Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
567 results · page 2 of 12
Sep 17, 2026The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, cCVE-2026-86801 · WordPress plugins & themes · reported by WPScanHigh 8.8
The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated users to store active content served from the site's own origin, and to list and delete the files already staged there.
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026wpShopGermany IT-RECHT KANZLEI: Does not generate its API authentication token securelyCVE-2026-88795 · WordPress plugins & themes · reported by WPScanCritical 9
The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the token and use the access it grants to write arbitrary files, leading to remote code execution.
- Product
- wpShopGermany IT-RECHT KANZLEI
- Fixed in
- 2.4
- What to do
- Update wpShopGermany IT-RECHT KANZLEI to 2.4 or newer.
Sep 16, 2026LearnPress: Does not perform any authenticationCVE-2026-86448 · WordPress plugins & themes · reported by WPScanLow 3.7
The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file, allowing unauthenticated attackers who can determine its identifier to download customer names, purchases, amounts and guest email addresses.
- Product
- LearnPress
- Fixed in
- 4.4.7
- What to do
- Update LearnPress to 4.4.7 or newer.
Sep 16, 2026Ni WooCommerce Sales Report: Does not have any authentication or authorisation checks on one of its report-printing routinesCVE-2026-78474 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks on one of its report-printing routines, allowing unauthenticated users to retrieve WooCommerce order details and customer contact information, to target an individual order, and to search the store's orders by customer name or email address.
- Product
- Ni WooCommerce Sales Report
- Fixed in
- 4.2.0
- What to do
- Update Ni WooCommerce Sales Report to 4.2.0 or newer.
Sep 15, 2026miniOrange JWT Authentication for WP REST APIs: Authentication method downgradeCVE-2026-89027 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or nonce verification. Attackers can force the plugin to use Basic HTTP authentication regardless of configured JWT or API token settings, then exploit distinguishable error codes and the absence of rate limiting to perform unthrottled username enumeration and credential guessing attacks.
- Product
- miniOrange JWT Authentication for WP REST APIs
- Fixed in
- 4.8.0
- What to do
- Update miniOrange JWT Authentication for WP REST APIs to 4.8.0 or newer.
Full record and what to do →NVD recordwordpress.orgvulncheck.com
Sep 12, 2026Zonify: Does not perform any capability or authentication check before returning the site's stored account login tokenCVE-2026-87842 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked service account.
- Product
- Zonify
- Fixed in
- 1.0.5
- What to do
- Update Zonify to 1.0.5 or newer.
Sep 12, 2026Frontegg SAML SSO: Does not verify the signature or issuer of SAML authentication responses before establishing a sessionCVE-2026-75800 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as well as to create arbitrary accounts.
- Product
- Frontegg SAML SSO
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Frontegg SAML SSO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026OTP Login & Register Woocommerce: Authentication BypassCVE-2026-12215 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in `process_otp_form` is keyed exclusively on the attacker-controlled `xoo_ml_user_ip_data` cookie's `ip_address` field, allowing unlimited counter resets by simply rotating the cookie, while the OTP itself is generated with PHP's non-cryptographic `rand()` function over a default space of only 9,000 possible values (1000–9999), and both the OTP issuance endpoint (`xoo_ml_login_with_otp`) and verification endpoint (`xoo_ml_otp_form_submit`) are registered as unauthenticated `wp_ajax_nopriv` actions with no nonce or capability checks. This makes it possible for unauthenticated attackers to brute-force the OTP for any registered account and obtain a full WordPress authentication session — including for administrator accounts — via `wp_set_auth_cookie()` in `login_user_with_otp()`. Exploitation requires the attacker to know the target user's registered phone number, which is used to trigger OTP issuance via the unauthenticated `xoo_ml_login_with_otp` endpoint
- Product
- OTP Login & Register Woocommerce
- Affected
- up to 2.7.2
- What to do
- Affects up to 2.7.2. Update OTP Login & Register Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 10, 2026WP Travel: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-81796 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Authentication Bypass Using an Alternate Path or Channel vulnerability in WEN Solutions WP Travel wp-travel allows Password Recovery Exploitation.This issue affects WP Travel: from n/a through 12.0.3.
