NO_PROXY bypass in axios Node.js HTTP client exposes local services to configured proxies when requests target 0.0.0.0. Affected versions 1.15.0-1.17.x and 0.31.0-0.32.x omit 0.0.0.0 from loopback address recognition in shouldBypassProxy.js, causing traffic intended to bypass proxy routing to instead be forwarded through HTTP_PROXY or HTTPS_PROXY. Plain HTTP requests are most exposed since the proxy receives the full request URL, headers, and body; HTTPS is partially mitigated by CONNECT tunneling. No public exploit or CISA KEV listing identified at time of analysis, but exploitation requires only attacker-controlled URL input in an otherwise common Node.js proxy deployment.
Audience-binding failure in @better-auth/oauth-provider (npm) allows authenticated OAuth clients to obtain JWT access tokens targeting resource servers never covered by the original authorization grant. Versions 1.4.8 through 1.7.0-beta.3 accept the RFC 8707 resource parameter exclusively at the token endpoint without recording it on the authorization code or the refresh-token row, meaning the authorized resource set is never enforced at redemption time. No public exploit has been identified at time of analysis, but the flaw directly undermines multi-audience OAuth deployments where resource servers enforce authorization based on the JWT aud claim.
Cross-tenant insecure direct object reference in OpenRemote versions up to and including 1.26.2 allows an authenticated attacker to bypass realm access controls in the AlarmResourceImpl.setAssetLinks endpoint, disclosing victim tenant asset names and persisting unauthorized cross-realm alarm-asset links. The flaw stems from a structurally incomplete authorization check that validates only the first realm returned by non-deterministic HashSet iteration rather than all realms submitted in the request, making the attack probabilistically repeatable until successful. No public exploit has been identified at time of analysis; the issue was fixed in version 1.27.0 per the vendor security advisory.
OAuth state validation bypass in better-auth before 1.6.2 enables network-based attackers to forge the OAuth callback state parameter and supply attacker-controlled authorization codes, creating authenticated sessions in the victim's browser that are cryptographically bound to the attacker's external identity. Account-linking flows are equally exposed, permitting the attacker's provider account to be persistently linked to an authenticated victim row in the application's user store. Exploitation is constrained to a specific non-default configuration (cookie-backed state storage with PKCE disabled), and no public exploit has been identified at time of analysis.
Bluetooth GATT notification and indication paths in Zephyr RTOS 2.6.0 through 4.4.x skip the application-configured encryption, authentication, and LESC security requirements for characteristic values when the application follows the documented idiom of passing the Characteristic Declaration attribute to the notify/indicate APIs. A remote Bluetooth peer within radio range can connect without pairing and trigger the server to emit protected characteristic values over an unsecured link by writing the Client Characteristic Configuration descriptor, achieving an access-control bypass and information disclosure. No public exploit is identified at time of analysis; exploitation requires adjacent network access and specific application configuration.
Unauthenticated sensitive information disclosure in the WooCommerce PayPal Payments WordPress plugin (all versions through 3.3.2) allows remote attackers to harvest full customer billing PII from recently placed orders. The vulnerability is a two-stage IDOR chain: the `enqueue_paypal_insights_script_on_order_received()` function exposes order keys without validating the caller's identity, and those keys can then be replayed against the WooCommerce Store API - which grants a 10-minute post-order grace period - to retrieve names, email addresses, phone numbers, and street addresses. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the network-reachable, zero-authentication attack path and PII sensitivity elevate practical risk above the CVSS 5.3 numeric score.
Sensitive information exposure in the Advanced Views WordPress plugin (wplakeorg, all versions ≤ 3.9.1) allows any authenticated subscriber-level user to harvest admin-authored editor content - including template markup, CSS, JavaScript, and PHP controller variables - via improperly authorized REST API routes. Wordfence identified the flaw across three CPT interactive field classes (base, Layout, and Post Selection). No public exploit code or CISA KEV listing exists at time of analysis, but the low authentication bar of subscriber-level access makes this trivially exploitable on any WordPress site with open user registration.
Authorization bypass in the Gutena Forms WordPress plugin (all versions through 1.9.0) enables unauthenticated remote attackers to permanently trash or toggle the read/unread status of arbitrary form submission entries across any form on the affected site. The root cause is a fatally weakened nonce check: the nonce action 'gutena_Forms' is broadcast to all anonymous site visitors via wp_localize_script() on any page embedding a Gutena Forms block, rendering the check_ajax_referer() call functionally useless as an authorization control. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE, though the low-complexity, zero-authentication attack vector means any anonymous internet user can exploit this without special tooling against any affected installation.
Authorization bypass in the RealHomes Memberships WordPress plugin (inspiry-memberships, all versions through 3.0.9) allows any authenticated subscriber to self-assign premium membership tiers without completing a PayPal transaction. The plugin's PayPal payment handler fails to verify user authorization before processing membership upgrades, enabling subscribers to generate falsified active payment receipts and unlock restricted property listing allowances. No public exploit has been identified at time of analysis, and the CVSS score of 4.3 (PR:L) reflects that exploitation is limited to authenticated users.
Vote-limit bypass in YOP Poll WordPress plugin before 7.0.6 allows unauthenticated remote attackers to cast unlimited votes on any public poll by spoofing IP addresses through client-controlled HTTP forwarding headers. The plugin enforces its per-IP vote restriction by reading attacker-supplied headers such as X-Forwarded-For rather than the validated TCP connection IP, making the restriction trivially circumventable. A publicly available proof-of-concept exists per WPScan reporting; EPSS sits at 0.14% (4th percentile), indicating low broad exploitation activity at time of analysis despite the low attack complexity.
Broken object-level authorization in the Event Tickets and Registration WordPress plugin before 5.29.0.1 allows any contributor-level (or higher) WordPress user to overwrite the seating layout, ticket inventory, and attendee seat assignments for events they do not own. The flaw stems from insufficient ownership verification on seating-related actions, meaning a low-privileged authenticated user can manipulate another author's event data without restriction. No public exploitation in the wild has been confirmed by CISA KEV, but a public proof-of-concept exists per WPScan reporting, and the EPSS score of 0.13% (3rd percentile) reflects minimal observed scanning or exploitation activity at time of analysis.
Unauthenticated order status manipulation is possible in the Event Tickets and Registration WordPress plugin across all versions before 5.29.0.1, due to a completely absent authorization check on an order-management REST endpoint. Any remote actor - with no credentials or privileges - can alter the status of existing orders, enabling fraud scenarios such as marking unpaid orders as completed. A publicly available exploit exists per WPScan; however, EPSS at 0.14% (4th percentile) indicates mass exploitation has not materialized at time of analysis, and the vulnerability is not listed in CISA KEV.
Authentication bypass in the Authora : Easy login with mobile number WordPress plugin (all versions before 1.7.7) exposes one-time login codes and valid verification tokens directly in the HTTP response of an unauthenticated endpoint, completely nullifying the mobile-based OTC authentication mechanism. Any unauthenticated attacker who knows a registered user's mobile number - including an administrator's - can obtain a valid session token without receiving an SMS, achieving full account takeover. A publicly available proof-of-concept exploit exists via WPScan; EPSS sits at 0.14% (4th percentile), indicating limited observed exploitation despite POC availability and no CISA KEV listing.
Unauthenticated forged conversion event injection in Pixel Tag Manager for WooCommerce (all versions before 2.2.1) allows any remote attacker to submit fabricated e-commerce conversion events to the site's server-side advertising APIs - such as Meta Conversions API or Google Ads - using the site's own stored credentials. The root cause is a missing authorization check on a WordPress AJAX action (CWE-284), meaning the endpoint processes requests from anyone without verifying identity or role. A publicly available exploit exists per WPScan; however, the EPSS score of 0.14% (4th percentile) indicates opportunistic exploitation has not yet been observed at scale.
Unrestricted mass assignment in the Booking for Appointments and Events Calendar WordPress plugin (before 2.4.4) permits any user holding the Amelia Manager role to overwrite arbitrary database columns on stored user records by injecting unsanitized fields into customer import requests. This can enable data tampering or privilege manipulation within the booking system's user table. No public exploitation is confirmed via CISA KEV, but a POC is publicly available through WPScan; EPSS remains at 0.13% (3rd percentile), consistent with limited real-world exploitation probability given the high-privilege prerequisite.
Improper authorization in the Brizy WordPress plugin before 2.8.18 allows any authenticated user holding the Contributor role or above to read the full content of arbitrary posts, bypassing WordPress's native visibility controls for private, pending, and draft posts. The flaw resides in a specific request handler that returns post content without verifying whether the requesting user is entitled to view it (CWE-639, IDOR). A publicly available proof-of-concept exploit has been published by WPScan; however, no confirmed active exploitation appears in CISA KEV, and the EPSS score of 0.13% (3rd percentile) reflects limited observed exploitation activity at time of analysis.
Missing authorization controls in the Buckaroo WooCommerce Payments Plugin before 4.9.0 allow any authenticated WordPress user - including low-privilege Subscribers - to trigger payment capture refunds against any captured order via an unprotected AJAX endpoint. The flaw causes direct financial integrity loss for merchants, as unauthorized refund processing reverses captured payments without any approval workflow. A publicly available exploit exists per WPScan, though EPSS remains very low at 0.13% (3rd percentile), indicating exploitation has not become widespread despite the accessible attack surface.
Unauthenticated OAuth state hijacking in Builderall for WordPress (versions before 3.0.2) enables remote attackers to overwrite the plugin's stored third-party integration access token by completing an OAuth authorization flow that is never bound to the initiating user session. Practical impact is constrained to sites already connected to a paid Builderall account - without that precondition, the overwrite is transient rather than durable. No confirmed active exploitation exists in CISA KEV, but WPScan has published a public proof-of-concept, making this accessible beyond sophisticated attackers despite an EPSS of 0.18% (7th percentile).
Broken object-level authorization in Fluent Support WordPress plugin before 2.3.1 allows restricted support agents to reassign the customer field on any ticket system-wide, bypassing per-ticket scope enforcement. Affected are WordPress installations running Fluent Support versions prior to 2.3.1 where restricted support agent accounts exist. An authenticated agent can manipulate ticket ownership across the entire helpdesk, exposing customer metadata and corrupting ticket assignment integrity. A publicly available proof-of-concept exists; EPSS probability is very low (0.13%, 3rd percentile) and no CISA KEV listing indicates no confirmed mass exploitation.
Unauthenticated order manipulation in the Direct Payments for WooCommerce WordPress plugin before 2.5.3 enables any remote attacker to forge payment completion states, overwrite payment-method labels, and attach fabricated proof-of-payment files to arbitrary customer orders. The flaw stems from multiple AJAX handlers that process order updates without verifying the requester owns or is otherwise authorized to modify the targeted order. A publicly available proof-of-concept exists and the SSVC framework rates this as automatable, meaningfully amplifying the fraud risk for affected merchants despite the EPSS score of 0.15% (4th percentile).
Credential exfiltration in AWS Strands Agents Tools before 0.8.2 exposes HTTP_REQUEST_TOKEN_CONFIG bearer tokens to attacker-controlled proxy infrastructure by exploiting the LLM's ability to set proxy parameters within the http_request tool's input schema. The root cause (CWE-863: Incorrect Authorization) is that proxy configuration was included as an LLM-controllable field, enabling prompt injection attacks to redirect credentialed HTTP requests through adversary infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis; however, any deployment combining token-authenticated HTTP requests with externally influenced agent inputs is at material risk.
