Authentication Bypass

Authorization Bypass in Crocoblock JetPopup WordPress plugin through version 2.0.20.1 allows attackers to exploit incorrectly configured access control security levels via user-controlled keys, enabling unauthorized access to protected popup content and functionality. EPSS score of 0.04% indicates low exploitation probability despite the authorization flaw; no public exploit code or active exploitation has been identified.

Unrestricted file upload in code-projects College Notes Uploading System 1.0 allows authenticated low-privilege attackers to upload arbitrary files via the profile image function. A publicly available exploit exists, but EPSS exploitation probability is very low (0.05%, 15th percentile). Impact is limited to file manipulation without confirmed remote code execution.

Missing authorization in Plugin Optimizer WordPress plugin through version 1.3.7 allows attackers to exploit incorrectly configured access controls to perform unauthorized actions. The vulnerability stems from improper authentication validation (CWE-862), enabling attackers to bypass security restrictions without proper administrative privileges. While EPSS scoring (0.06%, 17th percentile) indicates low exploitation probability, the authentication bypass classification warrants prompt patching.

Unrestricted file upload vulnerability in News-Buzz 1.0 (part of the code-projects/anirbandutta9 Content Management System) allows authenticated administrators to upload arbitrary files via the image parameter of /admin/editposts.php. Public exploit code exists, but the EPSS exploitation probability is very low (0.05%), and no active exploitation has been confirmed. Successful exploitation could lead to remote code execution if combined with other weaknesses.

Authentication bypass in TaleLin Lin-CMS up to version 0.6.0 allows remote attackers to manipulate username and password arguments in the /tests/config.py Tests Folder component, potentially exposing credentials stored in the configuration file. The attack requires high complexity and has been publicly disclosed, but exploitation is considered difficult with an EPSS score of 0.04% indicating very low real-world exploitation probability.

Improper authentication bypass in xiaozhi-esp32-server-java up to version 3.0.0 allows remote attackers with low-privilege access to bypass cookie-based authentication via crafted requests. A public exploit exists, but no active exploitation has been confirmed, and the exploitation probability is low (EPSS 0.10%). The vulnerability affects the tryAuthenticateWithCookies method in the AuthenticationInterceptor component.

Unauthenticated remote access to ZKTeco BioTime's /base/safe_setting/ endpoint exposes stored credential material via manipulable backup_encryption_password_decrypt and export_encryption_password_decrypt parameters, affecting versions 9.0.3, 9.0.4, and 9.5.2. The CVSS 4.0 vector (PR:N/UI:N) and an 'Authentication Bypass' tag confirm no credentials or user interaction are required, enabling any network-reachable attacker to retrieve encryption passwords from the application. A public proof-of-concept exploit is available on GitHub, directly lowering the skill barrier for exploitation, though the vulnerability is not yet listed in CISA KEV.

Unrestricted file upload in jackq XCMS allows high-privilege authenticated users to upload arbitrary files via the ProductImageController component, with publicly available exploit code disclosed. Despite a CVSS score of 2.0 reflecting the high authentication requirement (PR:H), the vulnerability enables authenticated administrators to bypass intended upload restrictions and potentially achieve remote code execution by uploading malicious files. The vendor has been informed via public issue report but has not yet responded with a fix.

Unrestricted file upload in jackq XCMS allows unauthenticated remote attackers to upload arbitrary files via the plupload example script, leading to arbitrary code execution. The vulnerability affects all rolling-release installations up to commit 3fab5342 and has published exploit code. No vendor patch is available, and the project has not responded to reports.

IBM DS8000 enterprise storage arrays - DS8A00 (R10.0/R10.1) and DS8900F (R9.4) - expose immutable backup infrastructure to destruction by local users holding authorized CCW update permissions, due to missing authorization checks in IBM Safeguarded Copy and GDPS Logical corruption protection mechanisms. The flaw (CWE-862) allows a low-privileged operator to delete or corrupt protected backup snapshots that are specifically designed to survive ransomware and insider attacks. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the strategic risk in ransomware pre-staging scenarios is significant.

Improper authentication in Sim's CRON secret handler allows attackers to bypass authentication on internal APIs and CRON endpoints when required environment secrets are not configured. Publicly available exploit code exists, and the issue affects Sim versions up to 0.5.27. Attackers can remotely access sensitive internal operations by providing an empty or arbitrary secret token.

