Authentication Bypass

Missing authorization checks in the ListingPro WordPress theme (<=2.9.9) enable authenticated users with low privileges to modify data without proper access validation. This broken access control flaw (CWE-862) has a CVSS 6.5 (High integrity impact) and currently no public exploit or active exploitation evidence.

Missing authorization in the WP Voting Contest WordPress plugin (versions ≤5.8) allows unauthenticated attackers to manipulate voting data without any prior authentication. The vulnerability carries a CVSS 7.5 but has a low EPSS score (0.06%), indicating limited observed exploitation activity as of analysis.

Missing authorization controls in Parallax Section block ≤1.0.9 allow authenticated low-privileged WordPress users to access administrative functionality, leading to high impact on availability and low integrity impact with no data exposure. An attacker with a subscriber or contributor account can disrupt site availability and partially modify content without proper capability checks. Reported by Patchstack, this vulnerability carries a CVSS 7.1 but shows no evidence of active exploitation or public exploit code.

Unauthenticated attackers can modify IDonatePro WordPress plugin data (integrity impact high) due to missing authorization checks in versions up to 2.1.9. Exploitation requires no privileges or user interaction and is carried out over the network. At the time of analysis, no active exploitation, public exploit code, or CISA KEV listing exists; EPSS score is low (0.07%).

Unauthenticated arbitrary content deletion in the Javo Core WordPress plugin up to version 3.0.0.529 can allow attackers to delete site content, causing a complete loss of data availability. The missing authorization vulnerability carries a CVSS 3.1 score of 7.5 with low EPSS exploitation probability, and no active exploitation or public proof-of-concept has been identified at the time of analysis.

Missing authorization in the Download After Email WordPress plugin versions 2.1.5 through 2.1.6 allows unauthenticated attackers to bypass access controls and access protected downloads intended for users who submit their email. The vulnerability has a CVSS base score of 5.8 (medium) but EPSS exploitation probability is very low (0.08%), and no public exploit or active exploitation has been reported.

Super Blank WordPress plugin versions up to 1.2.0 are vulnerable to missing authorization, allowing authenticated attackers with low privileges to delete arbitrary content. This can result in complete loss of site content availability; no active exploitation has been detected, and the EPSS likelihood is very low.

Unauthenticated modification of login page design in the Login Page Customizer WordPress plugin (<=2.1.1) allows remote attackers to alter the site's login and admin page customizations due to missing authorization checks. The vulnerability has low integrity and availability impact, and EPSS indicates very low exploitation probability with no known active exploitation or public exploit code.

Unauthenticated missing authorization in The African Boss Get Cash WordPress plugin up to 3.2.3 allows remote attackers to modify plugin data and potentially disrupt cash-related functionality without any prior access. The vulnerability carries a Medium severity with low EPSS exploitation likelihood, and no active exploitation or public PoC has been reported.

Authorization bypass in the Contact Form Email plugin for WordPress (versions <= 1.3.60) enables unauthenticated attackers to modify or remove contact form entries by manipulating user-controlled key values, with no confidentiality impact. No user interaction required, and the vulnerability is exploitable remotely, though EPSS indicates a low probability of widespread exploitation.

Gatekeeper bypass in Apple macOS allows a locally-executing app with standard user privileges to circumvent Apple's code-signing and notarization enforcement mechanism, enabling unsigned or untrusted software to run without expected security warnings or blocks. Affected versions include all macOS releases prior to Sequoia 15.7.4 and Tahoe 26.2, per Apple's security advisories. No public exploit code or active exploitation has been confirmed at time of analysis; however, the C:H/I:H/A:H CVSS impact triad reflects that successful bypass can lead to full system compromise via malicious unsigned payload execution.

Apple Safari and macOS Lockdown Mode can be bypassed to access restricted Web APIs through maliciously crafted file URLs due to insufficient URL validation. Affects Safari 26.2 and macOS Tahoe 26.2 on systems with Lockdown Mode enabled. Remote attackers can potentially execute high-impact attacks leveraging APIs meant to be restricted in high-security configurations. EPSS score of 0.06% (18th percentile) indicates low observed exploitation probability. No public exploit identified at time of analysis. This represents a serious compromise of Apple's enhanced security feature designed to protect high-risk users from targeted attacks.

Unauthenticated access to Hidden Photos Album in Apple iOS, iPadOS, macOS, and visionOS allows remote attackers to view protected photos without authentication due to a configuration flaw. Fixed in iOS/iPadOS 26.2, macOS Tahoe 26.2, and visionOS 26.2. CVSS 9.8 (Critical) reflects network-based unauthenticated access, though EPSS of 0.13% (32nd percentile) suggests low observed exploitation probability. No public exploit identified at time of analysis, and not listed in CISA KEV. This represents a privacy-critical authentication bypass affecting Apple's Photos app across all major platforms.

Authorization bypass in GG Soft PaperWork versions 5.2.0.9427 through 6.0 allows authenticated remote attackers to access or modify resources belonging to other users by manipulating user-controlled identifiers (IDOR). The flaw was reported through Turkey's USOM/TR-CERT, and no public exploit identified at time of analysis. With an EPSS score of 0.04% (12th percentile), opportunistic mass exploitation appears unlikely, though targeted abuse within deployed environments remains realistic.

Gutenberg Essential Blocks plugin for WordPress up to version 5.7.2 allows authenticated authors and above to access sensitive API keys for Instagram, Google Maps, and other external services due to missing capability checks on several callback functions. The vulnerability requires WordPress Author-level or higher privileges and carries a low real-world risk given the constrained attack surface and low EPSS score of 0.04%, though it does expose plaintext credentials to a wider internal threat model than intended.

