Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,932 results · page 3 of 39
Sep 30, 2026Unauthenticated Broken Access Control in Bookly <= 28.2 versions.CVE-2026-96348 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Bookly <= 28.2 versions.
- Affected
- up to 28.2
- What to do
- Affects up to 28.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.CVE-2026-95587 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Subscriber Broken Access Control in FormGent <= 1.12.2 versions.CVE-2026-94499 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Access Control in FormGent <= 1.12.2 versions.
- Affected
- up to 1.12.2
- What to do
- Affects up to 1.12.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.CVE-2026-94120 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.
- Affected
- up to 2.7.2
- What to do
- Affects up to 2.7.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.CVE-2026-94074 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.
- Affected
- up to 1.6.12.29
- What to do
- Affects up to 1.6.12.29. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Verge3D Publishing and E-Commerce: Does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content typeCVE-2026-92994 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript that executes in the browser of any user who opens it.
- Product
- Verge3D Publishing and E-Commerce
- Fixed in
- 4.13.1
- What to do
- Update Verge3D Publishing and E-Commerce to 4.13.1 or newer.
Sep 30, 2026FluentCart A New Era of eCommerce: Does not verify that the person placing a guest checkout controls the email address suppliedCVE-2026-100143 · WordPress plugins & themes · reported by WPScanMedium 6.5
The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not verify that the person placing a guest checkout controls the email address supplied, allowing unauthenticated attackers who know an existing guest customer's email to obtain a logged-in account bearing that address together with the customer's stored record.
- Product
- FluentCart A New Era of eCommerce
- Fixed in
- 1.6.5
- What to do
- Update FluentCart A New Era of eCommerce to 1.6.5 or newer.
Sep 26, 2026Groups – Memberships and Access Control: Privilege EscalationCVE-2026-77203 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.6.0. This is due to the groups_join() function deriving group-join eligibility from the ambient post's author capabilities via the global $post->post_author rather than from the currently authenticated user's own capabilities, while simultaneously minting and returning a valid groups-join-data hash and WordPress nonce for the caller in the same response — eliminating all authorization barriers to self-enrollment. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enroll themselves into any group including privileged groups carrying the groups_admin_groups capability, and to subsequently create and join a group containing every registered WordPress capability, effectively escalating their privileges to Administrator. Exploitation requires the attacker to supply an Administrator-authored post ID via the post_ID parameter of the authenticated wp_ajax_parse_media_shortcode handler in order to establish the privileged ambient post context used by the flawed authorization check.
- Product
- Groups – Memberships and Access Control
- Affected
- up to 4.6.0
- What to do
- Affects up to 4.6.0. Update Groups – Memberships and Access Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 23, 2026Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.CVE-2026-95604 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.
- Affected
- up to 4.2.4
- What to do
- Affects up to 4.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026YITH WooCommerce Request A Quote: Authorization Bypass Through User-Controlled KeyCVE-2026-95602 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1.
- Product
- YITH WooCommerce Request A Quote
- Fixed in
- 4.46.1
- What to do
- Update YITH WooCommerce Request A Quote to 4.46.1 or newer.
Sep 23, 2026Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions.CVE-2026-95527 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions.
- Affected
- up to 6.2.4
- What to do
- Affects up to 6.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.CVE-2026-95513 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.
- Affected
- up to 4.6.0
- What to do
- Affects up to 4.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.CVE-2026-94679 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.CVE-2026-94498 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.
- Affected
- up to 3.15.4
- What to do
- Affects up to 3.15.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions.CVE-2026-94080 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions.
- Affected
- up to 2.1.70
- What to do
- Affects up to 2.1.70. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.CVE-2026-94079 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.
- Affected
- up to 2.9.19
- What to do
- Affects up to 2.9.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.CVE-2026-93620 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.
- Affected
- up to 8.2.5
- What to do
- Affects up to 8.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions.CVE-2026-93529 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions.
- Affected
- up to 2.7.0
- What to do
- Affects up to 2.7.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 20, 2026Unlimited Elements For Elementor: Does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through itCVE-2026-85017 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. A partial fix in the 2.0.18 to 2.0.19 releases raised the privilege required to reach the vulnerable action to editor-level, and the issue was fully resolved in 2.0.20.
- Product
- Unlimited Elements For Elementor
- Fixed in
- 2.0.20
- What to do
- Update Unlimited Elements For Elementor to 2.0.20 or newer.
Sep 19, 2026MgoSync: Does not have authorization controls on one of its REST API endpointsCVE-2026-92404 · WordPress plugins & themes · reported by WPScanHigh 7.5
The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site.
- Product
- MgoSync
- Fixed in
- 2.1.7
- What to do
- Update MgoSync to 2.1.7 or newer.
Sep 17, 2026Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions.CVE-2026-78528 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions.
- Affected
- up to 4.1.15
- What to do
- Affects up to 4.1.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.CVE-2026-74017 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.
- Affected
- up to 5.2.7
- What to do
- Affects up to 5.2.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions.CVE-2026-74002 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions.
- Affected
- up to 11.7
- What to do
- Affects up to 11.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Contributor Broken Access Control in Simple Membership <= 4.8.2 versions.CVE-2026-74000 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Contributor Broken Access Control in Simple Membership <= 4.8.2 versions.
