Authentication Bypass

Unrestricted file upload in code-projects Simple Food Ordering System 1.0 allows remote attackers to upload arbitrary files through the photo parameter of /editproduct.php, exploiting improper access control (CWE-284) that effectively bypasses authentication on the upload endpoint. The Authentication Bypass tag alongside CWE-284 signals that the product-editing endpoint - which should be access-controlled - can be reached without valid credentials, enabling file placement on the server. A public proof-of-concept is disclosed on GitHub; EPSS sits at 0.06% (17th percentile), indicating minimal observed exploitation at time of analysis, and this CVE does not appear in the CISA KEV catalog.

Unrestricted file upload vulnerability in Muzuro Ecommerce System and ashymuzuro Full-Ecommerce-Website up to version 1.1.0 allows remote authenticated high-privilege administrators to upload arbitrary files via the Add Product Page (/admin/index.php?add_product), with exploit code publicly disclosed. Despite low CVSS score (2.0) due to high privilege requirement, the vulnerability enables direct code execution risk in admin-controlled uploads and received no vendor response to disclosure.

Authorization bypass in Bdtask Pharmacy Management System up to version 9.4 allows authenticated remote attackers to manipulate user profile data via the /user/edit_user/ endpoint, escalating privileges or modifying other users' accounts without proper access controls. The vulnerability has publicly available exploit code and affects the User Profile Handler component, though vendor response to disclosure has been absent.

Authentication bypass in code-projects Client Details System 1.0 allows authenticated remote attackers to gain unauthorized access to protected functionality via an unknown vector. The vulnerability has publicly available exploit code but is rated low-risk due to CVSS 2.1 score and 0.01% EPSS, indicating limited real-world exploitation potential despite remote attack capability.

LearnHouse allows authenticated remote users to upload arbitrary files via unrestricted manipulation of the thumbnail parameter in the Course Thumbnail Handler endpoint (/api/v1/courses/), enabling potential malicious file storage and execution. The vulnerability affects all versions up to commit 98dfad76aad70711a8113f6c1fdabfccf10509ca, with publicly available exploit code disclosed despite vendor non-response to early notification. While CVSS is low (2.1) and EPSS exploitation probability is minimal (0.06%), the presence of public exploits and authentication-only barrier warrants prioritization in environments where account compromise or insider risk is elevated.

Unrestricted file upload in Bdtask Flight Booking Software up to version 3.1 via the Package Information Module endpoint /b2c/package-information allows authenticated remote attackers to upload arbitrary files with low confidentiality and integrity impact. Publicly available exploit code exists; the vulnerability carries a low CVSS score (2.1) due to requiring prior authentication and limited scope, but the ease of exploitation (AC:L, public POC) and vendor non-responsiveness elevate practical risk for deployed instances.

Unrestricted file upload in Bdtask Flight Booking Software up to version 3.1 allows authenticated remote attackers to upload arbitrary files via the /admin/transaction/deposit endpoint. The vulnerability requires valid user credentials (PR:L in CVSS vector) but grants attackers capability to upload files with minimal scope impact. Public exploit code is available, though the very low EPSS score (0.02%) and lack of CISA KEV listing suggest limited real-world exploitation despite disclosure.

Missing authorization in the MDZ Persian Admin Fonts WordPress plugin (versions through 4.1.03) allows low-privileged authenticated users to perform actions reserved for administrators due to absent capability checks. The CVSS vector (PR:L, AV:N, S:U) confirms that any authenticated WordPress user - such as a subscriber or contributor - can reach the vulnerable endpoints over the network with no user interaction required. No public exploit code has been identified at time of analysis, and EPSS sits at 0.06% (18th percentile), indicating negligible observed exploitation activity.

The KiotViet Sync WordPress plugin through version 1.8.5 exposes restricted administrative functions to low-privileged authenticated users due to missing authorization checks (CWE-862), allowing unauthorized data modification via the plugin's sync operations. The flaw is network-exploitable with low privilege requirements and no user interaction, though impact is limited to integrity (I:L) with no confidentiality or availability consequences. No public exploit code exists and EPSS sits at 0.03% (10th percentile), indicating very low exploitation probability despite the broken access control classification.

Missing authorization controls in the Baidu SEO Collection WordPress plugin versions up to 2.1.4 allow unauthenticated remote attackers to access restricted functionality and retrieve sensitive information without proper permission checks. The vulnerability affects the plugin's core access control mechanisms, enabling unauthorized information disclosure with a CVSS score of 5.3. EPSS exploitation probability is low at 0.03%, and no active exploitation has been confirmed.

