CWE-862

The MailerPress – Newsletter, email marketing & AI automation plugin for WordPress is vulnerable to unauthorized access

The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, inline di

The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks before returning a group's member

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up

Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions.

Custom role Broken Access Control in Dokan <= 5.0.10 versions.

Unauthenticated Broken Access Control in Profile Builder <= 3.16.5 versions.

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a RES

The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modif

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.ano

The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allo

An unauthenticated user may access restricted repository information under specific conditions.

An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in

Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.

Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions.

Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.

Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions.

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versi

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwis

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source AP

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allo

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allo

phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments an

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could cause Splunk Enterprise to reload token-s

The AI Agent by SiteGround plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includi

Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control S

The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its p

The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8

Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions.

Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions.

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to authorization bypass i

The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass i

Missing authorization in WebAppInstalls in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker

Missing authorization in Sensor in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised th

The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before r

The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a reservation through i

The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only f

The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed t

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.

Subscriber Broken Access Control in Ditty <= 3.1.67 versions.

Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions.

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capab

The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns t

The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and th

An erroneous authorization check in SAP Business Workflow leads to privilege escalation. An authenticated administrative