Teddy Bear Customize Addon
Monthly
Unauthenticated remote code execution in the Teddy Bear Customize Addon WordPress plugin (all versions through 1.0.5) allows attackers to upload arbitrary PHP files to the server and execute code. The plugin's upload handler trusts the client-supplied MIME/content type and preserves the original attacker-controlled filename, so a request declaring an image content type while carrying a .php payload lands as an executable script in the webroot. Publicly available exploit details have been published by WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.
Authentication bypass in the Teddy Bear Customize Addon WordPress plugin (through version 1.0.5) lets unauthenticated attackers log in as any registered user - including administrators - by supplying only that user's email address, because the login routine never verifies the account password. WPScan reports a publicly available exploit, and with CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) this is a trivially weaponizable full account-takeover; no active-exploitation (KEV) listing exists at this time.
Unauthenticated information disclosure in the Teddy Bear Customize Addon WordPress plugin through version 1.0.5 exposes WooCommerce order metadata and customer-uploaded file attachment URLs to any network attacker without credentials. The plugin's data-return endpoints implement no authorization or ownership checks whatsoever, enabling an attacker to enumerate and retrieve private order records and attachment links belonging to arbitrary customers. Publicly available exploit code exists via WPScan; the same plugin also carries a separate RCE vulnerability (CVE-2026-14560), making immediate removal or patching urgent.
Unauthenticated remote code execution in the Teddy Bear Customize Addon WordPress plugin (all versions through 1.0.5) allows attackers to upload arbitrary PHP files to the server and execute code. The plugin's upload handler trusts the client-supplied MIME/content type and preserves the original attacker-controlled filename, so a request declaring an image content type while carrying a .php payload lands as an executable script in the webroot. Publicly available exploit details have been published by WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.
Authentication bypass in the Teddy Bear Customize Addon WordPress plugin (through version 1.0.5) lets unauthenticated attackers log in as any registered user - including administrators - by supplying only that user's email address, because the login routine never verifies the account password. WPScan reports a publicly available exploit, and with CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) this is a trivially weaponizable full account-takeover; no active-exploitation (KEV) listing exists at this time.
Unauthenticated information disclosure in the Teddy Bear Customize Addon WordPress plugin through version 1.0.5 exposes WooCommerce order metadata and customer-uploaded file attachment URLs to any network attacker without credentials. The plugin's data-return endpoints implement no authorization or ownership checks whatsoever, enabling an attacker to enumerate and retrieve private order records and attachment links belonging to arbitrary customers. Publicly available exploit code exists via WPScan; the same plugin also carries a separate RCE vulnerability (CVE-2026-14560), making immediate removal or patching urgent.