Broken access control in the Sendle Shipping WordPress plugin (official-sendle-shipping-method) versions through 6.02 allows unauthenticated remote attackers to invoke plugin functionality that should be restricted to authorized users. The flaw stems from missing authorization checks (CWE-862), meaning certain shipping-related actions are accessible without any privilege verification. Real-world impact is limited to availability disruption (CVSS A:L), with no confidentiality or integrity impact identified. No public exploit code exists and EPSS places exploitation probability at 0.04% (11th percentile), indicating negligible active threat at time of analysis.

Missing authorization checks in WebinarPress (wp-webinarsystem) WordPress plugin version 1.33.28 and earlier allow authenticated low-privileged users to perform availability-impacting actions beyond their intended access level. The flaw stems from incorrectly configured access control security levels (CWE-862), enabling a WordPress subscriber-tier user to invoke plugin functionality restricted to higher roles. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS probability stands at 0.03%, indicating low real-world exploitation interest currently.

Link Whisper Free WordPress plugin through version 0.9.2 allows unauthenticated remote attackers to read sensitive information via missing authorization checks on API endpoints. The vulnerability enables bypassing access controls to retrieve data that should be restricted, confirmed with CVSS 5.3 and EPSS 0.03% exploitation probability. No public exploit code or active exploitation has been identified at time of analysis.

Missing authorization in the GoCache CDN WordPress plugin (versions through 1.3.6) allows low-privileged authenticated users to invoke restricted plugin actions beyond their intended access level, resulting in limited integrity and availability impact against CDN configuration. Reported by Patchstack via coordinated disclosure, with no public exploit code identified and an EPSS of 0.03% (10th percentile), indicating very low near-term exploitation probability. No active exploitation has been confirmed by CISA KEV.

Missing authorization checks in the Admin Management Xtended WordPress plugin (versions through 2.5.1) allow authenticated users to exploit incorrectly configured access control levels, performing administrative operations beyond their assigned role boundary. The CVSS scope change component (S:C) signals the vulnerability's impact crosses the exploiting user's permission boundary within the WordPress installation, enabling privilege escalation within the CMS. No public exploit code has been identified at time of analysis, and the EPSS score of 0.05% (16th percentile) indicates very low real-world exploitation probability currently.

Broken access control in RealMag777 MDTF (WordPress Meta Data Filter and Taxonomy Filter) plugin versions up to 1.3.6 allows low-privileged authenticated users to bypass authorization controls and access or modify sensitive metadata and taxonomy filter configurations. While rated CVSS 8.1 (High), real-world exploitation risk remains moderate with EPSS at 0.03% (9th percentile) and no confirmed active exploitation or public exploit code identified at time of analysis. This authentication bypass vulnerability was disclosed by Patchstack's security audit team.

Broken access control in Revive Old Posts (tweet-old-post) WordPress plugin through version 9.3.3 allows authenticated attackers with low-level privileges to escalate permissions and execute high-impact operations including data exfiltration, modification, and service disruption. EPSS score of 0.05% (15th percentile) indicates low probability of mass exploitation, though the 8.8 CVSS score reflects significant potential damage once low-privilege access is obtained. No public exploit identified at time of analysis, and no CISA KEV listing exists.

Broken access control in Welcart e-Commerce WordPress plugin through version 2.11.24 allows authenticated users to bypass authorization checks and perform unauthorized actions with elevated privileges. This authentication bypass vulnerability (CWE-862) enables low-privileged authenticated attackers to access, modify, or delete data beyond their permission level, potentially compromising store operations, customer data, and site integrity. EPSS score of 0.05% (15th percentile) suggests low immediate exploitation probability, though no public exploit has been identified at time of analysis.

Broken access control in QuantumCloud ChatBot plugin for WordPress through version 7.7.3 allows authenticated attackers with low privileges to exploit misconfigured authorization checks, potentially leading to high-impact data breaches, unauthorized modifications, and service disruption. EPSS scoring indicates low exploitation probability (0.05%, 15th percentile), and no public exploit identified at time of analysis. The vulnerability stems from missing authorization controls (CWE-862), requiring only network access and low-privilege credentials with no user interaction, making it readily exploitable once an account is compromised.