Authentication bypass in Alteryx Server's Gallery API status endpoint (/gallery/api/status/) allows remote, unauthenticated attackers to access restricted information and perform low-impact modifications. Public exploit code is available, but no active exploitation or CISA KEV listing has been observed. EPSS score of 0.03% indicates low likelihood of widespread attacks.

Privilege escalation in Eclipse BlueChi, the multi-node systemd service controller used in Red Hat In-Vehicle Operating System (RHIVOS), allows a user holding root on a managed quality-managed (qm) node to write or override systemd service unit files that execute on the controlling host node. Because BlueChi did not deny cross-node proxy/dependency requests by default, a compromised lower-trust node could pivot to the host, leading to unauthorized service execution and full host compromise (CWE-863, Incorrect Authorization). Red Hat scored it 7.2 (High); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Missing authorization in the Userpro WordPress plugin versions up to 5.1.9 allows unauthenticated attackers to modify plugin settings or user data via a crafted HTTP request. The vulnerability arises from incorrectly configured access control security levels, with integrity impact only. No public exploit or active exploitation has been identified at time of analysis.

Missing authorization in the Editorial Calendar WordPress plugin allows authenticated attackers with low privileges to view and modify editorial calendar data. Versions up to 3.8.8 are affected. While active exploitation is not confirmed and exploit code is not publicly available, patching is advised.

Unauthenticated information disclosure in the Bit Assist plugin for WordPress (versions up to 1.5.11) allows remote attackers to read potentially sensitive data due to missing authorization checks on certain endpoints. No proof-of-concept exploit code or active exploitation has been publicly reported at this time; the EPSS exploitation probability is 0.06%.

Broken access control in Trustindex Widgets for Social Photo Feed (WordPress plugin) through version 1.8 allows authenticated attackers with low privileges to bypass authorization controls and execute high-impact actions. The vulnerability has low attack complexity (CVSS:3.1 AV:N/AC:L/PR:L) enabling compromise of confidentiality, integrity, and availability. EPSS score of 0.06% (18th percentile) indicates relatively low observed exploitation probability, and no public exploit or CISA KEV listing exists at time of analysis, suggesting this remains a patch-priority issue rather than an active threat.

Broken access control in Opinion Stage Poll, Survey & Quiz Maker Plugin for WordPress versions through 19.12.0 allows authenticated attackers with low-level privileges to bypass authorization checks and access or modify high-sensitivity data. The vulnerability (CWE-862: Missing Authorization) enables privilege escalation through improperly configured access control mechanisms. EPSS probability is low at 0.04% (13th percentile), and no public exploit identified at time of analysis, though authentication bypass tags indicate established attack patterns exist for this vulnerability class.

Missing authorization in WP Adminify plugin for WordPress (<=4.0.6.1) allows authenticated low-privileged users to modify plugin configurations without permission, impacting site integrity and availability. No active exploitation or public exploit code has been reported, and EPSS indicates a low probability of exploitation (0.06%). Exploitation requires a valid user account but no high-level access, making it a moderate risk once authenticated.

Privilege escalation via missing authorization in WP Adminify for WordPress allows authenticated low-privilege users to read sensitive information. Remote attackers can exploit this without user interaction, leading to limited confidential data disclosure. No active exploitation has been reported and EPSS indicates low probability of exploitation (0.06%).

Missing authorization in Simple File List WordPress plugin 6.1.18 and earlier allows authenticated low-privilege users to bypass access controls and gain unauthorized read/write access to file list data. Tagged as an authentication bypass vulnerability with EPSS score of 0.04% (13th percentile), indicating low observed exploitation probability. No active exploitation confirmed (not in CISA KEV), and no public exploit code identified at time of analysis.