- Product
- WP Travel
- Affected
- up to 12.0.3
- What to do
- Affects up to 12.0.3. Update WP Travel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions.CVE-2026-81787 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions.
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions.CVE-2026-81783 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions.
- Affected
- up to 3.2.5
- What to do
- Affects up to 3.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2026Several Newfold plugins are vulnerable to Authentication Bypass.CVE-2026-80099 · WordPress plugins & themes · reported by WordfenceHigh 8.8
Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the `authenticate()` method — registered on the `rest_authentication_errors` filter and therefore evaluated for every unauthenticated REST API request — performs an HMAC-style Bearer token comparison that degenerates when `HiiveConnection::get_auth_token()` returns `false`: PHP coerces `strrev(false)` to `strrev('')`, collapsing the secret salt to the publicly known constant `hash('sha256', '') = e3b0c44...`, while all remaining hash inputs (HTTP method, request URL, raw request body, and the `X-Timestamp` header) remain fully attacker-controlled. This makes it possible for unauthenticated attackers to compute a valid Bearer token entirely offline, pass the token equality check, and have `wp_set_current_user()` invoked against the first administrator returned by `get_users(['role' => 'administrator'])`, granting full administrator-level access and enabling arbitrary REST API operations such as creating new administrator accounts and achieving complete site takeover. Vulnerable versions are WP Plugin Crazy Domains (<= 2.5.2),
- Affected
- up to 2.9.4
- What to do
- Affects up to 2.9.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2026Next-Cart Store to WooCommerce Migration: Authentication BypassCVE-2026-76009 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the `NCWM_Kitconnect::run()` function. This is due to the plugin registering the `/wp-json/next_cart/v1/migration` REST route with `permission_callback` set to `__return_true` and relying on a hardcoded fallback value of `__token__` in `get_option('nextcart_token', '__token__')` when the `nextcart_token` option has not yet been written to the database. This makes it possible for unauthenticated attackers to bypass authentication to the migration endpoint by supplying the literal string `__token__` as the token, gaining access to privileged handlers that pass attacker-controlled SQL directly to `$wpdb->query()` and `$wpdb->get_results()` — enabling arbitrary SQL execution including administrator account creation — and pass an attacker-controlled path to `unlink()`, enabling arbitrary file deletion and full site takeover. The hardcoded fallback is reachable whenever the `nextcart_token` option has not yet been populated, which occurs after WP-CLI, network, or programmatic plugin activation without a subsequent authenticated `wp-admin
- Product
- Next-Cart Store to WooCommerce Migration
- Affected
- up to 3.9.8
- What to do
- Affects up to 3.9.8. Update Next-Cart Store to WooCommerce Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 5, 2026Frontend Admin by DynamiApps: Authentication Bypass to Account TakeoverCVE-2026-75816 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership check, and ActionPost::conditions_logic() short-circuiting its current_user_can('edit_post') authorization gate whenever the post ID is non-numeric — such as the string user_1 — allowing unauthenticated form submissions to be routed to arbitrary user records without restriction. This makes it possible for unauthenticated attackers to overwrite any user's registered email address, including an administrator's, and then leverage WordPress's native password-reset flow to fully take over the targeted account.
- Product
- Frontend Admin by DynamiApps
- Affected
- up to 3.29.12
- What to do
- Affects up to 3.29.12. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 5, 2026HivePress Authentication: Authentication BypassCVE-2026-18056 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the access_token parameter in all versions up to, and including, 1.1.4. This is due to the authenticate_user function's Facebook authenticator resolving third-party identity by forwarding the attacker-supplied access_token to the Facebook Graph API and trusting the returned email and ID verbatim, without performing any application ID or audience validation — specifically, no /debug_token verification and no comparison of the token's app_id against the configured hp_facebook_app_id. This makes it possible for unauthenticated attackers to authenticate as any existing WordPress user, including administrators, whose email address is associated with a Facebook account for which the attacker can obtain any valid access token. Important Note: To exploit the vulnerability, the attacker must obtain the victim's access token.