An unauthenticated attacker can exploit missing authorization checks in the Everest Backup WordPress plugin (<=2.3.8) to trigger resource-intensive backup operations without any privileges, causing a low impact on server availability. No active exploitation or public proof-of-concept is known, and the EPSS score is very low (0.06%).

Unauthenticated access to CSV export data in the MSTW CSV EXPORTER plugin for WordPress versions up to 1.4 allows an attacker to retrieve exported information without any authentication. The issue arises from a missing authorization check on a publicly accessible export endpoint. No active exploitation or public exploit code is known, and the EPSS score of 0.06% indicates a very low probability of widespread exploitation.

Missing authorization in Reoon Email Verifier for WordPress allows authenticated users to exploit incorrectly configured access control, potentially causing low-impact service disruption. Affected versions up to 2.0.1 are vulnerable. No active exploitation or public exploit code is known, and EPSS indicates a 0.04% exploitation probability.

Missing authorization controls in the Open Close WooCommerce Store plugin (versions ≤4.9.9) allow authenticated low-privileged users to bypass access restrictions and perform unauthorized high-impact operations, potentially modifying store configuration or accessing sensitive data. With CVSS 8.1 (High severity) but only 0.03% EPSS (9th percentile), this represents a significant vulnerability for affected WordPress/WooCommerce sites, though no public exploit or active exploitation (CISA KEV) has been identified at time of analysis. The authentication requirement (PR:L) substantially limits attack surface compared to unauthenticated vulnerabilities.

WordPress Table Block by RioVizual plugin versions through 3.0.0 contains a broken access control vulnerability allowing authenticated attackers with low privileges to bypass authorization checks and perform high-impact actions including data theft, modification, and service disruption. The CVSS score of 8.8 reflects network-accessible exploitation with low complexity requiring only minimal authentication. EPSS score of 0.05% (15th percentile) suggests low immediate exploitation probability, with no public exploit identified at time of analysis.

Broken access control in MSN Partner Hub WordPress plugin allows authenticated attackers with low privileges to bypass authorization controls and gain unauthorized access to high-privilege functions. This CWE-862 missing authorization flaw affects versions through 2.9, enabling authenticated users to execute actions beyond their intended permission level. EPSS score of 0.05% (15th percentile) indicates low observed exploitation probability, and no public exploit code or CISA KEV listing exists at time of analysis.

Unauthorized data access in PickPlugins Testimonial Slider for WordPress (≤2.0.15) enables low-privilege authenticated users to retrieve testimonials without proper authorization, leading to a confidentiality breach. The vulnerability allows any logged-in subscriber to read all testimonial entries, potentially exposing sensitive content. No active exploitation or public proof-of-concept is currently known.

An access control vulnerability in the SEO Meta Description Updater WordPress plugin (versions ≤1.2.0) allows low-privileged authenticated users to modify plugin settings without proper authorization. This missing authorization flaw (CWE-862) can be exploited over the network without user interaction, leading to unauthorized manipulation of SEO meta descriptions. No public exploit or active exploitation has been identified.

Confidential data exposure via missing authorization in Nelio Content WordPress plugin versions up to 4.0.5 allows authenticated low-privileged users (e.g., subscribers) to access information restricted to editors or administrators. The flaw carries a CVSS 6.5 score, but EPSS indicates very low exploitation probability (0.04%), and no public exploit or active exploitation has been identified.

Broken access control in Conversios.io WooCommerce analytics plugin (versions ≤7.2.13) allows authenticated low-privilege users to access or modify high-sensitivity data without proper authorization checks. The vulnerability enables privilege escalation where any authenticated user can bypass intended access restrictions to read confidential information or alter plugin settings/data. EPSS score of 0.03% (9th percentile) indicates low predicted exploitation probability; no public exploit identified at time of analysis.

Authenticated information disclosure in PickPlugins Post Grid and Gutenberg Blocks plugin for WordPress (≤2.3.17) allows low-privileged users to access sensitive post data due to missing authorization checks. The vulnerability requires a valid WordPress account with at least subscriber-level privileges but no user interaction. No public exploit code or active exploitation has been observed, and EPSS indicates a low probability of widespread exploitation (0.09%).

Unauthorized information disclosure in Export Categories plugin for WordPress through version 1.0 allows unauthenticated attackers to access category data due to a missing authorization check (CWE-862). Only category information is exposed, with no integrity or availability impact. The vulnerability has a low CVSS base score of 5.3, very low EPSS exploitation probability (0.04%), and no reports of active exploitation or public proof-of-concept.