IP spoofing via X-Forwarded-For header manipulation in Ghost CLI before 1.30.1 enables unauthenticated remote attackers to defeat rate-limiting controls on self-hosted Ghost instances. The vulnerability arises when Nginx is configured with the $proxy_add_x_forwarded_for directive, which appends attacker-supplied IP values to the header chain, causing Ghost's rate-limiter to treat each crafted request as originating from a distinct, unseen IP address. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the low attack complexity makes this straightforward to abuse once a vulnerable instance is identified.
pgAdmin 4 SERVER mode (versions 9.3 through 9.16) allows authenticated users to fully bypass administrator-configured per-tool role-based access controls by exploiting incomplete permission enforcement across backend routes and Socket.IO handlers. The Flask-Security `permissions_required` decorator was applied only to a single front-door route per tool, while all secondary routes and Socket.IO event handlers checked only authentication, not tool permissions - meaning a user who received a 403 on the initial gated endpoint could still drive the complete tool workflow through its other endpoints. Affected tools include Query Tool, Grant Wizard, Schema Diff, ERD, PSQL (interactive terminal), Debugger, Backup, Restore, Maintenance, and Import/Export. No dedicated public exploit has been identified, though the fix commits and GitHub issue are publicly visible; exploitation requires a valid authenticated pgAdmin session.
Authentication bypass in pgAdmin 4 SERVER mode exposes multiple routes to unauthenticated network access due to missing @pga_login_required decorators, a defect class previously identified in CVE-2026-12046 but incompletely remediated. Unauthenticated remote clients can enumerate table constraint metadata, delete table constraints (a state-mutating operation), read all CLI-settable preference values, and force-close active debugger or schema-diff sessions belonging to other authenticated users. The CVSS 4.0 vector (PR:N, AV:N, AC:L) confirms no authentication or special conditions are required in SERVER mode deployments; no public exploit or CISA KEV listing has been identified at time of analysis.
HCL iControl versions 4.3.0 and 4.4.0 expose a network-accessible integrity bypass to authenticated low-privileged attackers through a broken input validation mechanism. The implementation flaw in an architectural security tactic fails to enforce type conformance on received input, enabling an attacker to manipulate application logic and circumvent security controls. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV, though the vendor-assigned 'Authentication Bypass' tag elevates operational concern beyond what the CVSS score alone suggests.
Checkmk's reporting module fails to enforce the 'Edit foreign Reports' permission, allowing any authenticated user - regardless of their assigned role - to modify reports belonging to other users. Affected are all Checkmk deployments running versions prior to 2.5.0p10, 2.4.0p35, or 2.3.0p49, as well as the end-of-life 2.2.0 branch. No public exploit code or active exploitation has been identified at time of analysis, and real-world impact is bounded to report integrity rather than system compromise, but the permission bypass undermines multi-tenant trust boundaries in shared monitoring environments.
Insecure Direct Object Reference in Fluent Forms for WordPress (versions up to and including 6.2.8) exposes other users' payment receipt data to unauthenticated remote attackers via a brute-forceable 'transaction' parameter. Because the transaction hash is constructed from observable or guessable inputs - submission ID, form ID, and creation timestamp - the effective brute-force space is bounded to approximately 900 candidates per second per (submission, form) pair, making unauthenticated enumeration of victim receipts containing name, email, billing address, order items, payment method, and payment status practically feasible. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, a patch is available in version 6.2.9.
Unauthenticated campaign content tampering in the MailerPress - Newsletter, Email Marketing & AI Automation WordPress plugin (versions ≤ 1.5.0) allows any remote actor to overwrite active email campaign HTML by invoking the revision-restore REST endpoint without credentials. The campaign revision-restore route (POST /wp-json/mailpress/v1/campaign/<id>/restore-revision/<revision_id>) was registered in the WordPress REST API without a permissionCallback, bypassing the authorization layer entirely. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, though the attack is trivially executable against any reachable WordPress instance running the affected plugin.
Unauthorized contact data modification in MailerPress (WordPress plugin, versions up to and including 1.5.0) is achievable by any unauthenticated remote attacker via a missing capability check on the REST API endpoint `mailerpress/v1/contact`. The root cause (CWE-862) means WordPress's permission framework is entirely bypassed for this endpoint, exposing the contact database to arbitrary writes without credentials. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and zero authentication requirement make this trivially exploitable by automated scanners.
Remote unauthenticated access to an undocumented HTTP endpoint in ANDRITZ HIPASE-250 (formerly 250 SCALA) allows attackers to silently modify the system's audit logging level and destination without credentials. Rooted in CWE-306 (Missing Authentication for Critical Function), this flaw is particularly dangerous in industrial control system contexts where log integrity underpins incident detection and forensic capability - suppressing logs is a classic defense-evasion precursor enabling follow-on attacks to go unrecorded. No active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis, but the trivial attack complexity (AV:N/AC:L/PR:N/UI:N) means any attacker with network reachability can exploit this without tooling.
Wildcard domain validation in Keycloak's keycloak-services component can be bypassed by an attacker who controls their connection's reverse DNS, enabling unauthorized client registration or modification against a Keycloak realm. The flaw stems from the system accepting any hostname that merely ends with the configured domain suffix (e.g., 'attackerexample.com' satisfying a '*.example.com' restriction) rather than enforcing true subdomain membership. Exploitation requires high attack complexity due to the reverse DNS control prerequisite, and no public exploit or CISA KEV listing has been identified at the time of analysis.
Incorrect authorization in Keycloak's group policy evaluation allows a low-privileged authenticated user to bypass group membership checks and gain unauthorized access to administrative functions or protected resources. The root cause is a string prefix comparison used to verify child-group membership under an 'extend to child groups' policy: a user in a group whose name shares a leading prefix with a privileged group (e.g., '/admins-external' matching a policy scoped to '/admins') is incorrectly treated as a legitimate child-group member. The CVSS vector (PR:L, I:H) confirms this is an authenticated integrity-bypass with high impact. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Keycloak's OIDC token introspection endpoint incorrectly discloses the full set of JWT claims to confidential clients inspecting tokens that were not issued for them. Any confidential client configured to receive signed JWT introspection responses can submit a foreign token, receive an 'inactive' status confirmation, and simultaneously receive the complete signed JWT payload containing sensitive user attributes and claims - effectively bypassing the audience isolation that OIDC introspection is designed to enforce. No active exploitation has been confirmed (not listed in CISA KEV), and no public proof-of-concept code has been identified at time of analysis, but the low attack complexity and network accessibility via a standard API endpoint make this a meaningful confidentiality risk in multi-tenant or multi-client Keycloak deployments.
Broken access control in Keycloak's RoleContainerResource component allows delegated administrators with manage-realm permissions to remove child roles from built-in admin roles via name-based endpoints in the admin REST API that skip proper authorization checks. Affected distributions include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat JBoss EAP Expansion Pack, and Red Hat Data Grid 8. An attacker exploiting this flaw can degrade or disrupt administrative functions within a realm by stripping essential role assignments from built-in admin roles, effectively undermining the role-based access control structure of the affected deployment. No public exploit code and no CISA KEV listing are associated with this CVE at time of analysis.
Token revocation bypass in Keycloak's TokenManager component allows sessions and user data access to persist after administrative invalidation. The flaw (CWE-862: Missing Authorization) causes client-level 'not-before' revocation policies to be silently skipped when a realm-level revocation policy with an older, non-zero timestamp is already in place - causing the revocation to produce no effect. Authenticated token holders (PR:L) can continue refreshing sessions and querying user information APIs despite explicit administrative revocation. No public exploit identified at time of analysis; KEV status is not confirmed.
Missing authorization on attachment download endpoints in the Support Genix WordPress plugin (before 1.4.48) exposes private support ticket files to unauthenticated network access. Any caller who possesses a stored attachment's filename can retrieve it directly, bypassing ticket ownership and login checks entirely. A publicly available exploit exists per WPScan, though EPSS sits at 0.14% (4th percentile), indicating no widespread opportunistic exploitation at time of analysis; no CISA KEV listing.
Insecure Direct Object Reference (IDOR) in the wpForo Forum WordPress plugin before 3.1.2 allows any subscriber-level authenticated user to permanently delete the AI chat message history of arbitrary other users by submitting deletion requests without ownership verification. The plugin's AI chat message deletion endpoint does not validate that the targeted conversation belongs to the requesting user, enabling low-privilege account holders to cause irreversible data loss across the platform. A publicly available proof-of-concept exists per WPScan reporting; however, EPSS is extremely low at 0.13% (3rd percentile) and the vulnerability has not been added to the CISA KEV catalog, indicating limited observed exploitation.
Broken Object Level Authorization in the Academy LMS WordPress plugin through 3.8.2 exposes every user's quiz attempt records - including IP addresses, full names, registration dates, and quiz results - to any authenticated subscriber-level user who is enrolled in at least one course. The flaw stems from missing ownership checks on quiz attempt record retrieval endpoints (CWE-639), enabling horizontal privilege escalation across the entire site's student population. A publicly available proof-of-concept exists per WPScan; exploitation probability remains low (EPSS 0.13%, 3rd percentile) with no confirmed active exploitation in CISA KEV.
Broken object-level authorization (IDOR) in the BuddyPress WordPress plugin, all versions before 14.5.0, permits any authenticated user at the Subscriber level or above to read, modify, or delete private messages belonging to other users via the plugin's messaging endpoints. A publicly available proof-of-concept exists per WPScan reporting, though EPSS data places exploitation probability at just 0.13% (3rd percentile) and SSVC classification marks it as not automatable, indicating exploitation is currently opportunistic and targeted rather than widespread. No CISA KEV listing is present, but the low privilege bar combined with network accessibility makes this a meaningful privacy and integrity risk on any community-facing or multi-tenant WordPress deployment running BuddyPress.
Insecure Direct Object Reference (IDOR) in JS Help Desk WordPress plugin before 3.1.5 exposes support ticket data to any low-privileged authenticated user who supplies an arbitrary ticket ID. The plugin performs no ownership check when loading ticket contents, meaning a registered user can enumerate ticket IDs and read PII, message bodies, and reporter identity belonging to other users. A publicly available proof-of-concept exists per WPScan; no confirmed active exploitation (CISA KEV) has been identified, and EPSS remains very low at 0.13%.
Broken authorization in the JS Help Desk WordPress plugin (versions prior to 3.1.4) allows any authenticated user at Subscriber level or above to overwrite the content of any support-ticket reply site-wide, regardless of ownership. The plugin's reply-update endpoint fails to validate that the requesting user owns the targeted reply, enabling unauthorized content manipulation across all tickets. A publicly available proof-of-concept exploit exists; no active exploitation has been confirmed in CISA KEV at time of analysis.
Unauthenticated order document enumeration in the FluentCart WordPress plugin (all versions before 1.5.3) exposes customer PII - names, email addresses, and billing and shipping postal addresses - across every order in a store. CWE-639 (IDOR) is the root cause: order documents are keyed on sequential numeric identifiers with no authorization or ownership validation, so any unauthenticated visitor can iterate through all historical orders. A publicly available exploit exists per WPScan; no active exploitation is confirmed in CISA KEV, though the trivial enumeration method and public PoC substantially lower the barrier to mass data harvesting.