Broken access control in WP Telegram Widget and Join Link plugin versions up to 2.2.12 allows authenticated users with low privileges to bypass authorization checks and access high-sensitivity configuration or data. The vulnerability enables unauthorized read and write operations (CVSS C:H/I:H) without requiring user interaction. EPSS score of 0.04% suggests low observed exploitation probability, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Access control bypass in TS Poll WordPress plugin (versions ≤2.5.5) allows low-privileged authenticated users to escalate privileges and gain unauthorized read/write access to poll data. Attackers with basic subscriber accounts can exploit misconfigured authorization checks to access or modify content beyond their intended permission level. EPSS exploitation probability is low (0.04%, 13th percentile), with no public exploit identified at time of analysis, suggesting limited immediate risk despite the 8.1 CVSS score.

Missing authorization check in Watu Quiz plugin for WordPress up to version 3.4.5 permits authenticated low-privilege users to perform unauthorized modifications, such as altering quiz content or settings. The flaw stems from incorrectly configured access control security levels, allowing attackers with subscriber or contributor roles to bypass intended restrictions. No active exploitation has been reported, and EPSS indicates low likelihood of widespread attacks.

Broken access control in Cooked WordPress plugin versions ≤1.11.3 allows authenticated attackers with low-level privileges to bypass authorization checks and gain unauthorized access to high-privilege functions. The vulnerability stems from missing authorization validation (CWE-862), enabling privilege escalation and unauthorized data manipulation. With CVSS 8.8 and EPSS probability of 0.06% (18th percentile), real-world exploitation risk is moderate; no public exploit identified at time of analysis.

Missing authorization in WP Document Revisions plugin ≤3.7.2 allows authenticated high‑privilege users to bypass access controls and modify document data without proper authorization. The vulnerability carries Low severity (CVSS 2.7) due to the high permission level required and limited integrity impact. No active exploitation or public exploit is currently known.

Missing authorization in the Funnelforms Free plugin for WordPress (versions up to 3.8) allows unauthenticated attackers to modify plugin data due to incorrectly configured access control. The vulnerability (CWE-862) has a CVSS 5.3 rating with low integrity impact only; no confidentiality or availability is affected. At the time of analysis, there is no evidence of active exploitation and the EPSS score is low (0.06%), indicating limited urgency.

Missing authorization in YITH Slider for page builders (WordPress plugin) allows authenticated low-privileged attackers to view and modify slider content without proper permission checks. Patches are implied in versions beyond 1.0.11. No active exploitation or public exploit code is currently known.

Unauthorized modification of data in the WordPress FV Simpler SEO plugin versions up to and including 1.9.6 allows unauthenticated attackers to change plugin settings due to missing authorization checks. This vulnerability, reported by Patchstack, has a low predicted exploitation probability (EPSS 0.04%) and no public exploit or active exploitation identified at time of analysis.

Unauthorized data modification via missing authorization in the Addonify Quick View WordPress plugin (<= 2.0.4) allows remote, unauthenticated attackers to alter plugin settings or content due to missing capability checks on an AJAX endpoint. No active exploitation or public exploit code is known, and EPSS assigns a very low exploitation probability (0.04%).

Missing authorization in the Virusdie WordPress plugin (≤ 1.1.6) allows authenticated low-privilege users to exploit incorrectly configured access controls, potentially leading to unauthorized changes to plugin settings. The vulnerability is not known to be actively exploited, with a low EPSS score (0.06%), and no public exploit code has been identified at time of analysis.

Authorization bypass in Wappointment WordPress plugin versions ≤2.7.6 enables low-privileged authenticated attackers to perform unauthorized actions with high impact to confidentiality, integrity, and availability. The vulnerability stems from missing authorization checks (CWE-862), allowing authenticated users to access or modify data beyond their intended permission level. EPSS score of 0.06% (18th percentile) indicates low observed exploitation probability, and no confirmed active exploitation (CISA KEV) or public exploit code is identified at time of analysis.

Unauthenticated missing authorization flaw in the BBP Core WordPress plugin (versions ≤1.4.1) allows attackers to modify certain data with low integrity impact. No confidentiality is exposed. The flaw, assigned CWE-862, has a CVSS base score of 5.3 (Medium) but is not actively exploited.

Broken access control in SALESmanago WordPress plugin allows authenticated attackers with low-level privileges to bypass authorization checks and gain unauthorized access to high-privilege functions. Affects versions up to 3.9.0. The vulnerability enables complete compromise of confidentiality, integrity, and availability within the plugin's scope. EPSS score of 0.06% (18th percentile) suggests low observed exploitation probability, and no public exploit identified at time of analysis.