Unauthenticated remote attackers can bypass authorization controls in TS Demo Importer plugin for WordPress (versions ≤0.1.3), enabling high-impact integrity and availability compromise through misconfigured access control. EPSS scoring at 7th percentile (0.07%) suggests low observed exploitation probability. No CISA KEV listing indicates no confirmed active exploitation at time of analysis, though the authentication bypass tag and critical CVSS 9.1 rating warrant immediate attention for exposed WordPress installations.

Broken access control in IgnitionDeck WordPress plugin (versions ≤2.0.15) enables authenticated users to bypass authorization checks and perform unauthorized actions with elevated privileges. The vulnerability requires low-privilege authentication but has low attack complexity (CVSS 8.8, AV:N/AC:L/PR:L), allowing compromise of confidentiality, integrity, and availability. EPSS probability is low (0.05%, 15th percentile), and no public exploit is identified at time of analysis, suggesting limited active targeting despite the high severity rating.

Broken access control in WP Flights & Hotels Booking WP Plugin (adiaha-hotel) versions ≤3.1 allows authenticated users with low privileges to bypass authorization checks and gain unauthorized access to high-impact functionality. Attackers can achieve complete compromise of confidentiality, integrity, and availability within the plugin's scope. EPSS score of 0.05% (15th percentile) indicates low observed exploitation probability, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Missing authorization in Clicksend CF7 Plugin for WordPress versions ≤1.4.0 allows authenticated attackers to modify SMS notification settings without proper capability checks. The vulnerability has a low CVSS score of 4.3, no known public exploit, and an EPSS score of 0.06% indicating very low exploitation probability.

Missing authorization in Smart WeTransfer WordPress plugin up to version 1.3 allows authenticated users with low privileges to trigger actions that degrade service availability. The vulnerability is not known to be actively exploited, and EPSS indicates a low 0.04% probability of exploitation.

An access control weakness in Referral Link Tracker for WordPress up to 1.1.4 allows authenticated users with minimal privileges to interact with restricted plugin functionality, leading to limited availability impact. No data exposure or integrity tampering is indicated, and there is no evidence of active exploitation or public exploit code.

Unauthorized access to restricted functionality in Sunshine Photo Cart plugin for WordPress allows unauthenticated attackers to perform unauthorized actions. The vulnerability affects all versions up to and including 3.5.3, and stems from missing authorization checks that enable attackers to access functionality not properly constrained by Access Control Lists. With a low EPSS score (0.04%) and no reported active exploitation, the real-world risk is limited, though the flaw has a CVSS 5.3 medium rating.

Broken access control in King Addons for Elementor (WordPress plugin) versions through 51.1.61 allows authenticated attackers with low privileges to bypass authorization checks and gain unauthorized access to high-privilege functionality. The CVSS 8.8 score reflects potential for full compromise (high confidentiality, integrity, and availability impact), though the EPSS score of 0.05% (15th percentile) indicates minimal real-world exploitation observed. No public exploit code or CISA KEV listing identified at time of analysis. The vulnerability stems from improperly configured access control security levels (CWE-862: Missing Authorization), enabling privilege escalation by low-privileged users.

Missing authorization in RelyWP Coupon Affiliates plugin (versions up to 7.2.0) allows unauthenticated remote attackers to access restricted functionality and read sensitive data due to inadequate access control list (ACL) enforcement. The vulnerability requires no authentication and has low attack complexity, enabling attackers to bypass WordPress permission checks and retrieve coupon-related information not intended for public access.

Authenticated low-privilege users of the Seriously Simple Podcasting WordPress plugin (version ≤ 3.13.0) can bypass access controls to modify podcast content. This missing authorization flaw (CWE-862) results from incorrectly configured access control security levels. Exploitation has not been observed in the wild (EPSS 0.03%).

Missing authorization checks in WP-Lister Lite for eBay 3.8.3 and earlier allow low-privileged authenticated attackers to modify plugin data. The vulnerability has a CVSS base score of 4.3 and an EPSS score of 0.03%, indicating low exploitation probability; no active exploitation is currently known.

Unrestricted file upload in ajayrandhawa User-Management-PHP-MYSQL allows high-privilege attackers to upload arbitrary files via the image parameter in /admin/edit-user.php. Exploitation requires administrator credentials but publicly available exploit code exists. With an EPSS score of 0.06% and no active exploitation confirmed in CISA KEV, real-world risk is minimal despite the remote attack vector.

