CWE-862
CVEs classified under CWE-862, newest first.
3424 CVEsRSS
CVE-2026-106002Medium· 5.3Court Reservation < 1.12.4 - Unauthenticated Arbitrary Challenge Deletion
The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of its challenge-management actions, allowing unauthenticated users to delete arbitrary tournament-ladder challenge rec…
CVE-2026-105997Medium· 5.3Booking Package < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary Recipient
The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verific…
CVE-2026-107097Medium· 5.3Royal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience Injection via mailchimp_subscribe
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing …
CVE-2026-106647Low· 3.8Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget ID Collision
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storing it in a site-global namespace keyed only on a non-secret, …
CVE-2026-110691Medium· 6.5WPOrLogin < 3.1.0 - Unauthenticated Hide Login Slug Update
The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its hidden-login URL settings, which could allow unauthenticated attackers to reassign the login, registration and passw…
CVE-2026-113813Medium· 6.5PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure
The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated…
CVE-2026-76058Medium· 5.3PayPal Brasil para WooCommerce <= 1.7.8 - Missing Authorization to Unauthenticated Payment Gateway Modification via 'bcdc_activation_update' Action
The PayPal Brasil para WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. T…
CVE-2026-111372Medium· 4.3AI ChatBot for WooCommerce <= 5.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via qcld_rag_manual_sync AJAX Action
The AI ChatBot for WooCommerce – WoowBot plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an act…
CVE-2026-109979Medium· 4.3Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_create_link' Parameter
The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.0.0 via the 'rp4wp_create_link' parameter of the hidden 'rp4wp_link_related' admin page. The handle_…
CVE-2026-110020Medium· 6.5Rich Showcase for Google Reviews <= 7.1.6 - Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin Page
The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.1.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. …
CVE-2026-109980Medium· 4.3Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_view' Parameter
The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the 'rp4wp_view' parameter. This makes it possible for authenticated attackers, with con…
CVE-2026-116610Medium· 4.3Clean Login <= 1.20.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update via 'save_post' Hook
The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.20.1 due to a missing capability check on the CleanLogin_Shortcode::get_pages_with_shortcodes() function hooked to the save_p…
CVE-2026-111213Medium· 4.3Travelly <= 2.3.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' Parameter
The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6 This is due to the plugin not properly verifying that a user is authorize…
CVE-2026-2839Medium· 5.3Advanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthorized access of data and triggering of server-side actions in all versions up to, and including, 0.9.2.7. This is due to multiple AJAX handlers registered …
CVE-2026-116613High· 7.5Animated Text Block <= 1.2.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attribute
The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.6 via the 'animated-text' shortcode. This is due to the atb_shortcode_handler() function fetching an arbit…
CVE-2026-115624Medium· 5.3GROWI contains a missing authorization check vulnerability in its collaborative editing feature
GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited stat…
CVE-2026-56828High· 8.8Shopper: read-only team permissions allow administrator creation and permission escalation
Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authorization fix. A staff member with only `view_users` and `access_…
CVE-2026-59185High· 8.5identrail: Cross-tenant GitHub installation binding without ownership verification
identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on `POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete` endpoint in `internal/api/router.go` …
CVE-2026-118353High· 8.8Missing authorization in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted HTML page
Missing authorization in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-118333Medium· 5.4Buffer overflow in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
Buffer overflow in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-58255High· 8.8Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with `create_events` and `run_events` privileges can inject top-level `uid` and `gid` field…
CVE-2026-112355High· 7.5MembershipWorks WordPress Plugin < 6.17 Information Disclosure via WordPress REST API
The MembershipWorks plugin for WordPress before 6.17 contains an information disclosure vulnerability that allows unauthenticated attackers to access member-only content through the WordPress REST API. Because the filter that strips prot…
CVE-2026-118170Critical· 9.1CVE-2026-118170
The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.
CVE-2026-118171Medium· 6.5CVE-2026-118171
The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permis…
CVE-2026-116660Medium· 4.3Tanium addressed an improper access controls vulnerability in Enforce.
Tanium addressed an improper access controls vulnerability in Enforce.
CVE-2026-108301Medium· 6.0Tanium addressed an improper access controls vulnerability in Comply.
Tanium addressed an improper access controls vulnerability in Comply.
CVE-2026-16491Medium· 6.5CVE-2026-16491 CVE Record
Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an…
CVE-2026-116677Medium· 5.3OpenWISP Controller CA CRL REST API does not scope requests to managed organizations
OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca/<integer-id>/crl endpoint allows an authenticated organiz…
CVE-2026-90465High· 8.7Fireware OS Missing Authentication in FireCluster Sync Allows Privilege Escalation
A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to invoke privileged firewall managem…
CVE-2026-93865Critical· 9.2Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection
A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the…