- Affected
- up to 4.8.2
- What to do
- Affects up to 4.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions.CVE-2026-66676 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions.
- Affected
- up to 2.3.8
- What to do
- Affects up to 2.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 versions.CVE-2026-62136 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 versions.
- Affected
- up to 2.3.21
- What to do
- Affects up to 2.3.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions.CVE-2026-62135 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions.
- Affected
- up to 1.0.24
- What to do
- Affects up to 1.0.24. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions.CVE-2026-62132 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions.
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026Unauthenticated Broken Access Control in Passster <= 4.3.13 versions.CVE-2026-62114 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Passster <= 4.3.13 versions.
- Affected
- up to 4.3.13
- What to do
- Affects up to 4.3.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions.CVE-2026-27378 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions.
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Broken Access Control in WP Fast Total Search <= 1.82.284 versions.CVE-2026-84821 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WP Fast Total Search <= 1.82.284 versions.
- Affected
- up to 1.82.284
- What to do
- Affects up to 1.82.284. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce <= 4.6.4 versions.CVE-2026-81799 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce <= 4.6.4 versions.
- Affected
- up to 4.6.4
- What to do
- Affects up to 4.6.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions.CVE-2026-81794 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions.
- What to do
- Update the plugin to the newest version.
Sep 10, 2026Subscriber Broken Access Control in IMPress for IDX Broker <= 3.3.0 versions.CVE-2026-81788 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Subscriber Broken Access Control in IMPress for IDX Broker <= 3.3.0 versions.
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce <= 1.2.2 versions.CVE-2026-81786 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce <= 1.2.2 versions.
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Broken Access Control in BuddyForms <= 2.9.0 versions.CVE-2026-81785 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in BuddyForms <= 2.9.0 versions.
- Affected
- up to 2.9.0
- What to do
- Affects up to 2.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce <= 1.8.9 versions.CVE-2026-78536 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce <= 1.8.9 versions.
- Affected
- up to 1.8.9
- What to do
- Affects up to 1.8.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2026IP2Location Country Blocker: Access control bypassCVE-2026-82530 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forging the X-Real-IP HTTP header. Attackers can set the X-Real-IP header to an allowlisted IP address to bypass page, link, or site-wide access restrictions and access otherwise-blocked resources.
- Product
- IP2Location Country Blocker
- Fixed in
- 2.45.0
- What to do
- Update IP2Location Country Blocker to 2.45.0 or newer.
Full record and what to do →NVD recordwordpress.orgvulncheck.com
Sep 5, 2026My Private Site: Does not apply its site-privacy access control to certain unauthenticated front-end read surfacesCVE-2026-81348 · WordPress plugins & themes · reported by WPScanLow 3.7
The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login.
- Product
- My Private Site
- Fixed in
- 4.2.3
- What to do
- Update My Private Site to 4.2.3 or newer.
Sep 4, 2026WP Rentals: Authorization Bypass Through User-Controlled KeyCVE-2026-27432 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Rentals: from n/a before 3.16.0.
- Product
- WP Rentals
- Fixed in
- 3.16.0
- What to do
- Update WP Rentals to 3.16.0 or newer.
Sep 4, 2026Frontend Admin by DynamiApps: Does not properly validate a user-controllable directory path before deleting files within itCVE-2026-81347 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root, which can render the site inoperable. Successful exploitation requires a non-default form configuration.
- Product
- Frontend Admin by DynamiApps
- Fixed in
- 3.29.13
- What to do
- Update Frontend Admin by DynamiApps to 3.29.13 or newer.
Sep 3, 2026SureForms: Authorization Bypass Through User-Controlled KeyCVE-2026-85308 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm Force SureForms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SureForms: from n/a through 2.12.5.
- Product
- SureForms
- Affected
- up to 2.12.5
- What to do
- Affects up to 2.12.5. Update SureForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions.CVE-2026-84847 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions.
- Affected
- up to 9.17
- What to do
- Affects up to 9.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents <= 1.51.0 versions.CVE-2026-84779 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents <= 1.51.0 versions.
- Affected
- up to 1.51.0
- What to do
- Affects up to 1.51.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions.CVE-2026-84758 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions.
- Affected
- up to 6.4.26
- What to do
- Affects up to 6.4.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions.CVE-2026-84755 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions.
- Affected
- up to 1.31.0
- What to do
- Affects up to 1.31.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions.CVE-2026-84754 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions.
- Affected
- up to 3.12.13
- What to do
- Affects up to 3.12.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.CVE-2026-84238 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions.CVE-2026-84215 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions.
- Affected
- up to 1.0.61
- What to do
- Affects up to 1.0.61. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Yoast SEO Premium: Does not sanitize control characters from redirect origins before writing them to the site's Apache configuration fileCVE-2026-10821 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. This allows such users to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honour PHP directives, the injection can be chained with the user's own media upload (a polyglot image carrying a PHP payload) and an auto_prepend_file directive to achieve Remote Code Execution.
- Product
- Yoast SEO Premium
- Fixed in
- 27.6.1
- What to do
- Update Yoast SEO Premium to 27.6.1 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.