Protection-mechanism bypass in BlueMail 1.140.103 and earlier on Windows lets attackers deliver files that are saved via the attachment-interaction feature without a Mark-of-the-Web (MOTW) tag, defeating Windows SmartScreen, Office Protected View, and third-party security software that rely on the MOTW zone identifier. Publicly available exploit code exists; the flaw is not listed in CISA KEV and EPSS is low (0.48%, 38th percentile), indicating no confirmed widespread exploitation yet. The practical effect is that a malicious document or executable arriving by email loses the 'downloaded from the Internet' provenance that would normally trigger a warning or block.

Protection-mechanism bypass in Canary Mail 5.1.40 and earlier on Windows lets attacker-supplied email attachments be written to disk without the Mark-of-the-Web (MOTW) NTFS tag, so files that reach a victim through the mail client are treated as trusted local content rather than internet-originated. This defeats SmartScreen, Office Protected View, and other MOTW-aware defenses in Windows and third-party software, materially easing malware delivery. Publicly available exploit code exists; the issue is not listed in CISA KEV and EPSS is low (0.48%, 38th percentile), indicating no evidence of widespread active exploitation.

Network traffic sniffing in RTI Connext Professional 7.2.0-7.3.0 and 7.4.0-7.6.x exposes private personal information to unauthorized remote actors with low attack complexity. The vulnerability allows confidentiality breach (high impact) with limited integrity and availability impacts, affecting distributed data-sharing middleware used in critical infrastructure and industrial systems. EPSS exploitation probability is minimal (0.05%, 15th percentile) with no confirmed active exploitation or public exploit code identified at time of analysis.

Information disclosure in Menulux Mobile App versions prior to 9.5.8 allows remote unauthenticated attackers to access other users' data by manipulating trusted identifiers (IDOR-style flaw). The vulnerability falls under CWE-639 (Authorization Bypass Through User-Controlled Key) and was reported by Turkey's national CERT (USOM). There is no public exploit identified at time of analysis, and EPSS scoring places exploitation probability at just 0.04% (13th percentile).

Authenticated users with limited privileges can modify plugin settings and access functionality they should not have access to via missing authorization checks in Buttoner for Elementor through version 1.0.6. The vulnerability requires valid WordPress user credentials but no administrative role, allowing privilege escalation within the plugin's configuration interface. EPSS score of 0.05% indicates low exploitation probability despite network accessibility.

Broken access controls in Ultimate Auction plugin for WordPress up to version 4.3.3 allow low-privileged attackers to modify or disrupt auction operations. The missing authorization checks (CWE-862) enable unauthorized changes without user interaction, impacting integrity and availability but not confidentiality. No active exploitation or public exploit code has been reported; EPSS indicates a low exploitation probability.

Authorization bypass in Essential Real Estate WordPress plugin versions through 5.2.9 allows authenticated users to access sensitive real estate data they should not have permission to view through user-controlled key manipulation. The vulnerability exploits incorrectly configured access control at the application level, enabling privilege escalation from a standard user account to view confidential information such as property details or pricing. No public exploit code has been identified, and the EPSS score of 0.04% indicates low exploitation probability despite the CVSS 6.5 severity rating.

Insecure direct object reference in Barn2 Document Library Lite plugin for WordPress allows unauthenticated remote attackers to read arbitrary documents by manipulating a user-controlled key parameter. Affected versions include all releases up to and including 1.1.7, with low confidentiality impact and no integrity or availability loss.

Remote unauthenticated attackers can exploit missing authorization checks in the Homey Core plugin (versions ≤ 2.4.3) to degrade service availability. The vulnerability stems from a missing authorization flaw (CWE-862) that permits unauthorized interaction with vulnerable endpoints. No public exploit code has been identified and active exploitation is not confirmed at the time of analysis.

Information disclosure in the TI WooCommerce Wishlist WordPress plugin (≤2.10.0) allows unauthenticated attackers to read any user's wishlist data due to missing authorization checks. The vulnerability has a low CVSS base score of 5.3 and an extremely low EPSS exploitation probability (0.02%), indicating minimal real-world risk. No public exploit or active exploitation has been reported.

Missing authorization in NinjaTeam FileBird Pro WordPress plugin versions up to 6.5.1 allows authenticated users to access and modify files they should not have permission to view or edit due to incorrectly configured access control security levels. The vulnerability requires valid user credentials but can lead to disclosure and modification of sensitive files within the plugin's file management interface. EPSS exploitation probability is low at 0.04%, and no public exploit code has been identified at the time of analysis.

Missing authorization in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin versions up to 4.0.7 allows unauthenticated attackers to modify cookie consent settings, potentially undermining the site’s compliance posture. No active exploitation or public proof-of-concept has been identified, and the EPSS score (0.05%) indicates very low exploitation probability.

Authorization bypass in FAPI Member WordPress plugin through version 2.2.29 allows unauthenticated remote attackers to access or modify resources via insecure direct object references (IDOR) exploiting misconfigured access control security levels. The vulnerability requires no authentication, low attack complexity, and results in confidentiality and integrity impact without availability compromise. EPSS score of 0.04% indicates minimal real-world exploitation probability despite the moderate CVSS score.

Broken access control in Yaad Sarig Payment Gateway for WooCommerce (versions ≤2.2.11) allows unauthenticated remote attackers to bypass authorization checks and gain unauthorized access to payment gateway functions. With CVSS 9.1 (Critical) scoring reflecting network-accessible exploitation requiring no privileges or user interaction, attackers can read or modify sensitive payment data. EPSS score of 0.04% (14th percentile) suggests low observed exploitation probability despite severity. No public exploit identified at time of analysis, though the authentication bypass tag indicates potential for unauthorized transaction manipulation or data exposure in WordPress e-commerce environments.

Missing authorization in Sendinblue for WooCommerce plugin versions up to 4.0.49 allows unauthenticated attackers to modify newsletter subscription settings with low integrity impact. The vulnerability (CVE-2025-66128) has a CVSS 5.3 but a very low EPSS exploitation probability (0.05%) and no known active exploitation or public exploit code.

