Prolancer Element
Monthly
SQL injection in the ProLancer Element WordPress plugin (≤1.4.8) enables subscriber-level authenticated users to execute arbitrary SQL queries against the WordPress database, with a scope change indicating access beyond the plugin's own data boundary. Reported by Patchstack and corroborated by ENISA EUVD-2026-64799, the flaw requires only the lowest WordPress user role, making it exploitable on any site with open subscriber registration. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in the ProLancer Element WordPress plugin (themebing) affects all versions up to and including 1.4.8, allowing any authenticated subscriber-level user to invoke privileged plugin functionality without proper authorization. The flaw stems from missing authorization checks (CWE-862), yielding high integrity impact and low availability impact against affected WordPress installations. No active exploitation or public exploit code has been identified at time of analysis; Patchstack has published the disclosing advisory.
SQL injection in the ProLancer Element WordPress plugin (≤1.4.8) enables subscriber-level authenticated users to execute arbitrary SQL queries against the WordPress database, with a scope change indicating access beyond the plugin's own data boundary. Reported by Patchstack and corroborated by ENISA EUVD-2026-64799, the flaw requires only the lowest WordPress user role, making it exploitable on any site with open subscriber registration. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in the ProLancer Element WordPress plugin (themebing) affects all versions up to and including 1.4.8, allowing any authenticated subscriber-level user to invoke privileged plugin functionality without proper authorization. The flaw stems from missing authorization checks (CWE-862), yielding high integrity impact and low availability impact against affected WordPress installations. No active exploitation or public exploit code has been identified at time of analysis; Patchstack has published the disclosing advisory.