Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,233 results · page 3 of 125
Oct 22, 2026Falcon – WordPress Optimizations & Tweaks: Missing AuthorizationCVE-2026-112826 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in eLightUp Falcon – WordPress Optimizations & Tweaks falcon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Falcon – WordPress Optimizations & Tweaks: from n/a through 2.12.0.
- Product
- Falcon – WordPress Optimizations & Tweaks
- Affected
- up to 2.12.0
- What to do
- Affects up to 2.12.0. Update Falcon – WordPress Optimizations & Tweaks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026MarketKing: Missing AuthorizationCVE-2026-111847 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Kings Plugins MarketKing marketking-multivendor-marketplace-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MarketKing: from n/a through 2.1.72.
- Product
- MarketKing
- Affected
- up to 2.1.72
- What to do
- Affects up to 2.1.72. Update MarketKing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026Photo Engine (Media Organizer & Lightroom): Does not verify that a user is authorised to act on the targeted media attachmentCVE-2026-111972 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users and administrators.
- Product
- Photo Engine (Media Organizer & Lightroom)
- Fixed in
- 6.5.8
- What to do
- Update Photo Engine (Media Organizer & Lightroom) to 6.5.8 or newer.
Oct 22, 2026Infility Global: Does not perform any authorisation or nonce check on an AJAX action available to unauthenticated usersCVE-2026-109931 · WordPress plugins & themes · reported by WPScanLow 3.7
The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action available to unauthenticated users, allowing any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before 2.16.25.
- Product
- Infility Global
- Fixed in
- 2.16.25
- What to do
- Update Infility Global to 2.16.25 or newer.
Oct 21, 2026eRoom: Missing AuthorizationCVE-2026-114176 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom: from n/a through 1.7.1.
- Product
- eRoom
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update eRoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026H5P: Authorization Bypass Through User-Controlled KeyCVE-2026-112868 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through 1.17.9.
- Product
- H5P
- Affected
- up to 1.17.9
- What to do
- Affects up to 1.17.9. Update H5P to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026BjornTech Swish for WooCommerce: Missing AuthorizationCVE-2026-111835 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in bjorntech BjornTech Swish for WooCommerce woo-swish-e-commerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BjornTech Swish for WooCommerce: from n/a through 3.7.8.
- Product
- BjornTech Swish for WooCommerce
- Affected
- up to 3.7.8
- What to do
- Affects up to 3.7.8. Update BjornTech Swish for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publCVE-2026-114120 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpsp_el_editor_form AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or reschedule administrator posts, or publish other users' pending or draft posts.
- Fixed in
- 5.3.5
- What to do
- Update the plugin to 5.3.5 or newer.
Oct 21, 2026WpTravelly: Missing AuthorizationCVE-2026-111849 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.5.
- Product
- WpTravelly
- Affected
- up to 2.3.5
- What to do
- Affects up to 2.3.5. Update WpTravelly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026Click n Chat (Chat Widget Integration): Does not perform any authorization check on a lead-export handlerCVE-2026-92999 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not perform any authorization check on a lead-export handler, allowing unauthenticated users to download every captured contact record (names, email addresses and phone numbers).
- Product
- Click n Chat (Chat Widget Integration)
- Fixed in
- 1.1.3
- What to do
- Update Click n Chat (Chat Widget Integration) to 1.1.3 or newer.
Oct 21, 2026Wava Payment: Does not perform any authorisationCVE-2026-87838 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored credential that identifies the merchant account the store's payments are created against, to force the integration into a verified state the site owner never completed, and to remove the payment method from the store's checkout.
- Product
- Wava Payment
- Fixed in
- 0.3.10
- What to do
- Update Wava Payment to 0.3.10 or newer.
Oct 21, 2026Pricing Table: Does not perform authorisation checksCVE-2026-111947 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating a legacy pricing table, allowing users with the contributor role and above to clone and publish any post or page on the site, including private and draft content belonging to other users.