Originality.ai AI Checker plugin for WordPress allows authenticated attackers with Subscriber-level access to delete all scan result data from the wp_originalityai_log database table due to missing capability checks on the ai_scan_result_remove function in versions up to 1.0.15. The vulnerability enables unauthorized data loss affecting post titles, scan scores, and credit usage records; exploitation requires only standard WordPress authentication and no user interaction.

Originality.ai AI Checker WordPress plugin versions up to 1.0.16 allow authenticated Subscriber-level users to read sensitive data from the wp_originalityai_log database table due to missing capability checks on the 'ai_get_table' AJAX function. An attacker with basic WordPress account privileges can access post titles, scan scores, credit usage, and other logged information without authorization. No public exploit code or active exploitation has been confirmed at time of analysis.

Arbitrary media deletion in Microsoft Azure Storage for WordPress plugin versions up to 4.5.1 allows authenticated subscribers and above to delete any media files from the WordPress Media Library due to missing capability checks on the 'azure-storage-media-replace' AJAX action. The vulnerability requires access to a nonce that is exposed to all authenticated users, enabling low-privilege attackers to perform unauthorized file deletion with no user interaction required. No public exploit code has been identified at the time of analysis.

Unauthorized data modification in Sovlix MeetingHub WordPress plugin through version 1.23.9 lets authenticated low-privilege attackers bypass authorization checks and alter meeting information. No active exploitation or public exploit is known; EPSS probability is 0.03%.

Missing authorization in the Front End Users WordPress plugin (≤3.2.33) allows authenticated attackers with low privileges to modify user data without proper access controls. The flaw stems from insufficient capability checks for certain actions, enabling unauthorized integrity impact with no confidentiality or availability loss. The vulnerability has a low EPSS score and no evidence of active exploitation or public exploits.

Missing authorization checks in the Repuso Social Proof Testimonials and Reviews widget for WordPress (<=5.29) allow authenticated attackers with low privileges to disrupt service availability. Exploitation probability is very low (EPSS 0.03%) and no active exploitation or public exploit code is known at this time.

Missing authorization checks in WPXPO WowRevenue 1.2.13 and earlier allow authenticated attackers with minimal privileges to modify plugin settings without proper capability checks, leading to limited integrity impact. This affects WordPress sites running the plugin and can be exploited remotely without user interaction.

An authenticated low-privilege user in WordPress with the One Page Express Companion plugin (versions ≤ 1.6.43) can exploit a missing authorization check to modify certain plugin data, leading to limited integrity impact. There is no known public exploit or active exploitation at this time.

Missing authorization in the SmartCrawl SEO plugin for WordPress allows authenticated attackers with low privileges to modify plugin settings and potentially cause limited service disruption. Versions up to 3.14.3 are affected, requiring no user interaction and having a low CVSS score (5.4) and very low exploitation probability (EPSS 0.03%). No evidence of active exploitation or public exploit code exists at time of analysis.

Unauthenticated access to sensitive data in BuddyPress up to version 14.3.4 allows remote attackers to read confidential information due to a missing authorization check. This vulnerability affects the popular WordPress social networking plugin and can be exploited without user interaction. Public exploit code is not known to exist, and EPSS indicates a very low probability (0.04%) of active exploitation.

Missing authorization in the Acknowledgify WordPress plugin (≤1.1.3) allows low-privilege authenticated users to modify plugin data without proper capability checks. The vulnerability, classified as CWE-862, carries a CVSS 3.1 base score of 4.3 (Medium) with low attack complexity and no user interaction. No public exploit or active exploitation has been reported, and EPSS assesses a 0.03% probability of exploitation.

WordPress UiChemy plugin up to 4.0.0 allows authenticated users with low privileges to modify plugin settings due to a missing authorization check. This could lead to unauthorized changes to plugin configuration. No active exploitation or public exploit code is known, and EPSS indicates a very low probability of exploitation.

Missing authorization in WP SMS plugin for WordPress up to 7.0.1 allows authenticated attackers to modify SMS settings and message content. This could alter notification behavior or enable limited service disruption, but the impact is moderate and requires low-privilege authentication. No active exploitation or public exploit code has been reported, and EPSS indicates very low exploitation probability.

Password recovery exploitation in WordPress Emails Catch All plugin <=3.5.3 allows low-privileged authenticated attackers to reset any user’s password via an authentication bypass using an alternate channel. Successful exploitation grants full access to the target WordPress site, including data theft and site takeover. While rated High severity, the EPSS signal indicates very low real-world exploitation probability and no active exploitation is confirmed at this time.