Broken access control in WP Time Slots Booking Form plugin (≤1.2.39) allows authenticated attackers with low-level privileges to escalate permissions and execute unauthorized administrative actions. The vulnerability stems from missing authorization checks (CWE-862), enabling privilege escalation to access, modify, or delete sensitive booking data and configuration settings. While CVSS scores 8.8 (High), real-world risk appears moderate with EPSS at 0.06% (18th percentile) and no public exploit identified at time of analysis.

Missing authorization in Claspo WordPress plugin through version 1.0.7 allows unauthenticated remote attackers to modify data via incorrectly configured access controls. With CVSS 7.5 (High integrity impact) but only 0.04% EPSS probability, this represents elevated exposure in vulnerable installations despite low observed exploitation likelihood. No public exploit identified at time of analysis, though the authentication bypass tag indicates potential for unauthorized actions without credentials.

Missing authorization in Twitch Player WordPress plugin (ttv-easy-embed-player) versions up to 2.1.3 allows remote unauthenticated attackers to trigger a denial-of-service condition via exploitation of incorrectly configured access control security levels. This CWE-862 vulnerability impacts only availability and has no confidentiality or integrity impact. No active exploitation or public exploit code is confirmed at this time; EPSS indicates a 0.06% probability of exploitation in the next 30 days.

Unauthorized modification possible in the Sunshine Photo Cart WordPress plugin up to version 3.5.7.1 due to missing authorization checks. Authenticated low-privileged users can exploit misconfigured access controls to alter data they should not have access to. No active exploitation or public exploit is known, and EPSS indicates a 0.04% probability of exploitation in the next 30 days.

Authenticated data modification in the Spiffy Calendar WordPress plugin allows low-privilege attackers to edit calendar events without proper authorization. The vulnerability affects all plugin versions up to and including 5.0.7. No active exploitation or public exploit code has been observed, and EPSS indicates a negligible chance of widespread exploitation.

Information disclosure in WpStream plugin for WordPress up to version 4.9.5 allows authenticated low-privileged users to read sensitive configuration data due to a missing authorization check (CWE-862). The vulnerability requires a subscriber-level account and exposes limited confidentiality information without affecting integrity or availability. No active exploitation or public exploit code has been identified at time of analysis.

Low-integrity unauthorized modification in WpStream plugin ≤4.9.5 allows unauthenticated remote attackers to alter plugin functionality via missing authorization checks. The vulnerability, classified as CWE-862 Missing Authorization, enables attackers to exploit incorrectly configured access control levels, potentially changing streaming settings or data without any user interaction. No public exploit or active exploitation has been confirmed, and EPSS score is very low (0.06%).

Missing authorization in the Tablesome WordPress plugin allows authenticated low-privilege users to modify or disrupt plugin data. Affected versions up to 1.1.35.1; no active exploitation or public exploit identified at this time.

Missing authorization in Gutenverse Form plugin for WordPress allows authenticated attackers with low privileges to bypass access controls and perform unauthorized actions, resulting in a high availability impact. Versions up to and including 2.3.1 are affected, and no active exploitation has been reported.

Missing authorization in the Brave Popup Builder WordPress plugin (version <= 0.8.3) allows unauthenticated attackers to access functionality not properly restricted by access controls. Exploitation could lead to disclosure of sensitive information with no user interaction required. EPSS suggests a very low exploitation probability (0.04%) and no public exploit code has been identified.

Unauthenticated information disclosure in the H5P WordPress plugin up to version 1.16.1 allows remote attackers to access sensitive data due to missing authorization checks. No authentication is required, but only low confidentiality impact is expected. No public exploit has been identified, and exploitation is not known to be active.

Authorization bypass in WP Swings Membership For WooCommerce up to 3.0.3 allows unauthenticated attackers to manipulate membership features via user-controlled keys, resulting in service disruption. The flaw does not expose or modify data but can cause a high availability impact. No active exploitation or public exploit code has been confirmed at the time of analysis, and EPSS probability is low (0.04%).