- Product
- Pricing Table
- Fixed in
- 4.1.3
- What to do
- Update Pricing Table to 4.1.3 or newer.
Oct 21, 2026SmartyParcel: Does not perform authorisation checksCVE-2026-107789 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers.
- Product
- SmartyParcel
- Fixed in
- 1.23.4
- What to do
- Update SmartyParcel to 1.23.4 or newer.
Oct 21, 2026SmartyParcel: Does not perform authorisation checksCVE-2026-107788 · WordPress plugins & themes · reported by WPScanMedium 4.3
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide.
- Product
- SmartyParcel
- Fixed in
- 1.23.4
- What to do
- Update SmartyParcel to 1.23.4 or newer.
Oct 21, 2026Booking Package: Does not perform authorization checks before returning calendar-account configuration in a responseCVE-2026-105999 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses.
- Product
- Booking Package
- Fixed in
- 1.7.31
- What to do
- Update Booking Package to 1.7.31 or newer.
Oct 21, 2026Booking Package: Does not perform any authorization or validity check before resetting its premium subscription stateCVE-2026-105998 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features.
- Product
- Booking Package
- Fixed in
- 1.7.31
- What to do
- Update Booking Package to 1.7.31 or newer.
Oct 21, 2026Synchrony Financing: Does not properly authorise requests to one of its REST routes that modifies WooCommerce ordersCVE-2026-100145 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes that modifies WooCommerce orders, allowing unauthenticated attackers to reassign any order to an account they control, tamper with its details, and read the associated customer's personal data.
- Product
- Synchrony Financing
- Fixed in
- 1.1.2
- What to do
- Update Synchrony Financing to 1.1.2 or newer.
Oct 20, 2026Participants Database: Authorization Bypass Through User-Controlled KeyCVE-2026-112861 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-database allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Participants Database: from n/a through 2.7.8.5.
- Product
- Participants Database
- Affected
- up to 2.7.8.5
- What to do
- Affects up to 2.7.8.5. Update Participants Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026Booktics: Missing AuthorizationCVE-2026-112829 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.30.
- Product
- Booktics
- Affected
- up to 1.0.30
- What to do
- Affects up to 1.0.30. Update Booktics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026Bus Ticket Booking with Seat Reservation: Missing AuthorizationCVE-2026-112824 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7.
- Product
- Bus Ticket Booking with Seat Reservation
- Affected
- up to 5.9.7
- What to do
- Affects up to 5.9.7. Update Bus Ticket Booking with Seat Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026WP User Manager: Missing AuthorizationCVE-2026-112823 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.This issue affects WP User Manager: from n/a through 2.9.25.
- Product
- WP User Manager
- Affected
- up to 2.9.25
- What to do
- Affects up to 2.9.25. Update WP User Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026Meta Box – WordPress Custom Fields Framework: Missing AuthorizationCVE-2026-109700 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.2.
- Product
- Meta Box – WordPress Custom Fields Framework
- Affected
- up to 5.15.2
- What to do
- Affects up to 5.15.2. Update Meta Box – WordPress Custom Fields Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026Seriously Simple Podcasting: Missing AuthorizationCVE-2026-112834 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0.
- Product
- Seriously Simple Podcasting
- Affected
- up to 3.17.0
- What to do
- Affects up to 3.17.0. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions,CVE-2026-113353 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.
- Fixed in
- 4.4.10
- What to do
- Update the plugin to 4.4.10 or newer.
Full record and what to do →NVD recordgithub.comlearnpresslms.com
Oct 20, 2026Easy Property Listings: Does not perform authorisation checks on several of its contact-management read AJAX actionsCVE-2026-96903 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private activity notes.
- Product
- Easy Property Listings
- Fixed in
- 3.5.27
- What to do
- Update Easy Property Listings to 3.5.27 or newer.
Oct 19, 2026Surfer: Missing AuthorizationCVE-2026-112222 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.8.0.744.