Missing authorization in g5theme Essential Real Estate WordPress plugin version 5.2.9 and earlier allows authenticated users to access or modify restricted resources by exploiting inadequately configured access controls. An attacker with low-privilege WordPress account credentials can leverage the broken access control to view sensitive information and make unauthorized modifications without requiring administrative approval. No public exploit code is currently identified, though the vulnerability is documented in the Patchstack security database.

Unauthenticated remote attackers can bypass access controls in ZEEN101 Leaky Paywall WordPress plugin versions up to 4.22.6, gaining unauthorized access to restricted content through incorrectly configured security levels. The vulnerability requires no user interaction and can be exploited over the network, though it is limited to information disclosure (CVSS 5.3, EPSS 0.04%). No public exploit code or active exploitation has been identified at time of analysis.

Unauthenticated access to a sensitive function in the Stylish Price List WordPress plugin through version 7.2.2 allows remote attackers to degrade service availability. The missing authorization check can be leveraged to perform actions that impact the plugin's availability without requiring login credentials. No active exploitation or public exploit code has been identified.

Missing authorization in the SiteGround Security plugin for WordPress (≤1.5.8) allows unauthenticated remote attackers to trigger availability disruptions by exploiting incorrectly configured access controls. The vulnerability has a CVSS 5.3 (Medium) but EPSS scores only 0.05%, indicating minimal predicted exploitation; no active attacks or public exploit code have been observed.

Unauthenticated information disclosure in the CatFolders WordPress plugin up to version 2.5.3 allows remote attackers to access restricted data via a missing authorization check. No public exploit is known, and EPSS indicates a low exploitation probability (0.05%).

Missing authorization in WP Compress for MainWP plugin versions up to 6.50.17 allows unauthenticated remote attackers to modify plugin settings due to incorrectly configured access control, affecting integrity of compressed content and plugin configuration without requiring authentication or user interaction.

Unauthenticated modification of plugin data in OnPay.io for WooCommerce through version 1.0.47 allows remote attackers to alter plugin settings via missing authorization checks. The WordPress plugin lacks proper capability verification, enabling attackers with no privileges to perform actions that should require authentication. Exploitation probability is negligible per EPSS, and no active attacks or public exploit code have been identified.

Unauthenticated modification of plugin data affects Feeds for YouTube plugin for WordPress through version 2.4.0. The vulnerability stems from a missing authorization check, allowing remote attackers to alter settings without authentication. Despite a CVSS base score of 5.3, only low integrity impact is possible, and no active exploitation or public proof-of-concept has been identified at the time of analysis.

Broken access control in ThemeFusion Avada WordPress theme through version 7.13.2 allows authenticated attackers with low privileges to access functionality improperly constrained by access control lists, potentially achieving full site compromise. With CVSS 8.8 (High) due to network-based access requiring only low-privilege authentication, attackers can achieve high confidentiality, integrity, and availability impact. EPSS probability remains low at 0.06% (18th percentile), and no public exploit identified at time of analysis, suggesting limited immediate exploitation risk despite the critical CVSS rating.

Unauthenticated remote attackers can access sensitive sitemap data in Google XML Sitemaps WordPress plugin versions through 4.1.22 due to missing authorization checks on sitemap endpoints. The vulnerability allows unauthorized information disclosure of site structure and indexed pages without requiring authentication or user interaction. While the CVSS score is moderate (5.3), real-world exploitation probability is very low (EPSS 0.04th percentile), suggesting this is primarily an information disclosure risk rather than an active threat.

WCFM Marketplace plugin through version 3.7.1 fails to properly enforce authorization controls, allowing authenticated users with limited privileges to cause denial of service or access functionality they should not have. The vulnerability affects the WordPress plugin across all installations through the specified version, exploiting incorrectly configured access control security levels via network-accessible endpoints. With an EPSS score of 0.05% and low real-world exploitation probability, this represents a privilege escalation risk primarily for multi-vendor marketplace administrators.

Denial-of-service vulnerability in Strategy11’s Business Directory Plugin for WordPress (≤ 6.4.19) allows authenticated high-privileged attackers to disrupt site availability. The flaw stems from missing authorization checks, permitting an admin-level user to trigger an action with high availability impact. No public exploit is known, and EPSS (0.06%) indicates low exploitation probability despite the network-based attack vector.

Arbitrary content deletion in WordPress Ultimate Learning Pro plugin versions <= 3.9.3 allows authenticated high-privilege users to delete learning content without proper authorization checks. An attacker with instructor or administrator access can delete arbitrary posts, lessons, or courses, resulting in high integrity impact but no data theft or system disruption. The vulnerability is not known to be actively exploited and has very low exploitation likelihood (EPSS 0.05%).

Denial of service in WordPress Protect WP Admin plugin <=4.1 allows unauthenticated remote attackers to degrade availability. A missing authorization check enables exploitation of incorrectly configured access control security levels, causing a low-impact loss of availability without affecting confidentiality or integrity. The vulnerability has a low EPSS score (0.05%) and no known public exploit or active exploitation.

Missing authorization in the WordPress Read More & Accordion plugin (expand-maker) versions 3.5.5.1 and earlier allows authenticated users to access restricted functionality through incorrectly configured access controls, potentially revealing sensitive information. The vulnerability requires user authentication and network access but carries a CVSS score of 6.5 due to high confidentiality impact, though real-world exploitation probability remains low at 0.04% EPSS. No public exploit code or active exploitation has been identified at time of analysis.

Authenticated low-privileged users can exploit missing authorization in the Accessibility by AudioEye WordPress plugin (≤1.0.49) to modify plugin data, resulting in a limited integrity impact. The vulnerability allows attackers with subscriber roles to bypass access controls on plugin endpoints, though no active exploitation or public exploit code is currently known. The CVSS score of 4.3 reflects its low severity.