- Product
- HivePress Authentication
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update HivePress Authentication to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddevelopers.facebook.comgithub.com
Sep 5, 2026Mstore Api: Authentication BypassCVE-2026-13447 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible for unauthenticated attackers to forge a Firebase Phone Auth JWT signed with a self-generated RSA key pair and impersonate any phone number, resulting in unauthorized access to existing WordPress accounts or creation of new arbitrary accounts.
- Product
- Mstore Api
- Affected
- up to 4.20.0
- What to do
- Affects up to 4.20.0. Update Mstore Api to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 3, 2026Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions.CVE-2026-84777 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions.
- Affected
- up to 9.8.0
- What to do
- Affects up to 9.8.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026HIPAA FORMS: Contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requestsCVE-2026-2688 · WordPress plugins & themes · reported by WPScanMedium 6.5
The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints.
- Product
- HIPAA FORMS
- Fixed in
- 3.2.0
- What to do
- Update HIPAA FORMS to 3.2.0 or newer.
Sep 2, 2026Booking for Appointments and Events Calendar: Does not require authentication or a valid request token before running the post-booking action chainCVE-2026-14215 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by enumerating its identifier.
- Product
- Booking for Appointments and Events Calendar
- Fixed in
- 2.4.9
- What to do
- Update Booking for Appointments and Events Calendar to 2.4.9 or newer.
Sep 1, 2026Simple Membership: Authentication Bypass leading to Administrator Account TakeoverCVE-2026-77194 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4.8.0. This is due to improper identity verification during the public registration flow in WordPress Multisite environments, where the plugin binds new Simple Membership records to existing global WordPress users based solely on matching username and email, without requiring password verification or ownership proof, and fails to properly detect Administrator roles on child sites. This makes it possible for unauthenticated attackers to take over Administrator accounts on child sites in a Multisite network by registering a Simple Membership account with a victim's credentials on a site where public registration is enabled, then updating the victim's global WordPress password through the profile edit functionality. The vulnerability was partially patched in version 4.8.1.
- Product
- Simple Membership
- Affected
- up to 4.8.0
- What to do
- Affects up to 4.8.0. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 1, 2026Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System: Authentication Bypass leading to Administrator Account TakeoverCVE-2026-19806 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the `guest_ticket_login()` function and its `p` parameter. This is due to the site-wide AES-256-CBC encryption key being derived from only three two-digit `wp_rand(10, 99)` values and a Unix timestamp via `md5()` — yielding approximately 19.5 bits of entropy — combined with a deterministic IV derived from the password, no authentication tag on the ciphertext, and no capability check, nonce, or session validation on the publicly reachable `/sgnix/?p=<token>` endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, who can obtain a single legitimate guest ticket token as a known-plaintext oracle and bound the plugin activation timestamp, to exhaust the ~729,000-candidate keyspace entirely offline, recover the site-wide encryption key, and forge a self-consistent `{ticket_id, ticket_user}` token targeting any administrator-owned ticket. Submitting the forged token to the unprotected endpoint causes `w
- Product
- Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System
- Affected
- up to 1.4.52
- What to do
- Affects up to 1.4.52. Update Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 31, 2026Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions.CVE-2026-82225 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions.
- Affected
- up to 6.0.9.8
- What to do
- Affects up to 6.0.9.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 30, 2026MyHome Core: Authentication BypassCVE-2026-15980 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. This makes it possible for unauthenticated attackers to generate an activation token for an unconfirmed user account and obtain a valid authentication cookie for that account, including administrators. Successful exploitation requires the MyHome theme to be configured in legacy/WPBakery mode with frontend registration and confirmation email enabled, and the target account must not already have the myhome_agent_confirmed user meta set.
- Product
- MyHome Core
- Affected
- up to 4.4.5
- What to do
- Affects up to 4.4.5. Update MyHome Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Aug 29, 2026SAML Single Sign On – SSO Login: Authentication BypassCVE-2026-75807 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mo_saml_login_validate() ACS handler persisting the X.509 certificate extracted from an incoming SAMLResponse into the mo_saml_required_certificate option before the signature-validation verdict is enforced, because mo_saml_find_certificate() returns false on a fingerprint mismatch rather than halting execution. This makes it possible for unauthenticated attackers to overwrite the plugin's stored IdP signing certificate with an attacker-controlled value, and subsequently forge SAML assertions for any WordPress account — including administrators — to obtain a fully privileged session. Note: The exploit requires the administrator to perform a repair after receiving the test_config_error_wpsamlerr004 error message during the test configuration.