- Product
- Surfer
- Affected
- up to 1.8.0.744
- What to do
- Affects up to 1.8.0.744. Update Surfer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 19, 2026Event Tickets: Authorization Bypass Through User-Controlled KeyCVE-2026-110902 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1.
- Product
- Event Tickets
- Affected
- up to 5.30.1
- What to do
- Affects up to 5.30.1. Update Event Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 19, 2026YITH WooCommerce Product Bundles: Missing AuthorizationCVE-2026-111845 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0.
- Product
- YITH WooCommerce Product Bundles
- Affected
- up to 2.29.0
- What to do
- Affects up to 2.29.0. Update YITH WooCommerce Product Bundles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 19, 2026Broadcast Live Video: Missing AuthorizationCVE-2026-111839 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.7.
- Product
- Broadcast Live Video
- Affected
- up to 7.3.7
- What to do
- Affects up to 7.3.7. Update Broadcast Live Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 19, 2026FluentCommunity: Missing AuthorizationCVE-2026-111836 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP ManageNinja LLC FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentCommunity: from n/a through 2.11.0.
- Product
- FluentCommunity
- Affected
- up to 2.11.0
- What to do
- Affects up to 2.11.0. Update FluentCommunity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 19, 2026FluentForm: Missing AuthorizationCVE-2026-111831 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.15.
- Product
- FluentForm
- Affected
- up to 6.2.15
- What to do
- Affects up to 6.2.15. Update FluentForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 19, 2026LearnPress: Missing AuthorizationCVE-2026-110363 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10.
- Product
- LearnPress
- Affected
- up to 4.4.10
- What to do
- Affects up to 4.4.10. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 19, 2026App Builder: Does not require authentication or authorisation before writing attacker-supplied data to one of its options andCVE-2026-94294 · WordPress plugins & themes · reported by WPScanMedium 5.3
The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data.
- Product
- App Builder
- Fixed in
- 5.7.1
- What to do
- Update App Builder to 5.7.1 or newer.
Oct 19, 2026Snap Finance: Does not verify that a request to change a WooCommerce order's status comes from an authorised sourceCVE-2026-94272 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail.
- Product
- Snap Finance
- Fixed in
- 3.12.0
- What to do
- Update Snap Finance to 3.12.0 or newer.
Oct 19, 2026TrueBooker: Does not have authorisation checks in place in some of its functionalityCVE-2026-94231 · WordPress plugins & themes · reported by WPScanMedium 5.3
The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices.
- Product
- TrueBooker
- Fixed in
- 1.3.0
- What to do
- Update TrueBooker to 1.3.0 or newer.
Oct 19, 2026TrueBooker: Does not have authorisation checks in some of its AJAX actionsCVE-2026-94230 · WordPress plugins & themes · reported by WPScanMedium 5.3
The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer accounts.
- Product
- TrueBooker
- Fixed in
- 1.3.0
- What to do
- Update TrueBooker to 1.3.0 or newer.
Oct 19, 2026ElementsReady Addons for Elementor: Does not perform authorization checks that halt execution in several of its settings-save handlersCVE-2026-91046 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several of its settings-save handlers, allowing users with subscriber-level access and above to overwrite the ElementsReady Addons for Elementor WordPress plugin through 6.7.2's stored settings, including its stored API credentials and its feature and template configuration.
- Product
- ElementsReady Addons for Elementor
- Affected
- up to 6.7.2
- What to do
- Affects up to 6.7.2. Update ElementsReady Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 19, 2026ActiveTrail for WooCommerce: Does not perform any authorization check before creating WooCommerce couponsCVE-2026-106028 · WordPress plugins & themes · reported by WPScanMedium 5.3
The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons, allowing unauthenticated attackers to create arbitrary coupons, including 100%-off and free-shipping coupons.
- Product
- ActiveTrail for WooCommerce
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update ActiveTrail for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2026Kit (formerly ConvertKit): Missing AuthorizationCVE-2026-110880 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.6.