Insecure Direct Object Reference in the Paid Membership Subscriptions WordPress plugin (before 3.0.7) allows any authenticated subscriber-level user to enumerate and retrieve payment records belonging to other members. The AJAX handler responsible for payment data retrieval performs neither a WordPress capability check nor a nonce validation, meaning horizontal privilege escalation requires only a valid low-privilege account on the target site. A publicly available proof-of-concept exists per WPScan, though no CISA KEV listing confirms active widespread exploitation at time of analysis.
Unauthenticated data overwrite in the Events Made Easy WordPress plugin (all versions before 3.1.4) allows any remote, unauthenticated attacker to overwrite personal data stored in any person record by exploiting a missing authorization check on data-change endpoints. The plugin's nonce mechanism is public and shared, providing no per-record token or ownership binding, making it trivially bypassable under CWE-639. A publicly available exploit exists per WPScan research; no active exploitation has been confirmed in CISA KEV at time of analysis.
Unauthenticated mailing list subscription abuse in the Mailgun for WordPress plugin before 2.2.1 allows any remote attacker to enroll arbitrary email addresses into the site owner's Mailgun mailing lists by exploiting an unprotected AJAX endpoint. The plugin's stored API credentials are silently invoked on the attacker's behalf, effectively weaponizing the site owner's Mailgun account against third-party email addresses. A public exploit is available via WPScan, though the EPSS score of 0.14% (4th percentile) and absence from CISA KEV indicate limited observed exploitation to date.
GiveWP WordPress donation plugin before version 4.16.3 allows unauthenticated users to route donations through payment gateways the administrator has explicitly disabled, by supplying a gateway identifier via request input that the plugin fails to validate against the admin-configured allowlist. Rooted in CWE-862 (Missing Authorization), this bypasses financial controls that site operators may have disabled for compliance, fraud prevention, or contractual reasons - making the practical business risk higher than the CVSS Medium score suggests. A publicly available proof-of-concept exists via WPScan; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Authorization bypass in Google mcp-toolbox's bigquery-execute-sql tool (versions 0.16.1-1.4.0) allows authenticated low-privileged users to exfiltrate DDL schemas from explicitly restricted datasets and query federated external data via EXTERNAL_QUERY connections. The fail-open logic flaw stems from the tool treating an empty tableIDSet returned by the BigQuery dry-run API - which occurs for INFORMATION_SCHEMA and EXTERNAL_QUERY constructs - as a signal to skip allowedDatasets enforcement entirely. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the bypass mechanism is straightforward for any authenticated toolbox user.
SFTPGo versions prior to 2.7.4 expose a permission bypass allowing authenticated users holding the create_symlinks permission to circumvent per-directory access controls by creating symbolic links that bridge permitted and restricted directories. Authorization is evaluated against the symlink's parent directory rather than the dereferenced target, so read and write operations succeed against paths the user should not be able to reach. No public exploit or CISA KEV listing has been identified; the CVSS 4.0 score of 2.3 reflects the combined effect of high attack complexity and low privilege requirements.
Sequential integer order ID enumeration in Sylius MolliePlugin exposes customer PII across all orders without authentication. The thank-you and QR-code endpoints accept a raw integer orderId query parameter with no ownership or session validation, allowing unauthenticated remote attackers to iterate through all orders, extract non-guessable tokenValue identifiers, and subsequently query the register-after-checkout endpoint to retrieve customer first names, last names, and email addresses. No active exploitation confirmed (not in CISA KEV) and no public proof-of-concept exploit has been identified, but the attack requires zero authentication and minimal skill, making it a realistic threat to any publicly-facing Sylius shop using the Mollie payment gateway.
Incorrect authorization in OpenProject's REST API before 17.6.0 allows any authenticated non-admin user to enumerate sequential custom option IDs via GET /api/v3/custom_options/:id and read option labels belonging to admin_only UserCustomField and GroupCustomField records. The root cause, confirmed by commit diff, is that the authorization handler returned true unconditionally for these two custom field types instead of invoking the visible(current_user) scope filter. No public exploit code exists and this is not listed in CISA KEV, but the low attack complexity and standard network API surface make this trivially exploitable by any account holder on an affected instance.
Broken access control in IBM Langflow OSS 1.0.0-1.8.4 exposes private flow files through two distinct endpoint flaws: the image retrieval endpoint enforces no authentication whatsoever, allowing unauthenticated remote attackers to access any user's image files given a valid flow ID and filename; separately, the file download endpoint, while requiring authentication, fails to validate resource ownership, enabling any authenticated user to access files belonging to other tenants via IDOR. Both flaws break tenant isolation in multi-user deployments and result in unauthorized disclosure of sensitive data. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Tier authorization bypass in Tigera Calico's apiserver allows an authenticated high-privileged user to bulk-delete NetworkPolicy, GlobalNetworkPolicy, and their staged variants across restricted tiers without authorization. The `DeleteCollection` Kubernetes verb was not routed through `AuthorizeTierOperation` - the per-tier enforcement gate that governs all other write operations - meaning any principal holding `deletecollection` or wildcard verbs on tier-scoped policy resources could silently collapse network enforcement boundaries in tiers they have no legitimate access to. No public exploit or CISA KEV listing exists at time of analysis; four upstream patches have been merged and a vendor advisory (TTA-2026-006) has been published.
Cross-channel authorization bypass in Vendure through 3.7.1 allows a low-privileged, channel-scoped administrator to overwrite StockLocation inventory records and Asset catalog entries belonging to other tenants by submitting global GraphQL entity IDs that their channel does not own. The flaw is in the update methods of stock-location.service.ts and asset.service.ts, which omit the required channelId filter during entity lookup, permitting cross-tenant data corruption without triggering any authorization error. A public proof-of-concept exists via GitHub issue #5003, and an upstream fix is available in commit f67ef5f via PR #5017, though a tagged release version incorporating the fix has not been independently confirmed.
Session variable injection in Gladinet CentreStack before version 17.4 allows unauthenticated remote attackers to bypass authentication and access management pages without credentials. By embedding newline and tab characters into the AccountName parameter posted to SelectProvider.aspx, attackers exploit the absence of input sanitization in the product's custom session serialization format to inject an arbitrary resellerid session variable, which satisfies the IsValidRSession authentication check and opens management interfaces. No public exploit has been identified at time of analysis, though VulnCheck discovered and reported this issue with sufficient detail to facilitate reproduction.
Improper authorization in Apache Superset's chart update REST API allows any authenticated user holding chart-update permissions to associate charts with dashboards they do not own, effectively modifying those dashboards without authorization. All Superset versions from 0.0.0 up to (but not including) 6.0.0 are affected. The root cause is that UpdateChartCommand accepted arbitrary dashboard IDs from the request body without verifying the caller held write permissions on those target dashboards. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken object-level authorization in the Tutor LMS WordPress plugin (all versions before 4.0.0) allows any authenticated subscriber-level user to read Q&A threads and inject replies into courses they are not enrolled in or authorized to access. Exploitation requires only a valid WordPress account, making the barrier low for multi-tenant LMS deployments where user registration is open. A publicly available proof-of-concept exists per WPScan, and while not listed in CISA KEV, the low authentication requirement and POC availability elevate realistic risk for exposed installations.
Unauthenticated post metadata manipulation in WP Delicious (WordPress plugin before 1.10.2) allows any remote actor to inflate "like" counters and grow an associated identifier list on arbitrary posts without any credentials or user interaction. The flaw stems from a missing authorization check on a WordPress AJAX action accessible to unauthenticated visitors. A publicly available proof-of-concept exists; SSVC confirms automatable exploitation with partial technical impact, though no CISA KEV listing indicates active widespread exploitation has not been confirmed.
Unauthenticated information disclosure in Essential Addons for Elementor (WordPress plugin, all versions before 6.6.10) exposes WooCommerce product metadata - title, price, and SKU - for products in draft, pending, and private status that WordPress would otherwise withhold from public visitors. The plugin's product-comparison feature resolves product objects without performing authorization, post-status, or visibility checks, violating object-level access control (CWE-639). A public proof-of-concept exists per WPScan (the original reporter), and SSVC marks the flaw as automatable, though EPSS remains very low (0.15%) and the vulnerability is not currently listed in CISA KEV.
Insecure Direct Object Reference in the WP Travel WordPress plugin (all versions before 11.8.1) exposes customer booking records to any authenticated WordPress user. By supplying an arbitrary booking identifier to the customer account dashboard endpoint, a low-privileged attacker can retrieve another customer's full booking details, including billing address information. No special role is required beyond a basic site login; a publicly available proof-of-concept exists, though active exploitation has not been confirmed by CISA KEV.
Unauthenticated booking fraud is possible in the WP Travel WordPress plugin before 11.8.1 due to missing PayPal Instant Payment Notification (IPN) postback verification. Any unauthenticated attacker can send a forged IPN POST request to the plugin's payment handler, causing it to flip an arbitrary pending booking to a paid and confirmed state at a price of the attacker's choosing - enabling fraudulent travel reservations without payment. A publicly available proof-of-concept exists (reported by WPScan), and SSVC classifies the attack as automatable with partial technical impact, though no active exploitation is confirmed in the CISA KEV catalog.
IP spoofing via untrusted HTTP headers in WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 allows unauthenticated attackers to defeat the plugin's own brute-force login protection and downgrade its firewall by forging headers that match a hardcoded whitelisted IP range. The plugin fails to validate that IP-sourcing headers (such as X-Forwarded-For or X-Real-IP) originate from a trusted reverse proxy, making any client-controlled header a viable forgery vector. A publicly available proof-of-concept exists per WPScan's disclosure, though EPSS remains low (0.16%, 5th percentile) and no active exploitation has been confirmed in CISA KEV.
Missing authorization in Frontend Admin by DynamiApps WordPress plugin (versions before 3.29.7) exposes taxonomy term creation, modification, and deletion operations to any authenticated user, including Subscribers - the lowest WordPress role. Rooted in CWE-862 (Missing Authorization), the plugin's taxonomy management handlers execute without invoking WordPress capability checks, granting low-privilege accounts editor-level control over site taxonomy. A public POC is available via WPScan; however, EPSS sits at 0.14% (4th percentile) and no CISA KEV listing exists, suggesting limited real-world exploitation activity despite the accessible POC.
Unauthenticated integrity corruption in Points and Rewards for WooCommerce (versions before 2.10.1) allows remote attackers to arbitrarily modify or corrupt the wallet balance and loyalty points of any user account - including driving values negative - without possessing any credentials. The missing authorization check on a wallet/points update action fails to verify that the requester owns the targeted account, making cross-account manipulation trivially possible. A publicly available proof-of-concept exists per WPScan; the vulnerability is not currently listed in CISA KEV and carries a low EPSS score (0.15%, 4th percentile), suggesting exploitation has not yet been observed at scale.
RegistrationMagic WordPress plugin versions prior to 6.0.9.4 allows unauthenticated remote attackers to overwrite other users' front-end form submissions and the WordPress profile fields of the associated non-administrator accounts by exploiting absent authorization, ownership, and nonce validation on a submission-editing action. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction against any default plugin deployment. A public proof-of-concept exists per WPScan, though EPSS sits at 0.14% (4th percentile) and this CVE is not in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis.