- Product
- SAML Single Sign On – SSO Login
- Affected
- up to 5.4.6
- What to do
- Affects up to 5.4.6. Update SAML Single Sign On – SSO Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 29, 2026HEL Online Classroom: AI-powered Online Classrooms: Does not have any authorisation or authentication checkCVE-2026-77008 · WordPress plugins & themes · reported by WPScanMedium 6.5
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its settings, allowing unauthenticated users to overwrite them and repoint every online classroom, along with the shared secret those sessions are signed with, at infrastructure of their choosing.
- Product
- HEL Online Classroom: AI-powered Online Classrooms
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update HEL Online Classroom: AI-powered Online Classrooms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2026Essential Addons for Elementor: Authentication Bypass by SpoofingCVE-2026-81777 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor: from n/a through 6.8.0.
- Product
- Essential Addons for Elementor
- Affected
- up to 6.8.0
- What to do
- Affects up to 6.8.0. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2026WPMU DEV Dashboard: Authentication BypassCVE-2026-76581 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated `wdpsso_step1` and `wdpsso_step2` AJAX actions, where step 1 signs and discloses an unseparated concatenation of the token, state, redirect, and domain values, while step 2 verifies an unseparated concatenation that omits the domain field. This makes it possible for unauthenticated attackers, on sites connected to WPMU DEV with Hub SSO enabled and mapped to an administrator, to obtain a valid HMAC from step 1 and replay it to step 2 by moving the domain value into the redirect field, resulting in an authenticated administrator session.
- Product
- WPMU DEV Dashboard
- Affected
- up to 5.0.1
- What to do
- Affects up to 5.0.1. Update WPMU DEV Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpmudev.comwordfence.com
Aug 26, 2026Classified Listing - Mobile Number Verification: Authentication BypassCVE-2026-15985 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the process_otp_login() function. This makes it possible for unauthenticated attackers to authenticate as any user with a phone number registered in the plugin's phone table by submitting an arbitrary OTP code and UID through the Firebase OTP login flow. Successful exploitation requires OTP login to be enabled with Firebase selected as the verification gateway, and requires the attacker to know or guess the target account's registered phone number. Administrator account takeover is possible if an administrator account has a phone number registered in the plugin.
- Product
- Classified Listing - Mobile Number Verification
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Classified Listing - Mobile Number Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordradiustheme.comwordfence.com
Aug 26, 2026Booking for Appointments and Events Calendar: Does not require authentication before processing its pending notification queueCVE-2026-14216 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.
- Product
- Booking for Appointments and Events Calendar
- Fixed in
- 2.4.7
- What to do
- Update Booking for Appointments and Events Calendar to 2.4.7 or newer.
Aug 24, 2026Unauthenticated Broken Authentication in WPLegalPages <= 3.7.0 versions.CVE-2026-78259 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated Broken Authentication in WPLegalPages <= 3.7.0 versions.
- Affected
- up to 3.7.0
- What to do
- Affects up to 3.7.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 22, 2026Social Login & Sharing buttons with Analytics By SoClever: Does not perform any authenticationCVE-2026-77001 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user, including administrators. In the default case a session as the site's original administrator account is obtained without needing to know any account details at all.
- Product
- Social Login & Sharing buttons with Analytics By SoClever
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Social Login & Sharing buttons with Analytics By SoClever to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 22, 2026Firebase Authentication: Does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a sessionCVE-2026-76793 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators.
- Product
- Firebase Authentication
- Fixed in
- 1.7.1
- What to do
- Update Firebase Authentication to 1.7.1 or newer.
Aug 21, 2026LitExtension: Does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication tokenCVE-2026-15046 · WordPress plugins & themes · reported by WPScanMedium 4.2
The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link (CSRF).