Missing Authorization vulnerability in bnayawpguy Resoto resoto allows Exploiting Incorrectly Configured Access Control Security Levels.0.8. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Unauthenticated file upload vulnerability in code-projects Student File Management System 1.0 allows authenticated remote attackers to bypass file upload restrictions via manipulation of the File parameter in /save_file.php, despite the CVSS v4.0 score of 2.1 reflecting only low confidentiality, integrity, and availability impact with no scope change. The exploit is publicly available and the low EPSS score (0.09%, 25th percentile) suggests limited real-world exploitation attempts despite public disclosure.

Certificate-validation bypass in Eclipse Cyclone DDS before 0.10.5 lets unauthenticated network attackers defeat the DDS Security authentication plugin's certificate checks, and per the advisory execute commands with System privileges. The flaw stems from improper verification of certificate time/expiration (CWE-298), meaning expired or otherwise time-invalid certificates can be accepted as valid, enabling impersonation of trusted DDS participants. The EPSS score is low (0.30%, 22nd percentile) and there is no CISA KEV listing, so despite the maximal 10.0 CVSS there is no confirmed active exploitation at time of analysis.

Chakra test WordPress plugin version 1.0.1 and earlier fails to properly enforce access control restrictions, allowing unauthenticated or lower-privileged users to bypass authentication mechanisms and access restricted functionality. The vulnerability stems from incorrectly configured security levels that do not validate user permissions before executing sensitive operations, and is tracked with an exceptionally low EPSS score (0.04%) despite the missing authorization flaw, suggesting limited real-world exploitation despite the theoretical risk.

Missing authorization controls in VillaTheme HAPPY helpdesk plugin versions up to 1.0.9 allow unauthenticated attackers to bypass access restrictions and interact with support ticket functionality without proper permission verification. This authentication bypass vulnerability affects WordPress installations using the vulnerable plugin and could permit unauthorized access to sensitive support tickets and helpdesk operations. The issue has been reported by Patchstack security researchers with a low EPSS exploitation probability (0.04%) despite the authorization flaw.

Unauthenticated attackers can access private, draft, and pending template content in Premium Addons for Elementor WordPress plugin (versions up to 4.11.53) due to a missing capability check in the 'get_template_content' function. This authentication bypass allows unauthorized disclosure of sensitive template data without requiring user interaction or special privileges. A vendor patch is available, and the vulnerability carries a moderate CVSS score of 5.3 with low technical impact but confirmed accessibility to restricted resources.

GetStreamUri ONVIF endpoint in Xiongmai XM530 IP cameras exposes RTSP video streams with hardcoded credentials, allowing remote unauthenticated attackers to view live camera feeds without authentication. Affects firmware version V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06. Publicly available exploit code exists demonstrating credential extraction and direct stream access. EPSS data not available, but the combination of network-accessible attack vector (AV:N), no authentication requirement (PR:N), and public POC creates immediate risk for exposed internet-facing cameras.

Unauthenticated access to live video and device data affects Xiongmai XM530-based IP cameras running firmware V5.00.R02.000807D8.10010.346624.S with ONVIF 21.06, where the ONVIF service fails to enforce authentication on 31 endpoints. Any remote attacker who can reach the camera's ONVIF port can pull sensitive device information and view real-time RTSP/ONVIF video streams without credentials. Publicly available exploit code exists, though the flaw is not listed in CISA KEV and EPSS is modest (0.85%, 54th percentile).

Full administrative takeover of ClipBucket 5.5.2 is possible because the video-sharing platform ships with hardcoded default administrative credentials, letting any unauthenticated remote attacker sign into the admin panel and control the entire application. Publicly available exploit material (a Medium write-up) documents the attack, and the CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N). This is a network-reachable, no-interaction flaw, though EPSS is modest at 0.57% (43rd percentile) and it is not currently listed in CISA KEV.

ChestnutCMS up to version 1.5.8 allows authenticated remote attackers to upload arbitrary files by manipulating the File argument in the FilenameUtils.getExtension function of the /dev-api/common/upload endpoint. The vulnerability bypasses filename extension validation in the Filename Handler component, enabling unrestricted file uploads with low integrity and confidentiality impact. Publicly available exploit code exists; however, the low EPSS score (0.06%) and requirement for prior authentication significantly limit real-world exploitation risk compared to the CVSS base score.