Unauthorized access to other users' form submission data is possible in RegistrationMagic WordPress plugin versions prior to 6.0.9.4 due to missing OTP-to-identity binding validation. The plugin accepts a one-time password from a cookie without confirming it corresponds to the identity being requested, enabling unauthenticated network-based retrieval of personal information submitted through front-end registration forms. A publicly available exploit exists per WPScan, though EPSS at 0.14% (4th percentile) and the absence of a CISA KEV listing indicate exploitation has not been observed at scale.
Search Atlas SEO WordPress plugin (all versions before 2.6.12) exposes its Google Indexing API integration to any authenticated user - including low-privilege subscribers - due to a missing capability and nonce check in an AJAX handler. Any user with a valid WordPress session can invoke the plugin's Google Indexing API endpoint to submit or remove site URLs from Google's search index and exhaust the site's indexing API quota. A publicly available exploit exists via WPScan, though EPSS at 0.14% (4th percentile) and the absence of a CISA KEV listing indicate limited observed exploitation activity at this time.
The Appointment Booking Plugin for WordPress (all versions before 5.6.8) allows unauthenticated visitors to set privileged booking fields - including approval status - through the plugin's public booking funnel, silently bypassing the site's manual booking approval workflow. Any site relying on appointment approval as a gatekeeping mechanism can have that control subverted by any internet-accessible visitor with no credentials required. A publicly available proof-of-concept exists per WPScan; however, EPSS remains at 0.15% (5th percentile), indicating limited observed exploitation activity despite the trivially low attack complexity.
Bit Form WordPress plugin before version 3.1.2 fails to enforce form deactivation state on its public submission handlers, enabling unauthenticated network-accessible attackers to submit data to forms the site owner has intentionally disabled and trigger any configured backend workflows such as email notifications. The vulnerability carries a low CVSS score of 3.7 with AC:H, reflecting that exploitation requires knowledge of a specific deactivated form's endpoint, and real-world impact is limited to low integrity effects - spurious entries and unwanted workflow executions rather than data exfiltration or system compromise. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.15% (5th percentile) indicates exploitation has not meaningfully materialized across the wild.
Authenticated privilege escalation in the Sync Post With Other Site WordPress plugin (all versions before 1.9.3) allows any Contributor-level user to create, publish, and overwrite arbitrary Pages - including content authored by administrators - by exploiting an operator-precedence flaw in a REST route's authorization check. A public proof-of-concept is available via WPScan, though EPSS sits at 0.15% (5th percentile) and SSVC marks exploitation as non-automatable, suggesting opportunistic rather than widespread active exploitation. No CISA KEV listing exists at time of analysis.
Insecure direct object reference in the Easy Appointments WordPress plugin (all versions through 3.12.26) permits any authenticated subscriber-level user to retrieve personal information belonging to any appointment booking customer by iterating a customer identifier. The plugin fails to enforce ownership or capability checks before returning stored customer records, exposing PII across the entire customer base to the lowest-privileged WordPress role. No active exploitation is confirmed in CISA KEV, but a publicly available exploit exists via WPScan's disclosure, and EPSS sits at 0.15% - consistent with targeted rather than automated mass exploitation.
Improper access control in the Easy Appointments WordPress plugin through version 3.12.26 allows any contributor-level WordPress user to delete the site's booking configuration and functionally disable the appointment system. The vulnerable action handler performs neither a WordPress capability check nor nonce validation, meaning any authenticated user at or above contributor role can trigger the deletion without administrative approval. A publicly available exploit exists per WPScan, though EPSS at 0.15% (5th percentile) indicates limited observed exploitation; no CISA KEV listing is present.
Broken access control in the Easy Appointments WordPress plugin through version 3.12.26 permits any contributor-level authenticated user to perform privileged appointment-management actions - including reading all customer booking details and creating, modifying, or deleting appointments - without holding the required capabilities. The plugin relies exclusively on WordPress nonce verification as its authorization gate for these AJAX actions, but nonces are available to all authenticated users regardless of role and do not encode privilege level. A publicly available exploit exists per WPScan; no vendor patch has been identified at time of analysis.
Navigation restriction bypass in Google Chrome DevTools prior to version 151.0.7922.72 enables remote attackers to circumvent browser navigation controls by luring a user into opening a specially crafted malicious file. The flaw stems from CWE-20 insufficient input validation within the DevTools component, resulting in high integrity impact per CVSS. No public exploit has been identified and EPSS exploitation probability is very low at 0.16% (6th percentile); notably, the Chromium security team internally rated this 'Low' severity despite the medium NVD CVSS score of 6.5.
Cross-origin data leakage in Google Chrome's Speech component prior to version 151.0.7922.72 exposes sensitive information to attackers who have already achieved renderer process compromise. The vulnerability stems from insufficient policy enforcement in the Speech API, allowing a crafted HTML page to bypass cross-origin boundaries and exfiltrate data. With no CISA KEV listing, no public POC, and an EPSS of 0.16% (6th percentile), this is a low-probability exploitation scenario best understood as a potential second-stage component in a multi-vulnerability chain rather than a standalone attack.
Navigation restriction bypass in Google Chrome on macOS (versions prior to 151.0.7922.72) permits a local attacker to circumvent the browser's navigation controls by delivering a crafted malicious file. The CVSS vector (AV:L/I:H) confirms the impact is limited to integrity - an attacker who achieves local access can subvert Chrome's navigation security model without requiring elevated privileges or user interaction beyond obtaining local system access. With an EPSS score of 0.10% (1st percentile), no CISA KEV listing, and Chromium's own classification of Low severity, real-world exploitation risk is low despite the 6.2 CVSS base score.
Navigation restriction bypass in Google Chrome for Android (prior to 151.0.7922.72) originates from an inappropriate implementation in the browser's Media component, permitting a remote attacker to circumvent built-in navigation controls by delivering a crafted HTML page to a victim. The CVSS 4.3 score reflects a limited integrity-only impact - no code execution, no data exfiltration - and user interaction is required per the vector (UI:R). EPSS at 0.18% (8th percentile) and the absence of any KEV listing or public exploit indicate low real-world exploitation probability; Chromium's own internal severity rating of 'Low' is consistent with this assessment.
Navigation input validation bypass in Google Chrome prior to 151.0.7922.72 enables a renderer-compromised attacker to circumvent navigation restrictions via a crafted HTML page. The flaw is the second stage of a chained attack - exploitation requires a prior renderer process compromise, substantially raising the practical bar for abuse. No public exploit code or active exploitation has been identified; EPSS sits at 0.18% (8th percentile), consistent with its role as a post-exploitation primitive rather than an initial access vector.
Same-origin policy bypass in Google Chrome's Bluetooth subsystem (prior to 151.0.7922.72) can be triggered by an attacker who has already achieved renderer process compromise, using a crafted HTML page to abuse insufficient policy enforcement in the Web Bluetooth layer. The exploit chain requires a pre-existing foothold in the renderer, which limits real-world risk considerably - Chrome's own security team rated this 'Low' severity. No active exploitation has been confirmed (not listed in CISA KEV), and the EPSS score of 0.18% (8th percentile) reflects negligible observed exploitation activity.
Insufficient policy enforcement in Chrome's Speech component prior to version 151.0.7922.72 enables remote attackers to bypass site isolation - a core security boundary - via a crafted HTML page requiring only user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) signals high integrity impact with no privilege requirement, meaning an unrelated web page can be weaponized as the delivery vehicle. No public exploit code has been identified and EPSS sits at a low 0.18% (8th percentile), consistent with the Chromium team's own 'Low' severity classification despite the NVD medium score; however, the site isolation bypass class of vulnerability is historically sensitive and warrants prompt patching.
Same-origin policy bypass in Google Chrome's Cast component allows remote attackers to perform limited cross-origin integrity actions against victims who visit a crafted HTML page. All Chrome versions prior to 151.0.7922.72 are affected across Windows, macOS, and Linux. No active exploitation is confirmed (not in CISA KEV), no public exploit code has been identified, and Chromium's own internal severity rating is Low - signals that align with the very low EPSS score of 0.18% at the 8th percentile.
Insufficient policy enforcement in the Extensions subsystem of Google Chrome prior to 151.0.7922.72 allows an attacker to bypass discretionary access controls by deploying a malicious extension that uses a specially crafted domain name. The attack is fully dependent on social engineering - the victim must be convinced to install the malicious extension, which significantly constrains opportunistic exploitation. With a CVSS score of 4.3, EPSS at 0.12% (2nd percentile), no CISA KEV listing, and a 'Low' Chromium-internal severity rating, no public exploit identified at time of analysis, this represents a minimal real-world priority for most organizations, particularly those with enterprise extension management controls in place.
Navigation restriction bypass in Google Chrome's DevTools component (versions prior to 151.0.7922.72) allows a local attacker to circumvent browser navigation policies via a crafted HTML page. The insufficient policy enforcement within DevTools produces an integrity-high impact (CVSS I:H) without requiring attacker privileges. No public exploit code or CISA KEV listing exists; an EPSS score of 0.12% (2nd percentile) and Google's internal 'Low' Chromium severity rating together confirm this as a low immediate exploitation priority.
Navigation restriction bypass in Google Chrome on Android (prior to 151.0.7922.72) enables remote unauthenticated attackers to circumvent session-based navigation controls by inducing a victim to load a crafted HTML page. The root cause is an improper access control implementation (CWE-284) specific to Chrome's Session component on the Android platform. No public exploit has been identified at time of analysis, and CISA's SSVC framework rates exploitation as none with only partial technical impact, consistent with the low EPSS score of 0.18%.
Clever Mega Menu for Visual Composer (WordPress plugin, versions through 1.0.1) allows any authenticated user with as little as Subscriber-level access to overwrite navigation menu item content and settings through an unprotected AJAX endpoint. The plugin fails to perform either a nonce check or a capability check before processing menu item metadata updates, meaning WordPress role-based access control over menu management is completely bypassed. A publicly available exploit exists via WPScan, though EPSS places exploitation probability at 0.14% (4th percentile) with no CISA KEV listing, indicating limited observed exploitation at time of analysis.
Simple Restrict WordPress plugin before 1.2.9 exposes restricted post and page content through the WordPress REST API due to an authorization bypass. The plugin enforces its own permission system on the front-end but falls back to a generic WordPress capability check on REST API routes, allowing any contributor-level or higher WordPress account to read content that was explicitly restricted via the plugin's access controls. No public exploit identified at time of KEV review, though a proof-of-concept is publicly available via WPScan; the EPSS of 0.13% at the 3rd percentile confirms negligible observed exploitation activity.
Meta Box WordPress plugin before 5.13.1 allows any user holding a Contributor-level role (or equivalent low-privilege account) to permanently delete arbitrary media attachments owned by other users, including administrators, due to a missing authorization check on the deletion endpoint. The root cause is CWE-862: the plugin performs the deletion operation without verifying whether the requesting user has ownership or administrative rights over the target attachment. Publicly available exploit code exists (sourced from WPScan), and while EPSS sits at a low 0.17% (6th percentile), the low attack complexity and wide availability of Contributor accounts on multi-author WordPress sites make this a realistic insider or compromised-account threat.
Insecure Direct Object Reference in FluentBoards WordPress plugin before 1.95.3 allows any authenticated user holding member access to at least one board to silently exfiltrate task titles, descriptions, and file attachments from all other boards on the site by supplying arbitrary board item identifiers in an import request. The server performs no authorization check to verify that requested items belong to boards the invoking user is permitted to access, making any board member a potential insider threat against sensitive project data. A public proof-of-concept is available via WPScan; however, EPSS sits at 0.13% (3rd percentile) and no CISA KEV entry exists, indicating limited observed exploitation despite disclosure.