- Product
- Kit (formerly ConvertKit)
- Affected
- up to 3.4.6
- What to do
- Affects up to 3.4.6. Update Kit (formerly ConvertKit) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2026Electronic Signature Add-on for Fluent Forms: Authorization Bypass Through User-Controlled KeyCVE-2026-110383 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent Forms: from n/a through 2.0.5.
- Product
- Electronic Signature Add-on for Fluent Forms
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Electronic Signature Add-on for Fluent Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2026Advanced File Manager: Missing AuthorizationCVE-2026-110365 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14.
- Product
- Advanced File Manager
- Affected
- up to 5.4.14
- What to do
- Affects up to 5.4.14. Update Advanced File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2026Modern Events Calendar Lite: Does not verify that a user is authorized to edit the target post before updating itCVE-2026-110070 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users.
- Product
- Modern Events Calendar Lite
- Fixed in
- 7.36.4
- What to do
- Update Modern Events Calendar Lite to 7.36.4 or newer.
Oct 17, 2026SMS Alert Order Notifications: Missing AuthorizationCVE-2026-110882 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: from n/a through 4.0.1.
- Product
- SMS Alert Order Notifications
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update SMS Alert Order Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2026Patreon: Does not perform an authorization check on some of its functionalityCVE-2026-92431 · WordPress plugins & themes · reported by WPScanLow 3.7
The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end.
- Product
- Patreon
- Fixed in
- 1.10.0
- What to do
- Update Patreon to 1.10.0 or newer.
Oct 17, 2026WP Data Access: Does not have authorisation and CSRF checks in one of its actionsCVE-2026-106470 · WordPress plugins & themes · reported by WPScanMedium 5
The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome.
- Product
- WP Data Access
- Fixed in
- 5.5.88
- What to do
- Update WP Data Access to 5.5.88 or newer.
Oct 17, 2026PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI): Does not perform any capability or ownership check before returning an order's secret key in response to an unCVE-2026-103376 · WordPress plugins & themes · reported by WPScanMedium 5.3
The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to retrieve the key for any paid order and use it to view that order's customer name, email address, postal address and contents.
- Product
- PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)
- Fixed in
- 1.120.70
- What to do
- Update PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) to 1.120.70 or newer.
Oct 17, 2026WP Booking System – Booking Calendar: Authorization bypassCVE-2026-109369 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to grant themselves and arbitrary other users edit access to every booking form on the site by overwriting the user_permission meta that governs the plugin's own access-control list. Exploitation requires the attacker to have already been delegated edit rights on at least one booking form, as this delegation both downgrades the submenu capability to 'read' (making the edit page accessible) and allows them to harvest a valid wpbs_edit_form nonce that will pass validation against any other form_id.
- Product
- WP Booking System – Booking Calendar
- Affected
- up to 2.1.0.3
- What to do
- Affects up to 2.1.0.3. Update WP Booking System – Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 17, 2026WP Booking System – Booking Calendar: Authorization bypassCVE-2026-108123 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII including names, email addresses, phone numbers, messages, and booking dates intended to be visible only to administrators. This is exploitable by any Subscriber-level user because admin_init fires on profile.php, a wp-admin page accessible to all authenticated users.
- Product
- WP Booking System – Booking Calendar
- Affected
- up to 2.1.0.3
- What to do
- Affects up to 2.1.0.3. Update WP Booking System – Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 17, 2026LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Authorization bypassCVE-2026-107744 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate the complete site user roster and extract the full email address of any WordPress account, including administrator accounts, character-by-character by using the search response as an oracle against both user_login and user_email columns.
- Product
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
- Affected
- up to 4.4.10
- What to do
- Affects up to 4.4.10. Update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026Fastcache by Host.it: Authorization bypassCVE-2026-107763 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to add or remove the plugin's page-cache rewrite rules in the site's root .htaccess file.
- Product
- Fastcache by Host.it
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update Fastcache by Host.it to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.