CWE-862

The Accordion and Accordion Slider plugin for WordPress is vulnerable to authorization bypass in all versions up to, and

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to unauthorized arbitrary shortcode execution in all ve

The News Element Elementor Blog Magazine plugin for WordPress is vulnerable to Missing Authorization in all versions up

Missing Authorization vulnerability in BBR Plugins Better Business Reviews better-business-reviews allows Exploiting Inc

Missing Authorization vulnerability in 10up Autoshare for Twitter autoshare-for-twitter allows Exploiting Incorrectly Co

Missing Authorization vulnerability in scripteo Ads Pro ap-plugin-scripteo allows Exploiting Incorrectly Configured Acce

Missing Authorization vulnerability in WP Grids WP Wand ai-content-generation allows Exploiting Incorrectly Configured A

Missing Authorization vulnerability in AA-Team WZone woozone allows Exploiting Incorrectly Configured Access Control Sec

Missing Authorization vulnerability in Designinvento DirectoryPress directorypress allows Exploiting Incorrectly Configu

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, `discourse-policy`

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. A missing authorization vulner

wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to move, merge,

IBM Engineering Requirements Management DOORS Next 7.1, and 7.2 could allow an authenticated user to view and edit data

The Enable Media Replace plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capa

Missing Authorization vulnerability in Israpil Textmetrics webtexttool allows Exploiting Incorrectly Configured Access C

Missing Authorization vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly

Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-mana

Missing Authorization vulnerability in linethemes GLB glb allows Exploiting Incorrectly Configured Access Control Securi

Missing Authorization vulnerability in linethemes Nanosoft nanosoft allows Exploiting Incorrectly Configured Access Cont

Missing Authorization vulnerability in linethemes SmartFix smartfix allows Exploiting Incorrectly Configured Access Cont

Missing Authorization vulnerability in bPlugins PDF Poster pdf-poster allows Exploiting Incorrectly Configured Access Co

Missing Authorization vulnerability in wppochipp Pochipp pochipp allows Exploiting Incorrectly Configured Access Control

Missing Authorization vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Exploiting

Missing Authorization vulnerability in Saad Iqbal WP EasyPay wp-easy-pay allows Exploiting Incorrectly Configured Access

The Yoast Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.

The User Registration & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a miss

Missing Authorization vulnerability in WP Folio Team PPWP password-protect-page allows Exploiting Incorrectly Configured

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to versio

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/Live/uploadPoster.php` e

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, authenticate

The Restaurant Cafeteria WordPress theme through 0.4.6 exposes insecure admin-ajax actions without nonce or capability c

Missing Authorization vulnerability in OceanWP Ocean Extra allows Exploiting Incorrectly Configured Access Control Secur

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, jb child processe

The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing cap

Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect allows Exploiting Incorrectly Configured

Missing Authorization vulnerability in Wpbens Filter Plus filter-plus allows Exploiting Incorrectly Configured Access Co

Missing Authorization vulnerability in ilGhera JW Player for WordPress jw-player-7-for-wp allows Exploiting Incorrectly

The Ziggeo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1. The

OpenClaw before 2026.3.24 contains missing authorization vulnerabilities in the /send and /allowlist chat command handle

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course e

Missing Authorization vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control S

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Commun

OpenClaw before 2026.4.2 fails to enforce write scopes on the POST /sessions/:sessionKey/kill endpoint in identity-beari

OpenClaw before 2026.3.31 contains an authorization bypass vulnerability in Discord voice ingress that allows attackers

Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to

Due to missing authorization check in SAP Strategic Enterprise Management (Scorecard Wizard in Business Server Pages), a

Missing Authorization vulnerability in Broadstreet Broadstreet Ads broadstreet allows Exploiting Incorrectly Configured

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Missing Authorization in all v