Missing Authorization vulnerability in HappyFiles HappyFiles Pro happyfiles-pro allows Exploiting Incorrectly Configured Access Control Security Levels.8.1. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Missing Authorization vulnerability in HappyFiles HappyFiles Pro happyfiles-pro allows Exploiting Incorrectly Configured Access Control Security Levels.8.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Missing Authorization vulnerability in Mapro Collins Magazine Edge magazine-edge allows Exploiting Incorrectly Configured Access Control Security Levels.13. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Unauthenticated attackers can retrieve sensitive Google API keys from the Pretty Google Calendar WordPress plugin (versions up to 2.0.0) by exploiting a missing capability check in the pgcal_ajax_handler() AJAX function. The vulnerability allows direct read access to configured API credentials without authentication, enabling credential harvesting for downstream API abuse. No public exploit code or active exploitation has been confirmed at time of analysis; however, the low CVSS score (5.3) and very low EPSS percentile (21%) reflect that while the vulnerability is real, real-world exploitation likelihood remains minimal due to the ease of detection and limited direct impact compared to data exfiltration or system compromise.

Missing authentication on the HTTPS connectAP interface in TP-Link Tapo C200 V3 firmware (versions 1.3.3 through 1.4.1) allows adjacent network attackers to remotely reconfigure device Wi-Fi settings, causing permanent denial-of-service until manual intervention. The vulnerability exploits CWE-306 (Missing Authentication for Critical Function) with CVSS 8.7 severity, requiring only adjacent network access with low attack complexity and no user interaction. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the technical barrier is minimal for LAN-positioned adversaries.

Galette membership management application versions 0.9.6 through 1.1.x contain an authorization bypass allowing group managers to escalate privileges and modify data beyond their intended role scope. The vulnerability requires authenticated access as a group manager and affects the integrity of membership data and organizational controls. Galette 1.2.0 resolves the issue; affected deployments should upgrade immediately to restore proper role-based access controls.

Account linkage via Cross-Site Request Forgery (CSRF) in fastapi-sso before 0.19.0 allows attackers to trick a victim into visiting a malicious callback URL that links the attacker's OAuth provider account to the victim's internal application account, granting the attacker unauthorized access. The vulnerability stems from missing state parameter validation during OAuth callback processing. A public proof-of-concept exists, but no active exploitation has been confirmed.

Authentication bypass in JeecgBoot up to version 3.9.0 allows authenticated remote attackers to manipulate tenant ID arguments in the SysTenantController, resulting in improper authentication checks that grant unauthorized access to other tenants' data. The vulnerability has a low CVSS score of 2.1 but publicly available exploit code exists, suggesting active researcher interest despite minimal real-world impact signals (EPSS 0.32%, low severity scope). Exploitation requires prior authentication and produces only limited information disclosure within the multi-tenant architecture.

Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 allow anyone who can reach the database port to authenticate with full read/write access to the backend datastore. Publicly available exploit code exists, though EPSS remains low (0.81%) and the vendor states the database port is not network-exposed by default in 1.0.1 and later, limiting realistic reach. There is no public exploit identified as actively used in the wild (not in CISA KEV).

Unrestricted file upload in SourceCodester Client Database Management System 1.0 via the /user_leads.php endpoint in the Leads Generation Module allows authenticated remote attackers to upload arbitrary files. The vulnerability requires valid user credentials (PR:L in CVSS v4.0) but carries low confidentiality, integrity, and availability impact per the vector. Public exploit code exists, and EPSS score of 0.06% suggests minimal real-world exploitation despite public availability, likely due to the authenticated requirement limiting attack surface.

Missing authorization in PickPlugins Post Grid and Gutenberg Blocks WordPress plugin (versions through 2.3.17) allows attackers to bypass access control restrictions and exploit incorrectly configured security levels, potentially enabling unauthorized access to protected content or administrative functions. The vulnerability stems from broken access control (CWE-862) with no public exploit code confirmed at time of analysis, though EPSS scoring of 0.04% suggests minimal real-world exploitation probability despite the authorization flaw.