Unauthorized order data export in WooCommerce Orders & Customers Exporter plugin <= 5.4 allows authenticated, low-privileged WordPress users to download sensitive customer and order information without needing administrative permissions. The vulnerability has a medium CVSS 6.5 score and an extremely low EPSS probability (0.04%), and no active exploitation or public exploit is reported.

Information disclosure in PickPlugins Accordion WordPress plugin up to version 2.3.14 allows authenticated low-privileged users to access confidential data via missing authorization checks. The vulnerability has a CVSS 6.5 and a low EPSS score of 0.05%, indicating no active exploitation or public exploit at this time.

Unauthenticated attackers can bypass access controls in SUMO Memberships for WooCommerce versions below 7.8.0 to perform unauthorized actions including content modification and deletion through incorrectly configured membership level enforcement. The vulnerability requires user interaction (UI:R) but affects confidentiality, integrity, and availability of protected content. No public exploit code or active exploitation has been confirmed.

Missing authorization in the Wikipedia Preview WordPress plugin (≤1.15.0) allows unauthenticated attackers to perform actions that should require authentication, leading to limited integrity and availability impact. Exploitation requires no user interaction and has low attack complexity, but no public exploit or active exploitation is reported, and the EPSS score is very low (0.04%). The flaw enables attackers to modify or disrupt plugin functionality without being authenticated.

Missing authorization in the Breeze Checkout WordPress plugin (versions through 1.4.0) exposes restricted functionality to unauthenticated network attackers, enabling low-impact integrity and availability manipulation. The vulnerability stems from CWE-862 (Missing Authorization), where plugin endpoints fail to verify that the requesting party holds appropriate permissions before executing privileged operations. No public exploit code has been identified and EPSS probability sits at 0.05% (15th percentile), indicating low current exploitation activity despite the ease of network access implied by the CVSS vector.

Authorization bypass in Houzez WordPress theme versions up to 4.2.5 allows authenticated users to access or modify resources they should not have permission to reach through insecure direct object reference (IDOR) vulnerabilities. An authenticated attacker with low privileges can exploit inadequately configured access controls to view or modify data belonging to other users, achieving limited information disclosure and integrity compromise. The vulnerability is not confirmed as actively exploited, though the attack vector is network-based with low complexity.

Missing authorization in the Billingo WordPress plugin (versions ≤4.3.0) enables authenticated high-privilege users to escalate privileges through unprotected API endpoints. CVSS 7.2 indicates network-accessible exploitation requiring high-privilege authentication with high impact across confidentiality, integrity, and availability. EPSS score of 0.06% (18th percentile) suggests low observed exploitation probability. No CISA KEV listing or public exploit identified at time of analysis, though Patchstack vulnerability database confirms the vulnerability class as both authentication bypass and privilege escalation.

Missing authorization in the Templazee WordPress plugin (versions through 1.0.2) permits authenticated low-privileged users to invoke restricted plugin functionality by exploiting improperly enforced access control boundaries. The CVSS PR:L metric confirms that a valid WordPress account with minimal privileges - such as a subscriber - is sufficient to trigger the flaw over the network with no additional interaction required. No public exploit code is identified at time of analysis, and an EPSS score of 0.01% (1st percentile) signals extremely low observed exploitation probability.

Broken access control in the Smash Balloon Social Post Feed WordPress plugin (versions up to and including 4.3.2) allows authenticated users with low privileges to perform unauthorized modifications of social feed data or settings due to missing authorization checks. No active exploitation or public exploit has been identified at this time, and EPSS indicates very low exploitation probability.

Unauthenticated information disclosure in the VibeThemes WPLMS WordPress plugin (≤1.9.9.7) allows remote attackers to access restricted functionality and read sensitive data without any interaction or privileges. The vulnerability stems from a missing authorization check, making exploitation trivial, though EPSS indicates a low probability of real-world exploitation at this time.

Insufficient authorization checks in the WPeMatico RSS Feed Fetcher WordPress plugin (versions ≤2.8.3) allow authenticated attackers with low privileges (e.g., Subscriber) to modify plugin configurations without proper access control. No active exploitation or public exploit code has been reported; the EPSS probability is very low (0.05%).