Unauthorized access to attachment management exists in the Import external attachments WordPress plugin, allowing low-privileged users to modify external attachment settings or data without proper authorization checks. Versions up to 1.5.12 are vulnerable, and remote attackers with subscriber-level or similar accounts can exploit this missing authorization (CWE-862). No active exploitation or public proof-of-concept code is reported at the time of analysis, and EPSS indicates a low exploitation probability (0.05%).

Unauthorized modification of Elementor widget restrictions in the Restrict Elementor Widgets plugin for WordPress allows authenticated users with low privileges to bypass access controls. Affecting versions up to and including 1.12, this missing authorization flaw can be exploited to alter widget, column, and section restrictions without proper permissions. No active exploitation is confirmed, and the EPSS score remains low at 0.05%.

Low-privileged authenticated users of the e-plugins Directory Pro WordPress plugin (<=2.5.6) can bypass access controls due to a missing authorization flaw, potentially modifying plugin data. The vulnerability has a medium CVSS score (4.3) with low integrity impact, and no active exploitation or public exploit has been reported; EPSS score of 0.05% indicates a low probability of in-the-wild attacks.

Inadequately configured access control in Easy Property Listings WordPress plugin versions 3.5.21 and earlier allows authenticated users to access sensitive information they should not be authorized to view. An authenticated attacker with user-level privileges can bypass authorization checks to read property listing data or other restricted content due to missing authorization validation on API endpoints or functionality. EPSS exploitation probability is very low at 0.04%, and no public exploit code has been identified, indicating limited real-world threat despite the authentication-bypass tag.

Authenticated attackers with low-level privileges can modify plugin data in the WP Coupons and Deals WordPress plugin through version 3.2.4 due to missing authorization checks. This integrity-only impact (CVSS 4.3) requires an already-authorized low-privilege user account, limiting risk. No active exploitation has been reported, and the EPSS probability is 0.05% (14th percentile), indicating very low exploitation likelihood.

Authenticated low-privilege attackers can bypass access controls in the WPS Bidouille WordPress plugin through version 1.33.1, allowing unauthorized modification of plugin data. The vulnerability has a low EPSS score (0.05%) and no public exploit or active exploitation is currently reported.

