Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,273 results · page 18 of 86
Mar 25, 2026LearnPress – Sepay Payment: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-25002 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authentication Bypass Using an Alternate Path or Channel vulnerability in ThimPress LearnPress – Sepay Payment learnpress-sepay-payment allows Authentication Abuse.This issue affects LearnPress – Sepay Payment: from n/a through <= 4.0.0.
- Product
- LearnPress – Sepay Payment
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update LearnPress – Sepay Payment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026WP System Log: Missing AuthorizationCVE-2026-24987 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in activity-log.com WP System Log winterlock allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP System Log: from n/a through <= 1.2.7.
- Product
- WP System Log
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update WP System Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Elated Listing: Missing AuthorizationCVE-2026-24972 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Elated-Themes Elated Listing eltd-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elated Listing: from n/a through <= 1.4.
- Product
- Elated Listing
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Elated Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026News Magazine X: Missing AuthorizationCVE-2026-24382 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in wproyal News Magazine X news-magazine-x allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects News Magazine X: from n/a through <= 1.2.50.
- Product
- News Magazine X
- Affected
- up to 1.2.50
- What to do
- Affects up to 1.2.50. Update News Magazine X to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026WPVulnerability: Missing AuthorizationCVE-2026-24376 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Javier Casares WPVulnerability wpvulnerability allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPVulnerability: from n/a through <= 4.2.1.
- Product
- WPVulnerability
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update WPVulnerability to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026The Grid: Missing AuthorizationCVE-2026-24369 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Grid: from n/a through 2.8.0.
- Product
- The Grid
- Affected
- up to 2.8.0
- What to do
- Affects up to 2.8.0. Update The Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026WP User Frontend: Missing AuthorizationCVE-2026-24364 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through <= 4.2.5.
- Product
- WP User Frontend
- Affected
- up to 4.2.5
- What to do
- Affects up to 4.2.5. Update WP User Frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026WP Cost Estimation & Payment Forms Builder: Missing AuthorizationCVE-2026-24363 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in loopus WP Cost Estimation & Payment Forms Builder WP_Estimation_Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cost Estimation & Payment Forms Builder: from n/a through < 10.3.0.
- Product
- WP Cost Estimation & Payment Forms Builder
- What to do
- Update WP Cost Estimation & Payment Forms Builder to the newest version.
Mar 25, 2026Ultimate Post Kit: Missing AuthorizationCVE-2026-24362 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in bdthemes Ultimate Post Kit ultimate-post-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Post Kit: from n/a through <= 4.0.21.
- Product
- Ultimate Post Kit
- Affected
- up to 4.0.21
- What to do
- Affects up to 4.0.21. Update Ultimate Post Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Dokan: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-24359 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Dokan, Inc. Dokan dokan-lite allows Authentication Abuse.This issue affects Dokan: from n/a through <= 4.2.4.
- Product
- Dokan
- Affected
- up to 4.2.4
- What to do
- Affects up to 4.2.4. Update Dokan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Helpdesk Support Ticket System for WooCommerce: Missing AuthorizationCVE-2026-23977 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in WPFactory Helpdesk Support Ticket System for WooCommerce support-ticket-system-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Helpdesk Support Ticket System for WooCommerce: from n/a through <= 2.1.2.
- Product
- Helpdesk Support Ticket System for WooCommerce
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Helpdesk Support Ticket System for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Booking and Rental Manager: Missing AuthorizationCVE-2026-23972 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through <= 2.6.0.
- Product
- Booking and Rental Manager
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update Booking and Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Jobs for: Missing AuthorizationCVE-2026-23806 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in BlueGlass Interactive AG Jobs for WordPress job-postings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Jobs for WordPress: from n/a through <= 2.8.
- Product
- Jobs for
- Affected
- up to 2.8
- What to do
- Affects up to 2.8. Update Jobs for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026My Album Gallery: Missing AuthorizationCVE-2026-22485 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Ruhul Amin My Album Gallery my-album-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Album Gallery: from n/a through <= 1.0.4.
- Product
- My Album Gallery
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update My Album Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026EventPrime: Missing AuthorizationCVE-2025-69358 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through <= 4.2.6.0.