Client policy enforcement in Red Hat Build of Keycloak can be bypassed by an authenticated user holding client management permissions, allowing non-compliant OAuth clients to persist in a realm despite administrator-configured security hardening. The bypass exploits improper client state evaluation during update operations: an attacker creates a public client - which passes policy validation - and then updates it to a confidential client type, skipping the re-evaluation that would normally reject a non-compliant confidential client. No public exploit code has been identified and this CVE is not listed in CISA KEV; however, the low attack complexity and broad deployment of Keycloak in enterprise IAM infrastructure elevate its practical significance.
Time-based authorization policy bypass in Red Hat Build of Keycloak permits any low-privileged authenticated user to inject a fabricated timestamp into their authorization request, causing Keycloak's Authorization Services engine to evaluate the forged value instead of the actual server clock. This fully defeats time-based access controls - such as business-hours restrictions - across affected Red Hat products including Keycloak, Single Sign-On 7, Data Grid 8, and JBoss EAP Expansion Pack. No public exploit code has been identified and this CVE is not listed in CISA KEV, but the CVSS High integrity impact accurately reflects that time-gated authorization controls are rendered entirely ineffective against any valid account holder.
The full-scope-disabled client-policy executor in Red Hat Build of Keycloak silently skips enforcement when the fullScopeAllowed attribute is absent from a client registration or update request, allowing a delegated user to create OAuth/OIDC clients with unrestricted scope access. Affected platforms span Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and JBoss EAP Expansion Pack. An attacker holding delegated registration privileges (CVSS PR:L) can exploit this to issue tokens containing unauthorized role mappings, effectively escalating their effective permissions within any application trusting those tokens. No public exploit code or CISA KEV entry has been identified at time of analysis.
NO_PROXY bypass in axios Node.js HTTP client exposes local services to configured proxies when requests target 0.0.0.0. Affected versions 1.15.0-1.17.x and 0.31.0-0.32.x omit 0.0.0.0 from loopback address recognition in shouldBypassProxy.js, causing traffic intended to bypass proxy routing to instead be forwarded through HTTP_PROXY or HTTPS_PROXY. Plain HTTP requests are most exposed since the proxy receives the full request URL, headers, and body; HTTPS is partially mitigated by CONNECT tunneling. No public exploit or CISA KEV listing identified at time of analysis, but exploitation requires only attacker-controlled URL input in an otherwise common Node.js proxy deployment.
Audience-binding failure in @better-auth/oauth-provider (npm) allows authenticated OAuth clients to obtain JWT access tokens targeting resource servers never covered by the original authorization grant. Versions 1.4.8 through 1.7.0-beta.3 accept the RFC 8707 resource parameter exclusively at the token endpoint without recording it on the authorization code or the refresh-token row, meaning the authorized resource set is never enforced at redemption time. No public exploit has been identified at time of analysis, but the flaw directly undermines multi-audience OAuth deployments where resource servers enforce authorization based on the JWT aud claim.
Cross-tenant insecure direct object reference in OpenRemote versions up to and including 1.26.2 allows an authenticated attacker to bypass realm access controls in the AlarmResourceImpl.setAssetLinks endpoint, disclosing victim tenant asset names and persisting unauthorized cross-realm alarm-asset links. The flaw stems from a structurally incomplete authorization check that validates only the first realm returned by non-deterministic HashSet iteration rather than all realms submitted in the request, making the attack probabilistically repeatable until successful. No public exploit has been identified at time of analysis; the issue was fixed in version 1.27.0 per the vendor security advisory.
OAuth state validation bypass in better-auth before 1.6.2 enables network-based attackers to forge the OAuth callback state parameter and supply attacker-controlled authorization codes, creating authenticated sessions in the victim's browser that are cryptographically bound to the attacker's external identity. Account-linking flows are equally exposed, permitting the attacker's provider account to be persistently linked to an authenticated victim row in the application's user store. Exploitation is constrained to a specific non-default configuration (cookie-backed state storage with PKCE disabled), and no public exploit has been identified at time of analysis.
Bluetooth GATT notification and indication paths in Zephyr RTOS 2.6.0 through 4.4.x skip the application-configured encryption, authentication, and LESC security requirements for characteristic values when the application follows the documented idiom of passing the Characteristic Declaration attribute to the notify/indicate APIs. A remote Bluetooth peer within radio range can connect without pairing and trigger the server to emit protected characteristic values over an unsecured link by writing the Client Characteristic Configuration descriptor, achieving an access-control bypass and information disclosure. No public exploit is identified at time of analysis; exploitation requires adjacent network access and specific application configuration.
Unauthenticated sensitive information disclosure in the WooCommerce PayPal Payments WordPress plugin (all versions through 3.3.2) allows remote attackers to harvest full customer billing PII from recently placed orders. The vulnerability is a two-stage IDOR chain: the `enqueue_paypal_insights_script_on_order_received()` function exposes order keys without validating the caller's identity, and those keys can then be replayed against the WooCommerce Store API - which grants a 10-minute post-order grace period - to retrieve names, email addresses, phone numbers, and street addresses. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the network-reachable, zero-authentication attack path and PII sensitivity elevate practical risk above the CVSS 5.3 numeric score.
Sensitive information exposure in the Advanced Views WordPress plugin (wplakeorg, all versions ≤ 3.9.1) allows any authenticated subscriber-level user to harvest admin-authored editor content - including template markup, CSS, JavaScript, and PHP controller variables - via improperly authorized REST API routes. Wordfence identified the flaw across three CPT interactive field classes (base, Layout, and Post Selection). No public exploit code or CISA KEV listing exists at time of analysis, but the low authentication bar of subscriber-level access makes this trivially exploitable on any WordPress site with open user registration.
Authorization bypass in the Gutena Forms WordPress plugin (all versions through 1.9.0) enables unauthenticated remote attackers to permanently trash or toggle the read/unread status of arbitrary form submission entries across any form on the affected site. The root cause is a fatally weakened nonce check: the nonce action 'gutena_Forms' is broadcast to all anonymous site visitors via wp_localize_script() on any page embedding a Gutena Forms block, rendering the check_ajax_referer() call functionally useless as an authorization control. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE, though the low-complexity, zero-authentication attack vector means any anonymous internet user can exploit this without special tooling against any affected installation.
Authorization bypass in the RealHomes Memberships WordPress plugin (inspiry-memberships, all versions through 3.0.9) allows any authenticated subscriber to self-assign premium membership tiers without completing a PayPal transaction. The plugin's PayPal payment handler fails to verify user authorization before processing membership upgrades, enabling subscribers to generate falsified active payment receipts and unlock restricted property listing allowances. No public exploit has been identified at time of analysis, and the CVSS score of 4.3 (PR:L) reflects that exploitation is limited to authenticated users.
Vote-limit bypass in YOP Poll WordPress plugin before 7.0.6 allows unauthenticated remote attackers to cast unlimited votes on any public poll by spoofing IP addresses through client-controlled HTTP forwarding headers. The plugin enforces its per-IP vote restriction by reading attacker-supplied headers such as X-Forwarded-For rather than the validated TCP connection IP, making the restriction trivially circumventable. A publicly available proof-of-concept exists per WPScan reporting; EPSS sits at 0.14% (4th percentile), indicating low broad exploitation activity at time of analysis despite the low attack complexity.
Broken object-level authorization in the Event Tickets and Registration WordPress plugin before 5.29.0.1 allows any contributor-level (or higher) WordPress user to overwrite the seating layout, ticket inventory, and attendee seat assignments for events they do not own. The flaw stems from insufficient ownership verification on seating-related actions, meaning a low-privileged authenticated user can manipulate another author's event data without restriction. No public exploitation in the wild has been confirmed by CISA KEV, but a public proof-of-concept exists per WPScan reporting, and the EPSS score of 0.13% (3rd percentile) reflects minimal observed scanning or exploitation activity at time of analysis.
Unauthenticated order status manipulation is possible in the Event Tickets and Registration WordPress plugin across all versions before 5.29.0.1, due to a completely absent authorization check on an order-management REST endpoint. Any remote actor - with no credentials or privileges - can alter the status of existing orders, enabling fraud scenarios such as marking unpaid orders as completed. A publicly available exploit exists per WPScan; however, EPSS at 0.14% (4th percentile) indicates mass exploitation has not materialized at time of analysis, and the vulnerability is not listed in CISA KEV.
Authentication bypass in the Authora : Easy login with mobile number WordPress plugin (all versions before 1.7.7) exposes one-time login codes and valid verification tokens directly in the HTTP response of an unauthenticated endpoint, completely nullifying the mobile-based OTC authentication mechanism. Any unauthenticated attacker who knows a registered user's mobile number - including an administrator's - can obtain a valid session token without receiving an SMS, achieving full account takeover. A publicly available proof-of-concept exploit exists via WPScan; EPSS sits at 0.14% (4th percentile), indicating limited observed exploitation despite POC availability and no CISA KEV listing.
Unauthenticated forged conversion event injection in Pixel Tag Manager for WooCommerce (all versions before 2.2.1) allows any remote attacker to submit fabricated e-commerce conversion events to the site's server-side advertising APIs - such as Meta Conversions API or Google Ads - using the site's own stored credentials. The root cause is a missing authorization check on a WordPress AJAX action (CWE-284), meaning the endpoint processes requests from anyone without verifying identity or role. A publicly available exploit exists per WPScan; however, the EPSS score of 0.14% (4th percentile) indicates opportunistic exploitation has not yet been observed at scale.
Unrestricted mass assignment in the Booking for Appointments and Events Calendar WordPress plugin (before 2.4.4) permits any user holding the Amelia Manager role to overwrite arbitrary database columns on stored user records by injecting unsanitized fields into customer import requests. This can enable data tampering or privilege manipulation within the booking system's user table. No public exploitation is confirmed via CISA KEV, but a POC is publicly available through WPScan; EPSS remains at 0.13% (3rd percentile), consistent with limited real-world exploitation probability given the high-privilege prerequisite.
Improper authorization in the Brizy WordPress plugin before 2.8.18 allows any authenticated user holding the Contributor role or above to read the full content of arbitrary posts, bypassing WordPress's native visibility controls for private, pending, and draft posts. The flaw resides in a specific request handler that returns post content without verifying whether the requesting user is entitled to view it (CWE-639, IDOR). A publicly available proof-of-concept exploit has been published by WPScan; however, no confirmed active exploitation appears in CISA KEV, and the EPSS score of 0.13% (3rd percentile) reflects limited observed exploitation activity at time of analysis.
Missing authorization controls in the Buckaroo WooCommerce Payments Plugin before 4.9.0 allow any authenticated WordPress user - including low-privilege Subscribers - to trigger payment capture refunds against any captured order via an unprotected AJAX endpoint. The flaw causes direct financial integrity loss for merchants, as unauthorized refund processing reverses captured payments without any approval workflow. A publicly available exploit exists per WPScan, though EPSS remains very low at 0.13% (3rd percentile), indicating exploitation has not become widespread despite the accessible attack surface.