We are tasked to synthesize data from multiple intelligence sources about CVE-2025-59001 into a comprehensive analysis, returning a JSON object with specific fields. We need to cross-reference the data, provide original synthesis, and adhere to strict rules. Input data: - CVE ID: CVE-2025-59001 - Description: "Missing Authorization vulnerability in ThemeNectar Salient Core salient-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salient Core: from n/a through <= 3.0.8." - CVSS Score: 4.3 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - CWE: CWE-862 (Missing Authorization) - EPSS Score: 0.05% (percentile 16%) - Reported by: audit@patchstack.com - Tags: Authentication Bypass (Note: tags might be from Patchstack, but we'll incorporate) - References: [nvd] (None) but actually a Patchstack URL: https://patchstack.com/database/Wordpress/Plugin/salient-core/vulnerability/wordpress-salient-core-plugin-3-0-8-broken-access-control-vulnerability?_s_id=cve - Also, there is no KEV status provided, no POC status mentioned. We must not assume KEV. Our exploitation status phrase: no public exploit identified at time of analysis (since no KEV, no POC stated). But wait, Patchstack might have reported, but we have no explicit "POC=YES" in the data. So we'll use that phrase. We need to fill fields: 1. product_name: "1-3 words ONLY. The specific product or service name affected." It's "Salient Core". That's a WordPress plugin by ThemeNectar. So "Salient Core" works. 2. summary: "2-3 sentence plain-language summary for security professionals. CRITICAL: Do NOT copy or paraphrase the Description — write an original synthesis using all available data. Do NOT start with 'A vulnerability', 'A problem', 'A flaw', or 'An issue'. Start with the specific impact verb and product, e.g. 'Remote code execution in Apache Tomcat 9.x allows...' or 'Cortex XDR agent on macOS can be disabled by local admins via...'. Explain WHAT the vulnerability is, WHO is affected (specific product/version), and WHAT an attacker can do. Mention if actively exploited (KEV), if POC exists, and EPSS risk if notable." So, missing authorization in Salient Core plugin <=3.0.8 allows authenticated users to exploit incorrectly configured access control to modify some data (I:L, integrity impact low, no confidentiality or availability). No active exploitation known, and EPSS is low (0.05%). So summary: "Authenticated attackers can exploit a missing authorization check in ThemeNectar Salient Core plugin versions through 3.0.8 to modify data without proper permissions. The vulnerability results from incorrectly configured access control security levels, with low integrity impact and no confidentiality or availability impact. EPSS probability is very low (0.05%), and no public exploit code or active exploitation has been identified at this time." That's original. 3. technical_context: "Explain the underlying technology/library/protocol involved. Use CPE data to identify exact affected products. Reference the CWE to explain the root cause class. Be specific and educational." No CPE data provided, so we can mention that CPE is not available, but the product is a WordPress plugin. We can talk about missing authorization (CWE-862) and how access control in WordPress plugins can be misconfigured. Also, the Patchstack link likely provides details. We'll say: "The Salient Core plugin for WordPress is affected by a missing authorization vulnerability (CWE-862). This class of weakness occurs when a web application does not properly restrict access to privileged functionality, allowing low-privileged authenticated users to perform actions that should require higher permissions. The vulnerability is in the plugin's access control mechanisms, which fail to enforce correct security levels. No CPE information is provided, but the vendor's plugin is available on WordPress.org or ThemeNectar's site." 4. risk_assessment: "Assess real-world risk using ALL available signals: CVSS vector (attack vector, complexity, privileges), EPSS exploitation probability, KEV status, POC availability, SSVC decision framework (exploitation status, automatable, technical impact). Compare and contrast these signals. Is this a real priority or just a high-CVSS-but-low-real-risk issue? If any key data is missing or conflicting, STATE IT EXPLICITLY, e.g.: 'CVSS indicates network vector but description implies local access — verify with vendor.' or 'EPSS score is low despite KEV listing, suggesting targeted rather than widespread exploitation.' Do NOT present uncertain information as confirmed fact." So here: CVSS 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. It's network exploitable, low complexity, low privileges required (authenticated, any user), no user interaction, unchanged scope, only integrity low impact. EPSS 0.05% (very low). No KEV, no POC. SSVC: exploitation=none (no public exploit), automatable=maybe (AC:L, but needs authentication, so perhaps not fully automatable without credentials), technical impact=partial (integrity modification). So risk is low. We'll say: "The CVSS score is low (4.3) due to limited impact, but the vector indicates an authenticated remote attack with low complexity. EPSS probability of exploitation is negligible (0.05%, percentile 16%), and there is no evidence of active exploitation or public exploit code. This vulnerability does not appear to be a high-priority threat, as it requires authentication and only allows integrity modification, not compromising confidential data or system availability. The missing authorization likely stems from a configuration specific to the plugin's access control levels, so risk is contextual." A note: no data conflicts; CVSS aligns with description. 5. affected_products: "Write a concise paragraph listing affected products with their versions. Include product name, version range, CPE if available, and link to vendor advisory from references. Do NOT use bullet points, JSON, or key-value formatting." So: "ThemeNectar Salient Core plugin for WordPress, versions from n/a through 3.0.8, are affected. The vendor advisory is available at https://patchstack.com/database/Wordpress/Plugin/salient-core/vulnerability/wordpress-salient-core-plugin-3-0-8-broken-access-control-vulnerability?_s_id=cve." (Use the reference link). No CPE mentioned, so skip that. 6. remediation: "Write a concise paragraph with actionable remediation steps. Start with the primary fix (patch/upgrade with exact version), then mention workarounds if relevant. Include advisory URLs from references. If no patch is available, suggest SPECIFIC compensating controls with their trade-offs — not generic 'apply defense in depth' but actionable: 'Disable X feature', 'Block Y port', 'Restrict access to Z endpoint'. Note side effects of each mitigation. Do NOT use bullet points, JSON, or key-value formatting." The description says "from n/a through <= 3.0.8", implying that version 3.0.8 is the highest affected, and presumably fixed in version above that, but no specific fix version is given. Patchstack advisory may have details. Since we only have the link, we can check if it says "Fixed in version: 3.0.9" or something. But we don't have that info from the input, just the URL. I can't access it, so I'll assume there is a patch. The data says "Missing Authorization vulnerability... This issue affects Salient Core: from n/a through <= 3.0.8." Typically, Patchstack entries include a fixed version. But in this input, no fix version explicitly. I'll phrase: "Upgrade Salient Core to a version newer than 3.0.8. The vendor has not explicitly announced a fixed version in the CVE data, but the advisory at Patchstack likely provides details. As a workaround, administrators can restrict access to the affected plugin's functionality by reviewing and hardening access control settings until an update is applied, though this may require manual configuration review." But we must not invent version numbers. If no patch is known, I will state that. However, given the structure, I'll say "Update to a patched version beyond 3.0.8" – but that is an inference. Better: "The advisory at Patchstack (see reference) indicates the vulnerability affects versions up to 3.0.8; update to the latest version, which should contain the fix. If no patch is yet available, restrict access to authenticated users with necessary roles, or disable the plugin temporarily. Disabling the plugin may affect functionality dependent on Salient Core." I'll incorporate the reference. 7. exploit_scenario: "Brief realistic attack scenario in 2-3 sentences. If POC exists, note that. Factor in attack vector and complexity from CVSS." No POC exists. Attack scenario: "An authenticated low-privileged user, such as a subscriber on a WordPress site, crafts a request to a Salient Core endpoint that lacks proper authorization checks. Due to missing access control, the user modifies settings or content they should not have permission to alter, leading to unauthorized data modification." This matches AV:N, PR:L, UI:N, I:L. 8. exploitation_conditions: "CRITICAL FIELD — security teams make real decisions based on this. Extract SPECIFIC, CONCRETE prerequisites from the CVE description. Name the EXACT product feature, protocol, configuration setting, or deployment mode required. If the description says 'when configured with...' or 'if the X feature is enabled' — that IS the condition. If genuinely no special conditions (AV:N/AC:L/PR:N/UI:N), state: 'No special conditions — remote unauthenticated exploitation against default configurations of [PRODUCT NAME].' Also state what LIMITS exploitation: required user interaction, authentication level, non-default configuration, specific platform/version. These limiting factors help defenders assess realistic risk beyond raw CVSS score. FORBIDDEN generic phrases: 'Network access required.' / 'Specific configuration needed.' / 'Depends on deployment.'" From the description: "Missing Authorization vulnerability ... allows Exploiting Incorrectly Configured Access Control Security Levels." This implies that the vulnerability is due to incorrectly configured access control security levels. So the condition might be that access control security levels are not correctly configured. However, the CVSS vector has PR:L, so it requires authentication with low privileges. So specific conditions: "Exploitation requires an authenticated user with low privileges (e.g., subscriber) on a WordPress site where the Salient Core plugin is active. The vulnerability manifests when access control security levels are misconfigured, potentially due to the plugin's default settings. No user interaction is required. No other special conditions; the attack vector is network-based, and complexity is low." That's specific enough. The "incorrectly configured" might be inherent to the plugin's code rather than a site-specific misconfiguration, but it's a missing authorization check. So I'll phrase: "Exploitation requires an authenticated low-privilege user account on a WordPress instance running Salient Core 3.0.8 or earlier. The vulnerability exists in the plugin's access control mechanisms, specifically when handling requests to certain endpoints where permissions are not properly enforced. No other prerequisites such as enabled features or non-default settings are needed, but the attacker must have valid credentials." 9. attack_chain: "3-7 short steps separated by ' → ' (arrow), following kill chain phases. Use as many steps as the attack realistically requires. Each step is 3-8 words. Must be grounded in actual CVE data (attack vector, privileges, scope from CVSS). Phase templates by length: 3-step: Access → Exploit → Impact. 4-step: Access → Exploit → Execution → Impact. 5-step: Access → Delivery → Exploit → Execution → Impact. 6-step: Access → Delivery → Exploit → Execution → Persist → Impact. 7-step: Recon → Delivery → Exploit → Install → C2 → Execute → Impact. Example: 'Send crafted HTTP request → Trigger buffer overflow in parser → Execute arbitrary code as root'. No numbering, no prose, just the chain." So: Access: "Authenticate with low-privilege user account" -> Exploit: "Send request to unprotected endpoint" (or "Craft request to bypass authorization") -> Impact: "Modify data without proper authorization". That's 3 steps: "Authenticate as low-privileged user → Send crafted request to missing-auth endpoint → Unauthorized data modification". Alternatively, could be 4 steps: Access -> Delivery (sending the request) -> Exploit (the missing check allows access) -> Impact. But 3 steps suffices: "Access: obtain low-privilege credentials" → "Exploit: invoke