- Product
- EventPrime
- Affected
- up to 4.2.6.0
- What to do
- Affects up to 4.2.6.0. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 21, 2026Speedup Optimization: Missing AuthorizationCVE-2026-4127 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Speedup Optimization plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.5.9. The `speedup01_ajax_enabled()` function, which handles the `wp_ajax_speedup01_enabled` AJAX action, does not perform any capability check via `current_user_can()` and also lacks nonce verification. This is in contrast to other AJAX handlers in the same plugin (e.g., `speedup01_ajax_install_iox` and `speedup01_ajax_delete_cache_file`) which properly check for `install_plugins` and `manage_options` capabilities respectively. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable or disable the site's optimization module by sending a POST request to admin-ajax.
- Product
- Speedup Optimization
- Affected
- up to 1.5.9
- What to do
- Affects up to 1.5.9. Update Speedup Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 21, 2026Punnel – Landing Page Builder: Missing AuthorizationCVE-2026-3645 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Punnel – Landing Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.1. The save_config() function, which handles the 'punnel_save_config' AJAX action, lacks any capability check (current_user_can()) and nonce verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin's entire configuration including the API key via a POST request to admin-ajax.php. Once the API key is known (because the attacker set it), the attacker can use the plugin's public API endpoint (sniff_requests() at /?punnel_api=1) — which only validates requests by comparing a POST token against the stored api_key — to create, update, or delete arbitrary posts, pages, and products on the site.
- Product
- Punnel – Landing Page Builder
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Punnel – Landing Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 21, 2026Canto: Missing AuthorizationCVE-2026-3335 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Canto plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1 via the `/wp-content/plugins/canto/includes/lib/copy-media.php` file. This is due to the file being directly accessible without any authentication, authorization, or nonce checks, and the `fbc_flight_domain` and `fbc_app_api` URL components being accepted as user-supplied POST parameters rather than read from admin-configured options. Since the attacker controls both the destination server and the `fbc_app_token` value, the entire fetch-and-upload chain is attacker-controlled — the server never contacts Canto's legitimate API, and the uploaded file originates entirely from the attacker's infrastructure. This makes it possible for unauthenticated attackers to upload arbitrary files (constrained to WordPress-allowed MIME types) to the WordPress uploads directory. Additional endpoints (`detail.php`, `download.php`, `get.php`, `tree.php`) are also directly accessible without authentication and make requests using a user-supplied `app_api` parameter combined with an admin-configured subdomain.
- Product
- Canto
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update Canto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 21, 2026Company Posts for LinkedIn: Missing AuthorizationCVE-2026-1935 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Company Posts for LinkedIn plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.0. This is due to a missing capability check on the `linkedin_company_post_reset_handler()` function hooked to `admin_post_reset_linkedin_company_post`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete LinkedIn post data stored in the site's options table.
- Product
- Company Posts for LinkedIn
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Company Posts for LinkedIn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 20, 2026RockPress: Missing AuthorizationCVE-2026-3550 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The RockPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.17. This is due to missing capability checks on multiple AJAX actions (rockpress_import, rockpress_import_status, rockpress_last_import, rockpress_reset_import, and rockpress_check_services) combined with the plugin's nonce being exposed to all authenticated users via an unconditionally enqueued admin script. The plugin enqueues the 'rockpress-admin' script on all admin pages (including profile.php) without any page or capability restrictions, and the nonce for the 'rockpress-nonce' action is passed to this script via wp_localize_script. Since the AJAX handlers only verify this nonce and do not check current_user_can(), any authenticated user, including Subscribers, can extract the nonce from any admin page's HTML source and use it to trigger imports, reset import data (deleting options), check service connectivity, and read import status information. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger resource-intensive import operations, reset import tracking data, and perform system connection checks that should be
- Product
- RockPress
- Affected
- up to 1.0.17
- What to do
- Affects up to 1.0.17. Update RockPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 19, 2026Fraud Prevention For Woocommerce: Missing AuthorizationCVE-2026-25443 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Dotstore Fraud Prevention For Woocommerce woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fraud Prevention For Woocommerce: from n/a through <= 2.3.3.