Unauthenticated OAuth state hijacking in Builderall for WordPress (versions before 3.0.2) enables remote attackers to overwrite the plugin's stored third-party integration access token by completing an OAuth authorization flow that is never bound to the initiating user session. Practical impact is constrained to sites already connected to a paid Builderall account - without that precondition, the overwrite is transient rather than durable. No confirmed active exploitation exists in CISA KEV, but WPScan has published a public proof-of-concept, making this accessible beyond sophisticated attackers despite an EPSS of 0.18% (7th percentile).
Broken object-level authorization in Fluent Support WordPress plugin before 2.3.1 allows restricted support agents to reassign the customer field on any ticket system-wide, bypassing per-ticket scope enforcement. Affected are WordPress installations running Fluent Support versions prior to 2.3.1 where restricted support agent accounts exist. An authenticated agent can manipulate ticket ownership across the entire helpdesk, exposing customer metadata and corrupting ticket assignment integrity. A publicly available proof-of-concept exists; EPSS probability is very low (0.13%, 3rd percentile) and no CISA KEV listing indicates no confirmed mass exploitation.
Unauthenticated order manipulation in the Direct Payments for WooCommerce WordPress plugin before 2.5.3 enables any remote attacker to forge payment completion states, overwrite payment-method labels, and attach fabricated proof-of-payment files to arbitrary customer orders. The flaw stems from multiple AJAX handlers that process order updates without verifying the requester owns or is otherwise authorized to modify the targeted order. A publicly available proof-of-concept exists and the SSVC framework rates this as automatable, meaningfully amplifying the fraud risk for affected merchants despite the EPSS score of 0.15% (4th percentile).
Credential exfiltration in AWS Strands Agents Tools before 0.8.2 exposes HTTP_REQUEST_TOKEN_CONFIG bearer tokens to attacker-controlled proxy infrastructure by exploiting the LLM's ability to set proxy parameters within the http_request tool's input schema. The root cause (CWE-863: Incorrect Authorization) is that proxy configuration was included as an LLM-controllable field, enabling prompt injection attacks to redirect credentialed HTTP requests through adversary infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis; however, any deployment combining token-authenticated HTTP requests with externally influenced agent inputs is at material risk.
IP spoofing via X-Forwarded-For header manipulation in Ghost CLI before 1.30.1 enables unauthenticated remote attackers to defeat rate-limiting controls on self-hosted Ghost instances. The vulnerability arises when Nginx is configured with the $proxy_add_x_forwarded_for directive, which appends attacker-supplied IP values to the header chain, causing Ghost's rate-limiter to treat each crafted request as originating from a distinct, unseen IP address. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the low attack complexity makes this straightforward to abuse once a vulnerable instance is identified.
pgAdmin 4 SERVER mode (versions 9.3 through 9.16) allows authenticated users to fully bypass administrator-configured per-tool role-based access controls by exploiting incomplete permission enforcement across backend routes and Socket.IO handlers. The Flask-Security `permissions_required` decorator was applied only to a single front-door route per tool, while all secondary routes and Socket.IO event handlers checked only authentication, not tool permissions - meaning a user who received a 403 on the initial gated endpoint could still drive the complete tool workflow through its other endpoints. Affected tools include Query Tool, Grant Wizard, Schema Diff, ERD, PSQL (interactive terminal), Debugger, Backup, Restore, Maintenance, and Import/Export. No dedicated public exploit has been identified, though the fix commits and GitHub issue are publicly visible; exploitation requires a valid authenticated pgAdmin session.
Authentication bypass in pgAdmin 4 SERVER mode exposes multiple routes to unauthenticated network access due to missing @pga_login_required decorators, a defect class previously identified in CVE-2026-12046 but incompletely remediated. Unauthenticated remote clients can enumerate table constraint metadata, delete table constraints (a state-mutating operation), read all CLI-settable preference values, and force-close active debugger or schema-diff sessions belonging to other authenticated users. The CVSS 4.0 vector (PR:N, AV:N, AC:L) confirms no authentication or special conditions are required in SERVER mode deployments; no public exploit or CISA KEV listing has been identified at time of analysis.
HCL iControl versions 4.3.0 and 4.4.0 expose a network-accessible integrity bypass to authenticated low-privileged attackers through a broken input validation mechanism. The implementation flaw in an architectural security tactic fails to enforce type conformance on received input, enabling an attacker to manipulate application logic and circumvent security controls. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV, though the vendor-assigned 'Authentication Bypass' tag elevates operational concern beyond what the CVSS score alone suggests.
Checkmk's reporting module fails to enforce the 'Edit foreign Reports' permission, allowing any authenticated user - regardless of their assigned role - to modify reports belonging to other users. Affected are all Checkmk deployments running versions prior to 2.5.0p10, 2.4.0p35, or 2.3.0p49, as well as the end-of-life 2.2.0 branch. No public exploit code or active exploitation has been identified at time of analysis, and real-world impact is bounded to report integrity rather than system compromise, but the permission bypass undermines multi-tenant trust boundaries in shared monitoring environments.
Insecure Direct Object Reference in Fluent Forms for WordPress (versions up to and including 6.2.8) exposes other users' payment receipt data to unauthenticated remote attackers via a brute-forceable 'transaction' parameter. Because the transaction hash is constructed from observable or guessable inputs - submission ID, form ID, and creation timestamp - the effective brute-force space is bounded to approximately 900 candidates per second per (submission, form) pair, making unauthenticated enumeration of victim receipts containing name, email, billing address, order items, payment method, and payment status practically feasible. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, a patch is available in version 6.2.9.
Unauthenticated campaign content tampering in the MailerPress - Newsletter, Email Marketing & AI Automation WordPress plugin (versions ≤ 1.5.0) allows any remote actor to overwrite active email campaign HTML by invoking the revision-restore REST endpoint without credentials. The campaign revision-restore route (POST /wp-json/mailpress/v1/campaign/<id>/restore-revision/<revision_id>) was registered in the WordPress REST API without a permissionCallback, bypassing the authorization layer entirely. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, though the attack is trivially executable against any reachable WordPress instance running the affected plugin.
Unauthorized contact data modification in MailerPress (WordPress plugin, versions up to and including 1.5.0) is achievable by any unauthenticated remote attacker via a missing capability check on the REST API endpoint `mailerpress/v1/contact`. The root cause (CWE-862) means WordPress's permission framework is entirely bypassed for this endpoint, exposing the contact database to arbitrary writes without credentials. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and zero authentication requirement make this trivially exploitable by automated scanners.
Remote unauthenticated access to an undocumented HTTP endpoint in ANDRITZ HIPASE-250 (formerly 250 SCALA) allows attackers to silently modify the system's audit logging level and destination without credentials. Rooted in CWE-306 (Missing Authentication for Critical Function), this flaw is particularly dangerous in industrial control system contexts where log integrity underpins incident detection and forensic capability - suppressing logs is a classic defense-evasion precursor enabling follow-on attacks to go unrecorded. No active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis, but the trivial attack complexity (AV:N/AC:L/PR:N/UI:N) means any attacker with network reachability can exploit this without tooling.
Wildcard domain validation in Keycloak's keycloak-services component can be bypassed by an attacker who controls their connection's reverse DNS, enabling unauthorized client registration or modification against a Keycloak realm. The flaw stems from the system accepting any hostname that merely ends with the configured domain suffix (e.g., 'attackerexample.com' satisfying a '*.example.com' restriction) rather than enforcing true subdomain membership. Exploitation requires high attack complexity due to the reverse DNS control prerequisite, and no public exploit or CISA KEV listing has been identified at the time of analysis.
Incorrect authorization in Keycloak's group policy evaluation allows a low-privileged authenticated user to bypass group membership checks and gain unauthorized access to administrative functions or protected resources. The root cause is a string prefix comparison used to verify child-group membership under an 'extend to child groups' policy: a user in a group whose name shares a leading prefix with a privileged group (e.g., '/admins-external' matching a policy scoped to '/admins') is incorrectly treated as a legitimate child-group member. The CVSS vector (PR:L, I:H) confirms this is an authenticated integrity-bypass with high impact. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Keycloak's OIDC token introspection endpoint incorrectly discloses the full set of JWT claims to confidential clients inspecting tokens that were not issued for them. Any confidential client configured to receive signed JWT introspection responses can submit a foreign token, receive an 'inactive' status confirmation, and simultaneously receive the complete signed JWT payload containing sensitive user attributes and claims - effectively bypassing the audience isolation that OIDC introspection is designed to enforce. No active exploitation has been confirmed (not listed in CISA KEV), and no public proof-of-concept code has been identified at time of analysis, but the low attack complexity and network accessibility via a standard API endpoint make this a meaningful confidentiality risk in multi-tenant or multi-client Keycloak deployments.
Broken access control in Keycloak's RoleContainerResource component allows delegated administrators with manage-realm permissions to remove child roles from built-in admin roles via name-based endpoints in the admin REST API that skip proper authorization checks. Affected distributions include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat JBoss EAP Expansion Pack, and Red Hat Data Grid 8. An attacker exploiting this flaw can degrade or disrupt administrative functions within a realm by stripping essential role assignments from built-in admin roles, effectively undermining the role-based access control structure of the affected deployment. No public exploit code and no CISA KEV listing are associated with this CVE at time of analysis.
Token revocation bypass in Keycloak's TokenManager component allows sessions and user data access to persist after administrative invalidation. The flaw (CWE-862: Missing Authorization) causes client-level 'not-before' revocation policies to be silently skipped when a realm-level revocation policy with an older, non-zero timestamp is already in place - causing the revocation to produce no effect. Authenticated token holders (PR:L) can continue refreshing sessions and querying user information APIs despite explicit administrative revocation. No public exploit identified at time of analysis; KEV status is not confirmed.
Missing authorization on attachment download endpoints in the Support Genix WordPress plugin (before 1.4.48) exposes private support ticket files to unauthenticated network access. Any caller who possesses a stored attachment's filename can retrieve it directly, bypassing ticket ownership and login checks entirely. A publicly available exploit exists per WPScan, though EPSS sits at 0.14% (4th percentile), indicating no widespread opportunistic exploitation at time of analysis; no CISA KEV listing.
Insecure Direct Object Reference (IDOR) in the wpForo Forum WordPress plugin before 3.1.2 allows any subscriber-level authenticated user to permanently delete the AI chat message history of arbitrary other users by submitting deletion requests without ownership verification. The plugin's AI chat message deletion endpoint does not validate that the targeted conversation belongs to the requesting user, enabling low-privilege account holders to cause irreversible data loss across the platform. A publicly available proof-of-concept exists per WPScan reporting; however, EPSS is extremely low at 0.13% (3rd percentile) and the vulnerability has not been added to the CISA KEV catalog, indicating limited observed exploitation.
Broken Object Level Authorization in the Academy LMS WordPress plugin through 3.8.2 exposes every user's quiz attempt records - including IP addresses, full names, registration dates, and quiz results - to any authenticated subscriber-level user who is enrolled in at least one course. The flaw stems from missing ownership checks on quiz attempt record retrieval endpoints (CWE-639), enabling horizontal privilege escalation across the entire site's student population. A publicly available proof-of-concept exists per WPScan; exploitation probability remains low (EPSS 0.13%, 3rd percentile) with no confirmed active exploitation in CISA KEV.