The accessiBe WordPress plugin through version 2.10 fails to enforce proper authorization checks, allowing authenticated attackers with low privileges to modify restricted plugin settings and affect availability without authorization. This missing authorization vulnerability (CWE-862) can be exploited over the network with low attack complexity, leading to limited integrity and availability impacts (no confidentiality impact). No active exploitation or public exploit code has been identified at this time.

Unauthenticated attackers can bypass access controls in the MultiVendorX WooCommerce plugin (versions up to 4.2.23), leading to unauthorized modification of plugin functionality with high integrity impact. The vulnerability has a low EPSS score (0.06%) and no known public exploit or active exploitation at time of analysis.

Unauthenticated, remote integrity impact in the CoSchedule WordPress plugin through version 3.4.0 stems from a missing authorization check. Attackers can modify plugin data without user interaction, but the low EPSS score of 0.04% and absence of known exploitation or public proof-of-concept limit real-world urgency. CVSS rates it 5.3, reflecting the low integrity-only impact.

Missing authorization in the MDTF (WordPress Meta Data & Taxonomy Filter) plugin up to version 1.3.3.9 allows authenticated low-privileged users to bypass intended access controls. An attacker with a subscriber-level account could exploit this flaw to cause a limited availability impact, such as disrupting the plugin's functionality. The flaw is rated Medium severity with an EPSS score of 0.03%, indicating a low probability of large-scale exploitation.

Unauthenticated attackers can access functionality in WPComplete versions up to 2.9.5.3 that is not properly constrained by access controls, resulting in a low availability impact. The vulnerability (CWE-862) has a CVSS 5.3 score and an EPSS exploitation probability of only 0.04%, indicating low real-world risk.

Unauthenticated integrity modification in ZoloBlocks WordPress plugin up to 2.3.11 due to missing authorization checks. The vulnerability enables remote attackers to perform unauthorized changes with low integrity impact, with no confidentiality or availability impact. EPSS score is low (0.04%), indicating a very low probability of widespread exploitation.

The Whydonate WordPress plugin through version 4.0.15 lacks proper authorization checks, enabling unauthenticated attackers to remotely access restricted functionality. This can lead to service disruption or resource exhaustion, with no data exposure or system compromise. No active exploitation is reported, but the public advisory confirms the flaw.

Missing authorization in Hydra Booking plugin versions <=1.1.9 allows authenticated low-privilege users to bypass access controls and perform unauthorized actions on booking data. An attacker could view, modify, or disrupt limited booking information, with no indication of active exploitation or publicly available exploit code.

Unauthorized functionality modification in DELUCKS SEO WordPress plugin versions 2.5.9 and below allows unauthenticated attackers to alter plugin data due to missing access controls. No active exploitation or public exploit code has been identified, and EPSS indicates a low exploitation probability despite the network‑accessible attack vector.

Unauthenticated access in the Custom CSS plugin for WordPress up to version 1.4.0 allows attackers to inject arbitrary CSS or cause service disruption due to a missing authorization check. The affected component is the custom-css-editor, which can be triggered remotely without authentication, resulting in partial integrity and availability impact. No active exploitation or public proof-of-concept is known, and the EPSS score of 0.04% indicates low likelihood of widespread attacks.

High integrity impact vulnerability in WordPress Tablesome Table Premium plugin versions <= 1.1.23 allows unauthenticated attackers to modify plugin functionality due to missing authorization checks. An attacker can access features not properly constrained by ACLs, potentially altering table configurations or data. No active exploitation or public exploit code is reported, but the flaw is remotely exploitable with low complexity.

Authentication bypass in TM2 Monitoring v3.04 allows remote attackers to circumvent login controls and access the application, which additionally stores and discloses user credentials in plaintext. Publicly available exploit code exists (POC published by researcher stSLAYER for RT-Systems' TM2), enabling full compromise of confidentiality, integrity, and availability. Not listed in CISA KEV and EPSS probability is low (0.32%), so no confirmed active exploitation despite the critical 9.8 CVSS score.

Unauthorized data modification in Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition allows remote unauthenticated attackers to alter sensitive data through APIs and multiple protocols via difficult-to-exploit integrity bypass. Affected versions include Java SE 21.0.8 and 25, GraalVM for JDK 21.0.8, and GraalVM Enterprise Edition 21.3.15. The vulnerability carries a low EPSS score (0.03%, 10th percentile) and no active exploitation has been identified, indicating limited real-world priority despite network accessibility.