- Product
- Fraud Prevention For Woocommerce
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Fraud Prevention For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 19, 2026Admin Safety Guard: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-25471 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Authentication Bypass Using an Alternate Path or Channel vulnerability in Themepaste Admin Safety Guard admin-safety-guard allows Password Recovery Exploitation.This issue affects Admin Safety Guard: from n/a through <= 1.2.6.
- Product
- Admin Safety Guard
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update Admin Safety Guard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 19, 2026EventPrime: Missing AuthorizationCVE-2026-25312 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through <= 4.2.8.3.
- Product
- EventPrime
- Affected
- up to 4.2.8.3
- What to do
- Affects up to 4.2.8.3. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 19, 2026UiPress lite: Missing AuthorizationCVE-2026-27091 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in UiPress UiPress lite uipress-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UiPress lite: from n/a through <= 3.5.09.
- Product
- UiPress lite
- Affected
- up to 3.5.09
- What to do
- Affects up to 3.5.09. Update UiPress lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 19, 2026WP eMember: Missing AuthorizationCVE-2026-28070 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Tips and Tricks HQ WP eMember allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP eMember: from n/a through v10.2.2.
- Product
- WP eMember
- Affected
- up to v10.2.2
- What to do
- Affects up to v10.2.2. Update WP eMember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 18, 2026Contextual Related Posts: Missing AuthorizationCVE-2026-32565 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ajay Contextual Related Posts contextual-related-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contextual Related Posts: from n/a through < 4.2.2.
- Product
- Contextual Related Posts
- What to do
- Update Contextual Related Posts to the newest version.
Mar 17, 2026Booster for WooCommerce: Missing AuthorizationCVE-2026-32586 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booster for WooCommerce: from n/a through < 7.11.3.
- Product
- Booster for WooCommerce
- What to do
- Update Booster for WooCommerce to the newest version.
Mar 16, 2026WP EasyPay: Missing AuthorizationCVE-2026-32587 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Saad Iqbal WP EasyPay wp-easy-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP EasyPay: from n/a through <= 4.2.11.
- Product
- WP EasyPay
- Affected
- up to 4.2.11
- What to do
- Affects up to 4.2.11. Update WP EasyPay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 16, 2026Modern Events Calendar: Missing AuthorizationCVE-2026-32583 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Webnus Inc. Modern Events Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Modern Events Calendar: from n/a through 7.29.0.
- Product
- Modern Events Calendar
- Affected
- up to 7.29.0
- What to do
- Affects up to 7.29.0. Update Modern Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Responsive Blocks: Missing AuthorizationCVE-2026-32543 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CyberChimps Responsive Blocks responsive-block-editor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Blocks: from n/a through <= 2.2.0.
- Product
- Responsive Blocks
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Responsive Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Lawyer Landing Page: Missing AuthorizationCVE-2026-32487 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Lawyer Landing Page lawyer-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lawyer Landing Page: from n/a through <= 1.2.7.
- Product
- Lawyer Landing Page
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Lawyer Landing Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Travel Booking: Missing AuthorizationCVE-2026-32486 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wptravelengine Travel Booking travel-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Booking: from n/a through <= 1.3.9.
- Product
- Travel Booking
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Travel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Really Simple SSL: Missing AuthorizationCVE-2026-32461 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Really Simple Plugins Really Simple SSL really-simple-ssl allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Really Simple SSL: from n/a through <= 9.5.7.
- Product
- Really Simple SSL
- Affected
- up to 9.5.7
- What to do
- Affects up to 9.5.7. Update Really Simple SSL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Advanced Product Fields (Product Addons) for WooCommerce: Missing AuthorizationCVE-2026-32457 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Wombat Plugins Advanced Product Fields (Product Addons) for WooCommerce advanced-product-fields-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Product Fields (Product Addons) for WooCommerce: from n/a through <= 1.6.18.
- Product
- Advanced Product Fields (Product Addons) for WooCommerce
- Affected
- up to 1.6.18
- What to do
- Affects up to 1.6.18. Update Advanced Product Fields (Product Addons) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Avada Core: Missing AuthorizationCVE-2026-32453 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeFusion Avada Core fusion-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Avada Core: from n/a through < 5.15.0.
- Product
- Avada Core
- What to do
- Update Avada Core to the newest version.