Broken object-level authorization (IDOR) in the BuddyPress WordPress plugin, all versions before 14.5.0, permits any authenticated user at the Subscriber level or above to read, modify, or delete private messages belonging to other users via the plugin's messaging endpoints. A publicly available proof-of-concept exists per WPScan reporting, though EPSS data places exploitation probability at just 0.13% (3rd percentile) and SSVC classification marks it as not automatable, indicating exploitation is currently opportunistic and targeted rather than widespread. No CISA KEV listing is present, but the low privilege bar combined with network accessibility makes this a meaningful privacy and integrity risk on any community-facing or multi-tenant WordPress deployment running BuddyPress.
Insecure Direct Object Reference (IDOR) in JS Help Desk WordPress plugin before 3.1.5 exposes support ticket data to any low-privileged authenticated user who supplies an arbitrary ticket ID. The plugin performs no ownership check when loading ticket contents, meaning a registered user can enumerate ticket IDs and read PII, message bodies, and reporter identity belonging to other users. A publicly available proof-of-concept exists per WPScan; no confirmed active exploitation (CISA KEV) has been identified, and EPSS remains very low at 0.13%.
Broken authorization in the JS Help Desk WordPress plugin (versions prior to 3.1.4) allows any authenticated user at Subscriber level or above to overwrite the content of any support-ticket reply site-wide, regardless of ownership. The plugin's reply-update endpoint fails to validate that the requesting user owns the targeted reply, enabling unauthorized content manipulation across all tickets. A publicly available proof-of-concept exploit exists; no active exploitation has been confirmed in CISA KEV at time of analysis.
Unauthenticated order document enumeration in the FluentCart WordPress plugin (all versions before 1.5.3) exposes customer PII - names, email addresses, and billing and shipping postal addresses - across every order in a store. CWE-639 (IDOR) is the root cause: order documents are keyed on sequential numeric identifiers with no authorization or ownership validation, so any unauthenticated visitor can iterate through all historical orders. A publicly available exploit exists per WPScan; no active exploitation is confirmed in CISA KEV, though the trivial enumeration method and public PoC substantially lower the barrier to mass data harvesting.
Insecure Direct Object Reference in the Paid Membership Subscriptions WordPress plugin (before 3.0.7) allows any authenticated subscriber-level user to enumerate and retrieve payment records belonging to other members. The AJAX handler responsible for payment data retrieval performs neither a WordPress capability check nor a nonce validation, meaning horizontal privilege escalation requires only a valid low-privilege account on the target site. A publicly available proof-of-concept exists per WPScan, though no CISA KEV listing confirms active widespread exploitation at time of analysis.
Unauthenticated data overwrite in the Events Made Easy WordPress plugin (all versions before 3.1.4) allows any remote, unauthenticated attacker to overwrite personal data stored in any person record by exploiting a missing authorization check on data-change endpoints. The plugin's nonce mechanism is public and shared, providing no per-record token or ownership binding, making it trivially bypassable under CWE-639. A publicly available exploit exists per WPScan research; no active exploitation has been confirmed in CISA KEV at time of analysis.
Unauthenticated mailing list subscription abuse in the Mailgun for WordPress plugin before 2.2.1 allows any remote attacker to enroll arbitrary email addresses into the site owner's Mailgun mailing lists by exploiting an unprotected AJAX endpoint. The plugin's stored API credentials are silently invoked on the attacker's behalf, effectively weaponizing the site owner's Mailgun account against third-party email addresses. A public exploit is available via WPScan, though the EPSS score of 0.14% (4th percentile) and absence from CISA KEV indicate limited observed exploitation to date.
GiveWP WordPress donation plugin before version 4.16.3 allows unauthenticated users to route donations through payment gateways the administrator has explicitly disabled, by supplying a gateway identifier via request input that the plugin fails to validate against the admin-configured allowlist. Rooted in CWE-862 (Missing Authorization), this bypasses financial controls that site operators may have disabled for compliance, fraud prevention, or contractual reasons - making the practical business risk higher than the CVSS Medium score suggests. A publicly available proof-of-concept exists via WPScan; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Authorization bypass in Google mcp-toolbox's bigquery-execute-sql tool (versions 0.16.1-1.4.0) allows authenticated low-privileged users to exfiltrate DDL schemas from explicitly restricted datasets and query federated external data via EXTERNAL_QUERY connections. The fail-open logic flaw stems from the tool treating an empty tableIDSet returned by the BigQuery dry-run API - which occurs for INFORMATION_SCHEMA and EXTERNAL_QUERY constructs - as a signal to skip allowedDatasets enforcement entirely. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the bypass mechanism is straightforward for any authenticated toolbox user.
SFTPGo versions prior to 2.7.4 expose a permission bypass allowing authenticated users holding the create_symlinks permission to circumvent per-directory access controls by creating symbolic links that bridge permitted and restricted directories. Authorization is evaluated against the symlink's parent directory rather than the dereferenced target, so read and write operations succeed against paths the user should not be able to reach. No public exploit or CISA KEV listing has been identified; the CVSS 4.0 score of 2.3 reflects the combined effect of high attack complexity and low privilege requirements.
Sequential integer order ID enumeration in Sylius MolliePlugin exposes customer PII across all orders without authentication. The thank-you and QR-code endpoints accept a raw integer orderId query parameter with no ownership or session validation, allowing unauthenticated remote attackers to iterate through all orders, extract non-guessable tokenValue identifiers, and subsequently query the register-after-checkout endpoint to retrieve customer first names, last names, and email addresses. No active exploitation confirmed (not in CISA KEV) and no public proof-of-concept exploit has been identified, but the attack requires zero authentication and minimal skill, making it a realistic threat to any publicly-facing Sylius shop using the Mollie payment gateway.
Incorrect authorization in OpenProject's REST API before 17.6.0 allows any authenticated non-admin user to enumerate sequential custom option IDs via GET /api/v3/custom_options/:id and read option labels belonging to admin_only UserCustomField and GroupCustomField records. The root cause, confirmed by commit diff, is that the authorization handler returned true unconditionally for these two custom field types instead of invoking the visible(current_user) scope filter. No public exploit code exists and this is not listed in CISA KEV, but the low attack complexity and standard network API surface make this trivially exploitable by any account holder on an affected instance.
Broken access control in IBM Langflow OSS 1.0.0-1.8.4 exposes private flow files through two distinct endpoint flaws: the image retrieval endpoint enforces no authentication whatsoever, allowing unauthenticated remote attackers to access any user's image files given a valid flow ID and filename; separately, the file download endpoint, while requiring authentication, fails to validate resource ownership, enabling any authenticated user to access files belonging to other tenants via IDOR. Both flaws break tenant isolation in multi-user deployments and result in unauthorized disclosure of sensitive data. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Tier authorization bypass in Tigera Calico's apiserver allows an authenticated high-privileged user to bulk-delete NetworkPolicy, GlobalNetworkPolicy, and their staged variants across restricted tiers without authorization. The `DeleteCollection` Kubernetes verb was not routed through `AuthorizeTierOperation` - the per-tier enforcement gate that governs all other write operations - meaning any principal holding `deletecollection` or wildcard verbs on tier-scoped policy resources could silently collapse network enforcement boundaries in tiers they have no legitimate access to. No public exploit or CISA KEV listing exists at time of analysis; four upstream patches have been merged and a vendor advisory (TTA-2026-006) has been published.
Cross-channel authorization bypass in Vendure through 3.7.1 allows a low-privileged, channel-scoped administrator to overwrite StockLocation inventory records and Asset catalog entries belonging to other tenants by submitting global GraphQL entity IDs that their channel does not own. The flaw is in the update methods of stock-location.service.ts and asset.service.ts, which omit the required channelId filter during entity lookup, permitting cross-tenant data corruption without triggering any authorization error. A public proof-of-concept exists via GitHub issue #5003, and an upstream fix is available in commit f67ef5f via PR #5017, though a tagged release version incorporating the fix has not been independently confirmed.
Session variable injection in Gladinet CentreStack before version 17.4 allows unauthenticated remote attackers to bypass authentication and access management pages without credentials. By embedding newline and tab characters into the AccountName parameter posted to SelectProvider.aspx, attackers exploit the absence of input sanitization in the product's custom session serialization format to inject an arbitrary resellerid session variable, which satisfies the IsValidRSession authentication check and opens management interfaces. No public exploit has been identified at time of analysis, though VulnCheck discovered and reported this issue with sufficient detail to facilitate reproduction.
Improper authorization in Apache Superset's chart update REST API allows any authenticated user holding chart-update permissions to associate charts with dashboards they do not own, effectively modifying those dashboards without authorization. All Superset versions from 0.0.0 up to (but not including) 6.0.0 are affected. The root cause is that UpdateChartCommand accepted arbitrary dashboard IDs from the request body without verifying the caller held write permissions on those target dashboards. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken object-level authorization in the Tutor LMS WordPress plugin (all versions before 4.0.0) allows any authenticated subscriber-level user to read Q&A threads and inject replies into courses they are not enrolled in or authorized to access. Exploitation requires only a valid WordPress account, making the barrier low for multi-tenant LMS deployments where user registration is open. A publicly available proof-of-concept exists per WPScan, and while not listed in CISA KEV, the low authentication requirement and POC availability elevate realistic risk for exposed installations.
Unauthenticated post metadata manipulation in WP Delicious (WordPress plugin before 1.10.2) allows any remote actor to inflate "like" counters and grow an associated identifier list on arbitrary posts without any credentials or user interaction. The flaw stems from a missing authorization check on a WordPress AJAX action accessible to unauthenticated visitors. A publicly available proof-of-concept exists; SSVC confirms automatable exploitation with partial technical impact, though no CISA KEV listing indicates active widespread exploitation has not been confirmed.
Unauthenticated information disclosure in Essential Addons for Elementor (WordPress plugin, all versions before 6.6.10) exposes WooCommerce product metadata - title, price, and SKU - for products in draft, pending, and private status that WordPress would otherwise withhold from public visitors. The plugin's product-comparison feature resolves product objects without performing authorization, post-status, or visibility checks, violating object-level access control (CWE-639). A public proof-of-concept exists per WPScan (the original reporter), and SSVC marks the flaw as automatable, though EPSS remains very low (0.15%) and the vulnerability is not currently listed in CISA KEV.
Insecure Direct Object Reference in the WP Travel WordPress plugin (all versions before 11.8.1) exposes customer booking records to any authenticated WordPress user. By supplying an arbitrary booking identifier to the customer account dashboard endpoint, a low-privileged attacker can retrieve another customer's full booking details, including billing address information. No special role is required beyond a basic site login; a publicly available proof-of-concept exists, though active exploitation has not been confirmed by CISA KEV.
Unauthenticated booking fraud is possible in the WP Travel WordPress plugin before 11.8.1 due to missing PayPal Instant Payment Notification (IPN) postback verification. Any unauthenticated attacker can send a forged IPN POST request to the plugin's payment handler, causing it to flip an arbitrary pending booking to a paid and confirmed state at a price of the attacker's choosing - enabling fraudulent travel reservations without payment. A publicly available proof-of-concept exists (reported by WPScan), and SSVC classifies the attack as automatable with partial technical impact, though no active exploitation is confirmed in the CISA KEV catalog.
IP spoofing via untrusted HTTP headers in WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 allows unauthenticated attackers to defeat the plugin's own brute-force login protection and downgrade its firewall by forging headers that match a hardcoded whitelisted IP range. The plugin fails to validate that IP-sourcing headers (such as X-Forwarded-For or X-Real-IP) originate from a trusted reverse proxy, making any client-controlled header a viable forgery vector. A publicly available proof-of-concept exists per WPScan's disclosure, though EPSS remains low (0.16%, 5th percentile) and no active exploitation has been confirmed in CISA KEV.