Authenticated users with limited privileges can access search and replace functionality in CM On Demand Search And Replace WordPress plugin (versions up to 1.5.5) due to missing authorization checks on restricted features. An attacker with basic user credentials can perform privileged actions intended only for administrators, affecting data confidentiality through unauthorized content access. This is confirmed as an authentication bypass vulnerability with low real-world exploitation probability (EPSS 0.04%) despite the missing authorization flaw.

Missing authorization in the SKT Page Builder WordPress plugin allows authenticated attackers to modify page content. The vulnerability permits low-privilege users (e.g., subscribers) to perform unauthorized actions due to incorrectly configured access control security levels. No public exploit or active exploitation is confirmed, but the low privilege requirement poses a moderate insider threat risk.

Missing authorization in WCFM - Frontend Manager for WooCommerce through version 6.7.24 allows authenticated users with limited privileges to bypass access controls via incorrectly configured security levels, enabling read-only disclosure of sensitive information. The vulnerability requires user interaction and has a low EPSS score (0.03%, 10th percentile), indicating minimal real-world exploitation probability despite the authentication requirement.

Authenticated attackers with Contributor-level access or above can delete or generate featured images on posts they do not own in the Auto Featured Image (Auto Post Thumbnail) WordPress plugin through version 4.2.1, due to a missing capability check in the bulk_action_generate_handler function. The vulnerability requires user authentication and has a CVSS score of 4.3; no public exploit code or active exploitation has been confirmed at the time of analysis.

Keycloak's admin API endpoints for authorization resource management contain an IDOR vulnerability allowing authenticated administrators with fine-grained permissions for one client to delete or modify resources belonging to other clients within the same realm. The flaw exists in ResourceSetService and PermissionTicketService where authorization checks validate the resourceServer (client) ID from the API request, but backend database operations use only the resourceId, creating a permission bypass. Affected administrators can exploit this with standard HTTP requests to cross-client resource boundaries; no public exploit code identified at time of analysis.

Improper authentication in Ningyuanda TC155 firmware version 57.0.2.0 allows unauthenticated RTSP Live Video Stream access from within the local network. The vulnerability, classified as an authentication bypass (CWE-287), requires no user interaction and can be exploited with low complexity. Publicly available exploit code exists, though active exploitation has not been confirmed via CISA KEV. EPSS score of 0.16% indicates low real-world exploitation likelihood despite the disclosure and POC availability, suggesting limited attacker interest or access constraints.

Privilege escalation in Red Hat's runtimes-inventory-rhel8-operator lets a standard cluster user act with full cluster-administrator authority on the Red Hat management platform. A misconfigured internal proxy attaches the cluster's main administrative credentials to every command it relays - not just the report traffic it should handle - so any authenticated user can issue admin-level instructions and alter cluster configuration or status. There is no public exploit identified at time of analysis, EPSS is low (0.21%, 12th percentile), and the issue is not in CISA KEV, but the impact is a classic confused-deputy authentication bypass and Red Hat has shipped a fix.

Unrestricted file upload in Computer Laboratory System 1.0 via the technical_staff_pic.php file allows high-privilege users to upload arbitrary files to the server. The vulnerability requires administrator-level access (PR:H) and affects confidentiality, integrity, and availability with low impact scope. Publicly available exploit code exists; however, the EPSS score of 0.07% (21st percentile) and high-privilege requirement significantly limit real-world exploitation risk compared to the CVSS 2.0 baseline.

Unrestricted file upload in Computer Laboratory System 1.0 via the admin_pic.php image parameter allows high-privilege authenticated users to upload arbitrary files remotely, with publicly available proof-of-concept code demonstrating exploitation. Despite the CVSS 2.0 score reflecting the high authentication barrier (PR:H), the vulnerability enables attackers with admin credentials to bypass upload restrictions and potentially establish persistence or execute malicious code on the server.

The HAPPY Helpdesk Support Ticket System WordPress plugin up to version 1.0.9 allows authenticated attackers with Subscriber-level access to submit replies to arbitrary support tickets by bypassing authorization checks on the 'submit_form_reply' AJAX action. The vulnerability stems from missing capability validation before processing ticket replies, enabling low-privileged users to manipulate the 'happy_topic_id' parameter and interact with tickets they do not own or are not assigned to. While the CVSS score of 4.3 reflects low-to-medium severity with integrity impact only, the EPSS percentile of 13% and absence of evidence of active exploitation suggest this is not an immediate critical priority, though it should be patched to prevent unauthorized ticket interference.

Unauthorized data modification in AnnunciFunebri Impresa WordPress plugin through version 4.7.0 allows authenticated subscribers to reset all plugin options via the missing capability check on annfu_reset_options() function. Attackers with Subscriber-level access can delete all 29 plugin configuration options, reverting the plugin to default state without administrative authorization. No public exploit code or active exploitation has been identified at time of analysis.