Authorization bypass in RadiusTheme Radius Blocks WordPress plugin through version 2.2.1 allows attackers to exploit incorrectly configured access control security levels via user-controlled keys, enabling unauthorized access to restricted functionality. The vulnerability is classified as an insecure direct object reference (IDOR) issue affecting the plugin's access control implementation. While no CVSS score is available and EPSS indicates low exploitation probability (0.04%), the vulnerability demonstrates a fundamental authentication design flaw that could permit escalation of privileges within WordPress installations using this plugin.

Authentication bypass in AmentoTech Tuturn plugin for WordPress versions before 3.6 allows remote, unauthenticated attackers to abuse authentication mechanisms and gain privileged access to plugin functionality and potentially the entire WordPress site. No public exploit or active exploitation is identified at this time, and the likelihood of exploitation is rated low according to EPSS (0.12%).

Authorization bypass in PickPlugins Post Grid and Gutenberg Blocks WordPress plugin through version 2.3.23 allows attackers to exploit incorrectly configured access control via user-controlled keys, potentially enabling unauthorized access to post content or plugin functionality. The vulnerability is classified as CWE-639 (Authorization Through User-Controlled Key) and presents a low exploitation probability (EPSS 0.04%, 13th percentile) with no public exploit code or active exploitation confirmed at time of analysis.

Sermon Manager for WordPress plugin through version 2.30.0 allows unauthenticated attackers to exploit missing authorization checks to access or modify sermon data due to incorrectly configured access control security levels. The vulnerability stems from CWE-862 (Missing Authorization) and affects all installations running the vulnerable version range. With an EPSS score of 0.04% (13th percentile), real-world exploitation probability is minimal despite the permission-based nature of the flaw.

Missing authorization controls in Sparkle FSE WordPress theme versions 1.0.9 and earlier allow unauthenticated attackers to bypass access control restrictions and perform unauthorized actions through exploitable endpoint misconfigurations. This authentication bypass vulnerability, reported by Patchstack security researchers, affects all instances of the Sparkle FSE theme up to version 1.0.9 with low exploit probability (EPSS 0.05%) but represents a direct authorization failure (CWE-862) that could enable unauthorized data access or modification depending on endpoint exposure.

Missing authorization controls in sparklewpthemes Construction Light WordPress theme versions 1.6.7 and earlier allow unauthenticated attackers to bypass access restrictions and access resources that should be protected by role-based access control. The vulnerability stems from incorrectly configured access control security levels, potentially exposing sensitive functionality or data to unauthorized users.

Hard-coded credentials in Utarit Informatics SoliClub Android application versions prior to 5.3.7 allow remote unauthenticated attackers to abuse authentication and access confidential data. The flaw is tracked under CWE-798 with a CVSS 7.5 (high) confidentiality-only impact, and currently shows no public exploit identified at time of analysis with a low EPSS score of 0.06% (18th percentile).

Missing authorization controls in the SoliClub Android application (all versions before 5.3.7) allow authenticated low-privilege users to abuse their access and read data beyond their authorization level. The vulnerability, classified as CWE-862, exposes the application to privilege abuse where role or resource-level access checks are absent on one or more network-accessible functions. No public exploit code exists and EPSS stands at 0.03% (10th percentile), indicating no meaningful observed exploitation activity; this is not listed in CISA KEV.

Authorization bypass in Utarit Informatics SoliClub Android application versions 5.2.4 through 5.3.6 allows remote unauthenticated attackers to access or manipulate other users' data by tampering with user-controlled identifiers (IDOR). The flaw enables functionality misuse with high impact on confidentiality (CVSS 7.5), though no public exploit identified at time of analysis and EPSS exploitation probability is very low at 0.04%.

Information disclosure in Utarit Informatics SoliClub Android app versions 5.2.4 through 5.3.6 allows remote unauthenticated attackers to query the system and retrieve private personal information belonging to other users. The flaw stems from inadequate access controls on a query interface, and while CVSS rates it 7.5 (High), the EPSS probability of exploitation is very low (0.04%, 13th percentile) and no public exploit identified at time of analysis.

Hard-coded credentials in Utarit Information Services SoliClub Android app (versions 5.2.4 through 5.3.7) allow remote unauthenticated attackers to read sensitive constants embedded within the executable. The flaw was reported by Turkey's national CERT (USOM) and carries a CVSS 7.5 with high confidentiality impact but no integrity or availability effect; no public exploit identified at time of analysis and EPSS is very low at 0.04%.