Missing authorization in Frontend Admin by DynamiApps WordPress plugin (versions before 3.29.7) exposes taxonomy term creation, modification, and deletion operations to any authenticated user, including Subscribers - the lowest WordPress role. Rooted in CWE-862 (Missing Authorization), the plugin's taxonomy management handlers execute without invoking WordPress capability checks, granting low-privilege accounts editor-level control over site taxonomy. A public POC is available via WPScan; however, EPSS sits at 0.14% (4th percentile) and no CISA KEV listing exists, suggesting limited real-world exploitation activity despite the accessible POC.
Unauthenticated integrity corruption in Points and Rewards for WooCommerce (versions before 2.10.1) allows remote attackers to arbitrarily modify or corrupt the wallet balance and loyalty points of any user account - including driving values negative - without possessing any credentials. The missing authorization check on a wallet/points update action fails to verify that the requester owns the targeted account, making cross-account manipulation trivially possible. A publicly available proof-of-concept exists per WPScan; the vulnerability is not currently listed in CISA KEV and carries a low EPSS score (0.15%, 4th percentile), suggesting exploitation has not yet been observed at scale.
RegistrationMagic WordPress plugin versions prior to 6.0.9.4 allows unauthenticated remote attackers to overwrite other users' front-end form submissions and the WordPress profile fields of the associated non-administrator accounts by exploiting absent authorization, ownership, and nonce validation on a submission-editing action. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction against any default plugin deployment. A public proof-of-concept exists per WPScan, though EPSS sits at 0.14% (4th percentile) and this CVE is not in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis.
Unauthorized access to other users' form submission data is possible in RegistrationMagic WordPress plugin versions prior to 6.0.9.4 due to missing OTP-to-identity binding validation. The plugin accepts a one-time password from a cookie without confirming it corresponds to the identity being requested, enabling unauthenticated network-based retrieval of personal information submitted through front-end registration forms. A publicly available exploit exists per WPScan, though EPSS at 0.14% (4th percentile) and the absence of a CISA KEV listing indicate exploitation has not been observed at scale.
Search Atlas SEO WordPress plugin (all versions before 2.6.12) exposes its Google Indexing API integration to any authenticated user - including low-privilege subscribers - due to a missing capability and nonce check in an AJAX handler. Any user with a valid WordPress session can invoke the plugin's Google Indexing API endpoint to submit or remove site URLs from Google's search index and exhaust the site's indexing API quota. A publicly available exploit exists via WPScan, though EPSS at 0.14% (4th percentile) and the absence of a CISA KEV listing indicate limited observed exploitation activity at this time.
The Appointment Booking Plugin for WordPress (all versions before 5.6.8) allows unauthenticated visitors to set privileged booking fields - including approval status - through the plugin's public booking funnel, silently bypassing the site's manual booking approval workflow. Any site relying on appointment approval as a gatekeeping mechanism can have that control subverted by any internet-accessible visitor with no credentials required. A publicly available proof-of-concept exists per WPScan; however, EPSS remains at 0.15% (5th percentile), indicating limited observed exploitation activity despite the trivially low attack complexity.
Bit Form WordPress plugin before version 3.1.2 fails to enforce form deactivation state on its public submission handlers, enabling unauthenticated network-accessible attackers to submit data to forms the site owner has intentionally disabled and trigger any configured backend workflows such as email notifications. The vulnerability carries a low CVSS score of 3.7 with AC:H, reflecting that exploitation requires knowledge of a specific deactivated form's endpoint, and real-world impact is limited to low integrity effects - spurious entries and unwanted workflow executions rather than data exfiltration or system compromise. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.15% (5th percentile) indicates exploitation has not meaningfully materialized across the wild.
Authenticated privilege escalation in the Sync Post With Other Site WordPress plugin (all versions before 1.9.3) allows any Contributor-level user to create, publish, and overwrite arbitrary Pages - including content authored by administrators - by exploiting an operator-precedence flaw in a REST route's authorization check. A public proof-of-concept is available via WPScan, though EPSS sits at 0.15% (5th percentile) and SSVC marks exploitation as non-automatable, suggesting opportunistic rather than widespread active exploitation. No CISA KEV listing exists at time of analysis.
Insecure direct object reference in the Easy Appointments WordPress plugin (all versions through 3.12.26) permits any authenticated subscriber-level user to retrieve personal information belonging to any appointment booking customer by iterating a customer identifier. The plugin fails to enforce ownership or capability checks before returning stored customer records, exposing PII across the entire customer base to the lowest-privileged WordPress role. No active exploitation is confirmed in CISA KEV, but a publicly available exploit exists via WPScan's disclosure, and EPSS sits at 0.15% - consistent with targeted rather than automated mass exploitation.
Improper access control in the Easy Appointments WordPress plugin through version 3.12.26 allows any contributor-level WordPress user to delete the site's booking configuration and functionally disable the appointment system. The vulnerable action handler performs neither a WordPress capability check nor nonce validation, meaning any authenticated user at or above contributor role can trigger the deletion without administrative approval. A publicly available exploit exists per WPScan, though EPSS at 0.15% (5th percentile) indicates limited observed exploitation; no CISA KEV listing is present.
Broken access control in the Easy Appointments WordPress plugin through version 3.12.26 permits any contributor-level authenticated user to perform privileged appointment-management actions - including reading all customer booking details and creating, modifying, or deleting appointments - without holding the required capabilities. The plugin relies exclusively on WordPress nonce verification as its authorization gate for these AJAX actions, but nonces are available to all authenticated users regardless of role and do not encode privilege level. A publicly available exploit exists per WPScan; no vendor patch has been identified at time of analysis.
Navigation restriction bypass in Google Chrome DevTools prior to version 151.0.7922.72 enables remote attackers to circumvent browser navigation controls by luring a user into opening a specially crafted malicious file. The flaw stems from CWE-20 insufficient input validation within the DevTools component, resulting in high integrity impact per CVSS. No public exploit has been identified and EPSS exploitation probability is very low at 0.16% (6th percentile); notably, the Chromium security team internally rated this 'Low' severity despite the medium NVD CVSS score of 6.5.
Cross-origin data leakage in Google Chrome's Speech component prior to version 151.0.7922.72 exposes sensitive information to attackers who have already achieved renderer process compromise. The vulnerability stems from insufficient policy enforcement in the Speech API, allowing a crafted HTML page to bypass cross-origin boundaries and exfiltrate data. With no CISA KEV listing, no public POC, and an EPSS of 0.16% (6th percentile), this is a low-probability exploitation scenario best understood as a potential second-stage component in a multi-vulnerability chain rather than a standalone attack.
Navigation restriction bypass in Google Chrome on macOS (versions prior to 151.0.7922.72) permits a local attacker to circumvent the browser's navigation controls by delivering a crafted malicious file. The CVSS vector (AV:L/I:H) confirms the impact is limited to integrity - an attacker who achieves local access can subvert Chrome's navigation security model without requiring elevated privileges or user interaction beyond obtaining local system access. With an EPSS score of 0.10% (1st percentile), no CISA KEV listing, and Chromium's own classification of Low severity, real-world exploitation risk is low despite the 6.2 CVSS base score.
Navigation restriction bypass in Google Chrome for Android (prior to 151.0.7922.72) originates from an inappropriate implementation in the browser's Media component, permitting a remote attacker to circumvent built-in navigation controls by delivering a crafted HTML page to a victim. The CVSS 4.3 score reflects a limited integrity-only impact - no code execution, no data exfiltration - and user interaction is required per the vector (UI:R). EPSS at 0.18% (8th percentile) and the absence of any KEV listing or public exploit indicate low real-world exploitation probability; Chromium's own internal severity rating of 'Low' is consistent with this assessment.
Navigation input validation bypass in Google Chrome prior to 151.0.7922.72 enables a renderer-compromised attacker to circumvent navigation restrictions via a crafted HTML page. The flaw is the second stage of a chained attack - exploitation requires a prior renderer process compromise, substantially raising the practical bar for abuse. No public exploit code or active exploitation has been identified; EPSS sits at 0.18% (8th percentile), consistent with its role as a post-exploitation primitive rather than an initial access vector.
Same-origin policy bypass in Google Chrome's Bluetooth subsystem (prior to 151.0.7922.72) can be triggered by an attacker who has already achieved renderer process compromise, using a crafted HTML page to abuse insufficient policy enforcement in the Web Bluetooth layer. The exploit chain requires a pre-existing foothold in the renderer, which limits real-world risk considerably - Chrome's own security team rated this 'Low' severity. No active exploitation has been confirmed (not listed in CISA KEV), and the EPSS score of 0.18% (8th percentile) reflects negligible observed exploitation activity.
Insufficient policy enforcement in Chrome's Speech component prior to version 151.0.7922.72 enables remote attackers to bypass site isolation - a core security boundary - via a crafted HTML page requiring only user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) signals high integrity impact with no privilege requirement, meaning an unrelated web page can be weaponized as the delivery vehicle. No public exploit code has been identified and EPSS sits at a low 0.18% (8th percentile), consistent with the Chromium team's own 'Low' severity classification despite the NVD medium score; however, the site isolation bypass class of vulnerability is historically sensitive and warrants prompt patching.
Same-origin policy bypass in Google Chrome's Cast component allows remote attackers to perform limited cross-origin integrity actions against victims who visit a crafted HTML page. All Chrome versions prior to 151.0.7922.72 are affected across Windows, macOS, and Linux. No active exploitation is confirmed (not in CISA KEV), no public exploit code has been identified, and Chromium's own internal severity rating is Low - signals that align with the very low EPSS score of 0.18% at the 8th percentile.
Insufficient policy enforcement in the Extensions subsystem of Google Chrome prior to 151.0.7922.72 allows an attacker to bypass discretionary access controls by deploying a malicious extension that uses a specially crafted domain name. The attack is fully dependent on social engineering - the victim must be convinced to install the malicious extension, which significantly constrains opportunistic exploitation. With a CVSS score of 4.3, EPSS at 0.12% (2nd percentile), no CISA KEV listing, and a 'Low' Chromium-internal severity rating, no public exploit identified at time of analysis, this represents a minimal real-world priority for most organizations, particularly those with enterprise extension management controls in place.
Navigation restriction bypass in Google Chrome's DevTools component (versions prior to 151.0.7922.72) allows a local attacker to circumvent browser navigation policies via a crafted HTML page. The insufficient policy enforcement within DevTools produces an integrity-high impact (CVSS I:H) without requiring attacker privileges. No public exploit code or CISA KEV listing exists; an EPSS score of 0.12% (2nd percentile) and Google's internal 'Low' Chromium severity rating together confirm this as a low immediate exploitation priority.
Navigation restriction bypass in Google Chrome on Android (prior to 151.0.7922.72) enables remote unauthenticated attackers to circumvent session-based navigation controls by inducing a victim to load a crafted HTML page. The root cause is an improper access control implementation (CWE-284) specific to Chrome's Session component on the Android platform. No public exploit has been identified at time of analysis, and CISA's SSVC framework rates exploitation as none with only partial technical impact, consistent with the low EPSS score of 0.18%.