Popup Builder (Easy Notify Lite) plugin for WordPress versions up to 1.1.37 allows authenticated attackers with Subscriber-level access to reset plugin settings to default values due to missing capability checks in the easynotify_cp_reset() function. The vulnerability requires user authentication and does not grant elevated privileges or information disclosure, resulting in a CVSS score of 5.4 (medium severity). No public exploit code or active exploitation has been identified at time of analysis, though the issue poses moderate risk to WordPress installations relying on plugin configuration integrity.

Authentication bypass in JAY Login & Register plugin for WordPress versions ≤2.4.01 allows unauthenticated remote attackers to impersonate any site user, including administrators, by exploiting flawed cookie validation in the user-switching function. Attackers require only knowledge of target user IDs to gain complete account access without credentials. No public exploit identified at time of analysis.

Authenticated attackers with Subscriber-level access can modify tracking settings in the Employee Spotlight WordPress plugin (versions up to 5.1.3) due to missing authorization checks in the employee_spotlight_check_optin() function. The vulnerability allows privilege escalation to perform account integrity modifications that should require administrator approval, affecting all installations of this plugin without patches applied.

Unrestricted file upload in Campcodes Student Enrollment 1.0 allows remote attackers to upload arbitrary files via the photo parameter at the /admin/register.php endpoint. The vulnerability enables potential remote code execution by uploading malicious scripts (e.g., a PHP web shell). A publicly available exploit exists, but no active exploitation has been reported by CISA KEV.

Unrestricted file upload in campcodes Online Student Enrollment System 1.0 allows high-privileged authenticated users to upload arbitrary files via the userphoto parameter in /admin/index.php?page=user-profile, potentially enabling remote code execution or data exfiltration. Public exploit code is available, though the vulnerability's real-world impact is limited by the requirement for administrative credentials and low CVSS/EPSS scores.

FaceTime caller ID spoofing vulnerability in Apple operating systems allows remote attackers to spoof their caller identity due to inconsistent user interface state management. Affected versions include iOS 18.7.2 and earlier, iPadOS 18.7.2 and earlier, macOS Sequoia 15.7.2 and earlier, macOS Sonoma 14.8.2 and earlier, macOS Tahoe 26.1 and earlier, visionOS 26.1 and earlier, and watchOS 26.1 and earlier. The vulnerability requires no user interaction or authentication and carries low real-world exploitation risk (EPSS 0.07%, percentile 21%), with no public exploit code or active exploitation confirmed.

Simple Bike Rental WordPress plugin versions up to 1.0.6 allow authenticated subscribers to retrieve sensitive customer booking data due to missing capability checks on the 'simpbire_carica_prenotazioni' AJAX action. Attackers with subscriber-level access can exfiltrate personally identifiable information including names, email addresses, and phone numbers from all booking records. CVSS 4.3 reflects the moderate severity of unauthorized information disclosure without requiring administrative access.

Authenticated attackers with Subscriber-level access can duplicate arbitrary WordPress posts via the PDF for Contact Form 7 + Drag and Drop Template Builder plugin (versions up to 6.3.3) due to missing capability checks in the 'rednumber_duplicate' function. This allows disclosure of sensitive content including password-protected and private posts. The vulnerability requires authentication but exploits insufficient privilege validation, creating a post enumeration and information disclosure risk for multi-user WordPress installations. No public exploit code or active exploitation has been confirmed at the time of analysis.

WP Fastest Cache Premium plugin versions up to 1.7.4 contain a Server-Side Request Forgery (SSRF) vulnerability in the 'get_server_time_ajax_request' AJAX action that allows authenticated Subscriber-level users to send arbitrary web requests originating from the server, potentially enabling reconnaissance and manipulation of internal services. The free version is unaffected. No public exploit code has been identified at time of analysis, with a very low EPSS score of 0.04% indicating minimal real-world exploitation likelihood despite the authenticated attack vector.

Authenticated attackers with WordPress Subscriber-level access and above can modify arbitrary plugin settings in the Vimeo SimpleGallery plugin versions up to 0.2 due to missing authorization checks on the vimeogallery_admin function. The vulnerability allows privilege escalation within WordPress, enabling lower-privileged users to alter plugin configurations they should not have access to. No public exploit code or active exploitation has been identified at the time of analysis.

BuddyTask plugin for WordPress versions up to 1.3.0 fails to enforce capability checks on multiple AJAX endpoints, allowing authenticated subscribers and above to view, create, modify, and delete task boards in any BuddyPress group regardless of membership or group privacy settings. The CVSS 5.4 (Medium) rating reflects confidentiality and integrity impacts limited to group task data with low attack complexity and no user interaction required, though the actual organizational risk depends on BuddyPress deployment scope and task board sensitivity.

Premmerce Wishlist for WooCommerce plugin versions up to 1.1.10 fails to enforce authorization checks on the deleteWishlist() function, allowing authenticated Subscriber-level users to delete arbitrary wishlists belonging to other users. The vulnerability stems from missing capability validation rather than authentication bypass; while the CVSS vector indicates unauthenticated access (PR:N), the description specifies Subscriber-level authentication is required, suggesting the vector may reflect the function's accessibility rather than actual authentication bypass. With EPSS of 0.04% and no public exploit code identified, real-world exploitation risk is minimal despite the authorization flaw.

Unauthenticated attackers can modify plugin settings and create arbitrary filter options in the Filter Plus plugin for WordPress (versions up to 1.1.6) due to missing capability checks on AJAX actions 'filter_save_settings' and 'add_filter_options'. This allows unauthorized data modification with no confidentiality impact but enables attackers to alter product filtering functionality without authentication. The vulnerability has a low EPSS score (0.08%, 23rd percentile) despite network accessibility, indicating limited real-world exploitation likelihood.

Unauthenticated payment bypass in Campay Woocommerce Payment Gateway plugin (versions up to 1.2.2) allows remote attackers to mark orders as successfully completed without actually processing payment, directly resulting in financial loss. The vulnerability stems from insufficient transaction validation in the payment processing workflow, enabling attackers to manipulate order status through the payment gateway interface.