Unauthorized data access in Oracle Java SE JAXP component allows remote unauthenticated attackers to exfiltrate sensitive information from multiple Java platforms including Oracle Java SE (8u461 through 25), GraalVM for JDK (17.0.16, 21.0.8), and GraalVM Enterprise Edition (21.3.15). Exploitation requires no authentication, low complexity, and can occur through web services supplying malicious data to JAXP APIs or via sandboxed Java Web Start/applet deployments loading untrusted code. Oracle released patches in October 2025 Critical Patch Update with EPSS data unavailable at time of analysis. CVSS 7.5 reflects pure confidentiality impact with network attack vector.

Improper access control in Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition allows unauthenticated remote attackers to create, delete, or modify critical data when APIs in the Security component are exposed via web services or similar mechanisms. The vulnerability affects Java 8u461 through 25 and carries a CVSS 5.9 with high integrity impact, though exploitation is difficult (AC:H) and no public exploit or active KEV status has been confirmed.

Insecure Direct Object Reference in the Moodle OpenAI Chat Block plugin 3.0.1 allows any authenticated student to hijack administrator-configured AI block sessions by supplying an arbitrary blockId to the completion API endpoint. An attacker leveraging this flaw can read admin-only 'Source of Truth' prompt configurations, steer AI responses using privileged system instructions, and consume API quota tied to another user's block. A public proof-of-concept writeup and associated GitHub repository exist, though no confirmed active exploitation (CISA KEV) has been recorded; EPSS sits at 0.23% (14th percentile), indicating low but non-zero real-world exploitation interest.

Unauthorized account access in AutoBizLine (Android package com.mysecondline.app) version 1.2.91 lets remote attackers authenticate as other users due to an incomplete identity-verification mechanism, exposing victims' personal information. The flaw is tagged as both an authentication bypass and information disclosure, and the affected user endpoint (/secondline/user/get_user/) suggests server-side access control that fails to bind a session to the correct account. No public exploit is confirmed in the input, though a third-party technical write-up exists on GitHub, and the EPSS score is low (0.33%, 25th percentile).

Authorization bypass via user-controlled key in ACE Center (VHS Electronic Software Ltd. Co.) allows a locally-authenticated low-privileged user to exploit trusted identifiers and access sensitive resources beyond their authorization level. Affected versions span 3.10.100.1768 through 3.10.161.2255, with high confidentiality impact (C:H) but no integrity or availability effect per the CVSS vector. No public exploit exists and EPSS sits at 0.02% (5th percentile), indicating no observed widespread exploitation at time of analysis.

Authentication bypass in Ascertia SigningHub v8.6.8 lets remote unauthenticated attackers brute-force the One-Time Password (OTP) verification endpoint because it enforces no rate limiting, allowing them to defeat the second verification factor and gain access to signing accounts. The flaw is tagged as an Authentication Bypass and carries a high CVSS of 8.1, though the AC:H metric reflects that success depends on iterating through the OTP keyspace. No CISA KEV listing exists and EPSS is modest (0.46%, 37th percentile), indicating no confirmed active exploitation, but a CVE-named public GitHub repository referenced by NVD suggests exploit details may be circulating.

Uncontrolled account creation in Ascertia SigningHub v8.6.8 allows an attacker to repeatedly add user accounts with no rate limiting, driving resource exhaustion and a denial-of-service condition on the e-signature platform. The flaw stems from improper access control (CWE-284) around the account-provisioning function and is exploitable over the network by a low-privileged actor per the CVSS vector (PR:L). Publicly available exploit code exists (GitHub saykino/CVE-2025-56219), but there is no confirmed active exploitation and EPSS remains low at 0.37% (29th percentile).

Authentication bypass in 70mai X200 dashcam firmware up to version 20251010 allows remote attackers to pair with the device without any authentication. The flaw resides in the Pairing component and can be exploited without user interaction or privileges. A publicly available exploit exists on GitHub, but the vendor has not responded to disclosure, leaving devices vulnerable with no official patch.

Streamax Crocus 1.3.40 allows authenticated remote attackers to bypass file upload restrictions via manipulation of the File parameter in the /FileDir.do?Action=Upload endpoint, enabling unrestricted file upload with limited direct impact. Publicly available exploit code exists and the vendor has not responded to disclosure attempts. Despite a low CVSS score of 2.1, the combination of public exploit availability and vendor non-response elevates operational risk, particularly if the upload mechanism can be chained with other vulnerabilities to achieve code execution.