Mar 13, 2026Fusion Builder: Missing AuthorizationCVE-2026-32452 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeFusion Fusion Builder fusion-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fusion Builder: from n/a through < 3.15.0.
- Product
- Fusion Builder
- What to do
- Update Fusion Builder to the newest version.
Mar 13, 2026Fusion Builder: Missing AuthorizationCVE-2026-32451 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ThemeFusion Fusion Builder fusion-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fusion Builder: from n/a through < 3.15.0.
- Product
- Fusion Builder
- What to do
- Update Fusion Builder to the newest version.
Mar 13, 2026Atarim: Missing AuthorizationCVE-2026-32447 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through <= 4.3.2.
- Product
- Atarim
- Affected
- up to 4.3.2
- What to do
- Affects up to 4.3.2. Update Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Contact Form by WPForms: Missing AuthorizationCVE-2026-32446 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by WPForms: from n/a through <= 1.9.9.3.
- Product
- Contact Form by WPForms
- Affected
- up to 1.9.9.3
- What to do
- Affects up to 1.9.9.3. Update Contact Form by WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Elementor Website Builder: Missing AuthorizationCVE-2026-32445 · WordPress plugins & themes · reported by PatchstackLow 2.7
Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Website Builder: from n/a through <= 3.35.5.
- Product
- Elementor Website Builder
- Affected
- up to 3.35.5
- What to do
- Affects up to 3.35.5. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026e2pdf: Missing AuthorizationCVE-2026-32442 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in E2Pdf e2pdf e2pdf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects e2pdf: from n/a through <= 1.28.15.
- Product
- e2pdf
- Affected
- up to 1.28.15
- What to do
- Affects up to 1.28.15. Update e2pdf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026WP Food: Missing AuthorizationCVE-2026-32440 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ex-Themes WP Food wp-food allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Food: from n/a through < 2.7.1.
- Product
- WP Food
- What to do
- Update WP Food to the newest version.
Mar 13, 2026BigHearts: Missing AuthorizationCVE-2026-32439 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WebGeniusLab BigHearts bighearts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BigHearts: from n/a through <= 3.1.14.
- Product
- BigHearts
- Affected
- up to 3.1.14
- What to do
- Affects up to 3.1.14. Update BigHearts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026VW School Education: Missing AuthorizationCVE-2026-32438 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vowelweb VW School Education vw-school-education allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW School Education: from n/a through <= 1.4.6.
- Product
- VW School Education
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update VW School Education to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026VW Portfolio: Missing AuthorizationCVE-2026-32437 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vowelweb VW Portfolio vw-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Portfolio: from n/a through <= 1.3.3.
- Product
- VW Portfolio
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update VW Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026VW Photography: Missing AuthorizationCVE-2026-32436 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vowelweb VW Photography vw-photography allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Photography: from n/a through <= 1.3.8.
- Product
- VW Photography
- Affected
- up to 1.3.8
- What to do
- Affects up to 1.3.8. Update VW Photography to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026VW Pet Shop: Missing AuthorizationCVE-2026-32435 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vowelweb VW Pet Shop vw-pet-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Pet Shop: from n/a through <= 1.4.7.
- Product
- VW Pet Shop
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update VW Pet Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026VW Fitness: Missing AuthorizationCVE-2026-32434 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vowelweb VW Fitness vw-fitness allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Fitness: from n/a through <= 4.3.4.
- Product
- VW Fitness
- Affected
- up to 4.3.4
- What to do
- Affects up to 4.3.4. Update VW Fitness to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026WP Time Slots Booking Form: Missing AuthorizationCVE-2026-32432 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Time Slots Booking Form: from n/a through <= 1.2.42.
- Product
- WP Time Slots Booking Form
- Affected
- up to 1.2.42
- What to do
- Affects up to 1.2.42. Update WP Time Slots Booking Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Popup Like box: Missing AuthorizationCVE-2026-32428 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ays Pro Popup Like box ays-facebook-popup-likebox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup Like box: from n/a through <= 3.7.7.
- Product
- Popup Like box
- Affected
- up to 3.7.7
- What to do
- Affects up to 3.7.7. Update Popup Like box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.