Unauthenticated access to sensitive data in Ays Pro Easy Form plugin for WordPress up to version 2.7.8 allows remote attackers to obtain information due to a missing authorization check. This vulnerability has a CVSS 7.5 base score, but EPSS indicates low exploitation probability (0.05%). No active exploitation (CISA KEV) or public exploit code exists at time of analysis.

Denial of service in the WordPress Offload, AI & Optimize with Cloudflare Images (cf-images) plugin up to version 1.9.5 allows low-privilege authenticated users to disrupt service availability through missing authorization checks. Any authenticated subscriber or similar low-level role can trigger the flaw to degrade or crash the service. No active exploitation or public PoC is known, and EPSS indicates a very low probability of real-world attacks.

Sensitive information disclosure in Magnigenie RestroPress WordPress plugin versions up to 3.2.3.5 allows authenticated attackers with low privileges to access restricted data via a missing authorization check. This vulnerability, tracked as CVE-2025-66100, has no known public exploit or active exploitation, and EPSS estimates a low probability of exploitation.

Unauthenticated information disclosure in PropertyHive plugin (≤2.1.12) allows remote attackers to access sensitive property data without authentication. The vulnerability stems from missing authorization checks on certain endpoints, effectively bypassing access controls. No active exploitation or public exploit code has been identified; EPSS score is very low.

Missing authorization in wpForo Forum up to version 2.4.10 allows remote unauthenticated attackers to access restricted forum content due to incorrectly configured access control security levels. The vulnerability is in the WordPress plugin and does not require user interaction; it results in high confidentiality impact with no integrity or availability effects. No active exploitation or public exploit code is known, and EPSS score of 0.05% indicates low exploitation likelihood.

Missing authorization in InstaWP Connect for WordPress up to version 0.1.1.9 allows unauthenticated attackers to modify and disrupt site content (low integrity and availability impact). The vulnerability stems from an incorrectly configured access control security level, leaving sensitive plugin functions exposed without proper capability checks. At the time of analysis, no evidence of active exploitation or public proof-of-concept exists, and EPSS indicates a low probability of widespread exploitation.

Unauthenticated information disclosure in LearnPress for WordPress up to version 4.2.9.4 enables remote attackers to read sensitive data by bypassing missing authorization checks. Exploitation requires no credentials or user interaction, but no public exploit or active exploitation has been identified. EPSS score of 0.05% indicates very low probability of real-world attacks.

Insufficient access control in the ListingPro WordPress theme before version 2.9.10 allows authenticated attackers with low privileges to read high-sensitivity data and modify limited content. The vulnerability has a low EPSS exploitation probability (0.05%) and no public exploit or active exploitation is currently reported.

Unauthorized data modification in WP Social Ninja WordPress plugin ≤ 3.20.1 allows remote unauthenticated attackers to alter plugin data or partially disrupt availability due to missing authorization checks on certain endpoints. The vulnerability carries a CVSS base score of 6.5 with low integrity and availability impact, and EPSS data predicts a very low exploitation probability (0.05%). No public exploit code or active exploitation has been identified at time of analysis.

Authenticated attackers with low-level privileges can bypass access controls in GetResponse Official plugin for WordPress (versions <=1.5.3) to modify sensitive data, resulting in a high integrity impact. The vulnerability arises from missing authorization checks in the plugin’s endpoint handling, permitting unauthorized alteration of settings or subscription data. The risk is moderate; the issue is not listed in CISA KEV and has a low exploitation prediction score, with no public exploit confirmed.

Arbitrary content deletion vulnerability in FantasticPlugins WooCommerce Recover Abandoned Cart plugin versions up to 24.6.0. Unauthenticated remote attackers can exploit missing authorization to delete arbitrary WordPress content, with no privileges or user interaction required. At time of analysis, no public exploit or active exploitation is known (EPSS 0.06%), though the issue has been disclosed by Patchstack.

Unauthenticated content deletion in MasterStudy LMS Pro WordPress plugin allows remote attackers to delete arbitrary learning content, causing complete availability loss. The vulnerability (CVE-2025-64214) affects versions up to 4.7.16, requires no authentication or user interaction