Premmerce Brands for WooCommerce plugin versions up to 1.2.13 allow authenticated attackers with Subscriber-level access to modify brand permalink settings due to a missing capability check in the saveBrandsSettings function. The vulnerability requires only network access and low-privilege authentication, enabling unauthorized data modification of WordPress brand configuration without user interaction.

Unauthenticated LAN gRPC access on SpaceX Starlink Dish devices running firmware 2024.12.04.mr46620 (Mini1_prod2) permits adjacent-network attackers to invoke administrative functions and read physical telemetry - tilt, rotation, and elevation - without credentials. The cross-origin policy can be circumvented by simply omitting the Referer header, potentially enabling browser-based cross-site requests against the local device. Critically, this report is formally disputed by SpaceX: the vendor states that unauthenticated LAN gRPC is intentional design for mobile app integration, and that cross-origin enforcement is correctly applied to gRPC-Web on port 9201; no public exploit or CISA KEV listing exists at the time of analysis.

Unrestricted file upload in SourceCodester Real Estate Property Listing App 1.0 allows high-privileged authenticated users to upload arbitrary files via the image parameter in /admin/property.php, potentially leading to remote code execution. The vulnerability affects only administrators or high-privilege accounts due to PR:H requirements, but public exploit code exists and EPSS scoring indicates low real-world exploitation probability (0.07th percentile).

Unrestricted file upload in baowzh hfly allows authenticated remote attackers to upload arbitrary files via manipulation of the imgFile parameter in /Public/Kindeditor/php/upload_json.php. The vulnerability affects rolling-release versions up to commit 638ff9abe9078bc977c132b37acbe1900b63491c, carries low overall risk (CVSS 2.1, EPSS 0.07%), and has publicly available exploit code but requires authenticated access, significantly limiting real-world exploitability compared to unauthenticated file upload scenarios.

Authorization bypass in Netiket Information Technologies' ApplyLogic platform (all versions through 01.12.2025) allows authenticated remote attackers to manipulate user-controlled identifiers to access or modify resources belonging to other users. The flaw is classified as an Insecure Direct Object Reference (IDOR) pattern with high integrity impact, and no public exploit has been identified at time of analysis. EPSS exploitation probability is low (0.07%, 22nd percentile), and the CVE is not on the CISA KEV list.

HTTP request smuggling in libsoup, GNOME's HTTP client/server library, lets remote unauthenticated attackers exploit inconsistent Host header parsing: libsoup accepts multiple Host: headers and processes the last occurrence, while common front-end proxies honor the first. Supplying duplicate Host headers creates a proxy/backend mismatch enabling vhost confusion, request smuggling, cache poisoning, and bypass of host-based access controls. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but Red Hat has shipped fixes across numerous products (15 RHSA errata).

Authorization bypass in Aksis AxOnboard versions 3.2.0 through 3.2.x allows authenticated low-privileged users to manipulate user-controlled identifiers (IDOR pattern) and access or modify resources belonging to other users or tenants. Türkiye's national CSIRT USOM (TR-25-0446) coordinated disclosure, and while no public exploit code has been identified, the high integrity impact in a multi-tenant onboarding platform makes this a meaningful escalation-of-privilege risk for organizations using version 3.2.x.

Unauthenticated Bluetooth Low Energy (BLE) command execution against the Meatmeet Pro WiFi & Bluetooth Meat Thermometer firmware 1.0.34.4 allows any proximity attacker to issue shutdown, restart, or factory-reset commands without credentials, resulting in a denial of service. The clear-config command is particularly disruptive: it dissociates the device from its owner account, severing the connection to the Meatmeet cloud backend and requiring full device re-provisioning before temperature data can be received again. A public proof-of-concept is available via a GitHub gist, though EPSS sits at 0.27% (19th percentile), reflecting the niche consumer IoT footprint rather than low technical reproducibility.

DijiDemi, a platform by Im Park Information Technology, contains an authorization bypass vulnerability (CWE-639) that allows authenticated low-privileged users to access data belonging to other users by manipulating user-controlled identifier keys. Affecting all versions through 28.11.2025, the flaw enables horizontal privilege escalation - an attacker with a valid low-privilege account can exploit trusted identifiers to read confidential data outside their authorized scope. No public exploit code exists and no KEV listing is present; with an EPSS of 0.03% (10th percentile), active exploitation is not currently anticipated.

Authorization bypass in EZCast Pro II wireless presentation devices before firmware 1.17478.177 allows adjacent-network attackers to obtain full administrative control of the device Admin UI by leveraging hard-coded cryptographic keys (CWE-798). The flaw was reported through Switzerland's NCSC coordinated vulnerability disclosure programme and carries a CVSS v4.0 base score of 9.3 with automatable exploitation flagged in the vector. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

A critical authentication bypass and path traversal vulnerability in PipesHub AI platform allows unauthenticated remote attackers to upload files with directory traversal sequences, enabling arbitrary file writes anywhere the service account has permissions. This vulnerability affects PipesHub versions prior to 0.1.0-beta and has a publicly available proof-of-concept exploit, making it an immediate priority for organizations using this enterprise search and workflow automation platform. With a CVSS score of 9.8 and the ability to plant malicious code or overwrite critical files, this represents a severe risk to affected systems.

Insufficiently Protected Credentials in Adobe ColdFusion (versions 2025.4, 2023.16, and 2021.22 and earlier) enables unauthenticated remote attackers to gain limited unauthorized write access by exploiting improperly stored or transmitted credentials. The CVSS vector confirms network-accessible, zero-complexity exploitation with no privileges or user interaction required, producing limited integrity impact. Tagged as an Authentication Bypass vector, this vulnerability is distinct from a simple credential disclosure - it permits write operations, making it a meaningful integrity risk despite the moderate CVSS score. No public exploit or CISA KEV listing has been identified at time of analysis.