- Product
- LitExtension
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update LitExtension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 21, 2026Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code: Authentication BypassCVE-2026-77264 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handle_email_otp_return() function returning the secret magic login token in the response to a publicly accessible OTP request, rather than only delivering it to the user's email address. This makes it possible for unauthenticated attackers to log in as any user on the site, including administrators, if they know that user's email address.
- Product
- Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code
- Affected
- up to 4.8.6
- What to do
- Affects up to 4.8.6. Update Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 21, 2026Welcart e-Commerce: Does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameterCVE-2025-15671 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account after the victim logs in through an attacker-crafted request.
- Product
- Welcart e-Commerce
- Fixed in
- 2.12.1
- What to do
- Update Welcart e-Commerce to 2.12.1 or newer.
Aug 20, 2026Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.CVE-2026-74001 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.
- Affected
- up to 5.4.5
- What to do
- Affects up to 5.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Subscriber Broken Authentication in Leyka <= 3.32.3 versions.CVE-2026-66677 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Subscriber Broken Authentication in Leyka <= 3.32.3 versions.
- Affected
- up to 3.32.3
- What to do
- Affects up to 3.32.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Subscriber Broken Authentication in User Registration <= 5.2.6 versions.CVE-2026-73995 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Authentication in User Registration <= 5.2.6 versions.
- Affected
- up to 5.2.6
- What to do
- Affects up to 5.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions.CVE-2026-73399 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions.
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions.CVE-2026-73398 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 18, 2026Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 versions.CVE-2026-73396 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 versions.
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.CVE-2026-73381 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.
- Affected
- up to 1.13.0
- What to do
- Affects up to 1.13.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.CVE-2026-73350 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Broken Authentication in Ezoic <= 2.22.11 versions.CVE-2026-32481 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Authentication in Ezoic <= 2.22.11 versions.
- Affected
- up to 2.22.11
- What to do
- Affects up to 2.22.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 15, 2026User Profile Builder: Authentication BypassCVE-2026-15826 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the return value of wp_insert_user() before performing an is_wp_error() check — when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This makes it possible for unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover of the site.
- Product
- User Profile Builder
- Affected
- up to 3.16.4
- What to do
- Affects up to 3.16.4. Update User Profile Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 14, 2026User Session Synchronizer: Authentication Bypass leading to Account TakeoverCVE-2026-15341 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The `synchronize_session()` function, hooked on `init` and therefore executed on every request, performs no nonce, capability, or shared-secret validation against the attacker-supplied `ussync-key`, `ussync-token`, and `ussync-ref` parameters; when `ussync-key` references an unregistered slot, `get_option()` returns `false` for both the secret key and the domain list, causing the AES-256-CBC encryption key to degrade to the fully predictable `md5('')` and the referer allowlist to collapse to an empty-string match, while the AES IV is unconditionally hard-coded as `md5('another-secret')`. This makes it possible for unauthenticated attackers to supply a crafted request encrypting any known or guessable user email address in the `ussync-ref` parameter, causing the handler to call `wp_set_auth_cookie()` for the matched user and granting full authentication as that user — including administrators — with no prior knowledge of site secrets.
- Product
- User Session Synchronizer
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update User Session Synchronizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 14, 20266Storage Rentals: Authentication bypassCVE-2026-15303 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the six_storage_create_wp_user() AJAX handler being registered on wp_ajax_nopriv_six_storage_create_wp_user without any nonce, capability, credential, or ownership verification, while calling wp_set_current_user() and wp_set_auth_cookie() for any WordPress user resolved by the attacker-supplied email address. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting that user's email address.
- Product
- 6Storage Rentals
- Affected
- up to 2.27.0
- What to do
- Affects up to 2.27.0. Update 6Storage Rentals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 13, 2026Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions.CVE-2026-66465 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions.
- Affected
- up to 1.3.0.1
- What to do
- Affects up to 1.3.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions.CVE-2026-66453 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions.
- Affected
- up to 10.30.26
- What to do
- Affects up to 10.30.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions.CVE-2026-28185 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions.
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.