Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,230 results · page 4 of 25
Sep 4, 2026WPFunnels: Does not restrict access to the log files it writes to a predictable location under the public uploads directoryCVE-2026-79631 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthenticated users to download customer order details and opt-in form submissions when logging is enabled.
- Product
- WPFunnels
- Fixed in
- 3.13.0
- What to do
- Update WPFunnels to 3.13.0 or newer.
Sep 3, 2026Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions.CVE-2026-84847 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions.
- Affected
- up to 9.17
- What to do
- Affects up to 9.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents <= 1.51.0 versions.CVE-2026-84779 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents <= 1.51.0 versions.
- Affected
- up to 1.51.0
- What to do
- Affects up to 1.51.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions.CVE-2026-84758 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions.
- Affected
- up to 6.4.26
- What to do
- Affects up to 6.4.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions.CVE-2026-84755 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions.
- Affected
- up to 1.31.0
- What to do
- Affects up to 1.31.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions.CVE-2026-84754 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions.
- Affected
- up to 3.12.13
- What to do
- Affects up to 3.12.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.CVE-2026-84238 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions.CVE-2026-84215 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions.
- Affected
- up to 1.0.61
- What to do
- Affects up to 1.0.61. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Restrict User Access: Does not normalise the REST API route before checking it against the routes its content protection coversCVE-2026-78153 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users.
- Product
- Restrict User Access
- Fixed in
- 2.8.1
- What to do
- Update Restrict User Access to 2.8.1 or newer.
Sep 2, 2026WatchMan-Site7: Does not restrict access to its debugging consoleCVE-2026-77009 · WordPress plugins & themes · reported by WPScanCritical 9.9
The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server.
- Product
- WatchMan-Site7
- Affected
- up to 4.2.0
- What to do
- Affects up to 4.2.0. Update WatchMan-Site7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <= 3.2.9 versions.CVE-2026-84760 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <= 3.2.9 versions.
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions.CVE-2026-82223 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions.
- Affected
- up to 4.1.22
- What to do
- Affects up to 4.1.22. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026MasterStudy LMS: Does not restrict access to a REST route that lists an author's coursesCVE-2026-81197 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished (draft, pending and private) courses.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.46
- What to do
- Update MasterStudy LMS to 3.7.46 or newer.
Aug 31, 2026Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.CVE-2026-81762 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.
- Affected
- up to 2.7.6
- What to do
- Affects up to 2.7.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2026Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions.CVE-2026-81758 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions.
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2026Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.CVE-2026-81296 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
- Affected
- up to 6.2.12
- What to do
- Affects up to 6.2.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2026Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions.CVE-2026-81293 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions.
- Affected
- up to 5.5.81
- What to do
- Affects up to 5.5.81. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2026MasterStudy LMS: Does not correctly restrict access to order informationCVE-2026-81200 · WordPress plugins & themes · reported by WPScanLow 2.7
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order IDs.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.42
- What to do
- Update MasterStudy LMS to 3.7.42 or newer.
Aug 29, 2026HEL Online Classroom: AI-powered Online Classrooms: Does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access codeCVE-2026-77010 · WordPress plugins & themes · reported by WPScanMedium 6.5
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code, allowing unauthenticated users to obtain a signed meeting join link for any classroom, including one protected by an access code, and to join it with moderator privileges.
- Product
- HEL Online Classroom: AI-powered Online Classrooms
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update HEL Online Classroom: AI-powered Online Classrooms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2026Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions.CVE-2026-81767 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions.
- Affected
- up to 2.5.2
- What to do
- Affects up to 2.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2026Subscriber Broken Access Control in WpEvently <= 5.5.0 versions.CVE-2026-81761 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in WpEvently <= 5.5.0 versions.
- Affected
- up to 5.5.0
- What to do
- Affects up to 5.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2026Contributor Broken Access Control in WpEvently <= 5.5.0 versions.CVE-2026-81759 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Contributor Broken Access Control in WpEvently <= 5.5.0 versions.
- Affected
- up to 5.5.0
- What to do
- Affects up to 5.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2026Contributor Broken Access Control in ACF Extended <= 0.9.2.6 versions.CVE-2026-81284 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Broken Access Control in ACF Extended <= 0.9.2.6 versions.
- Affected
- up to 0.9.2.6
- What to do
- Affects up to 0.9.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2026User Frontend: Does not restrict access to its user directory search endpointCVE-2026-14567 · WordPress plugins & themes · reported by WPScanMedium 5.3
The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators.
- Product
- User Frontend
- Fixed in
- 4.3.10
- What to do
- Update User Frontend to 4.3.10 or newer.
Aug 27, 2026Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.CVE-2026-81279 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.
- Affected
- up to 3.20
- What to do
- Affects up to 3.20. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions.CVE-2026-81276 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions.
- Affected
- up to 2.4.23
- What to do
- Affects up to 2.4.23. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026Subscriber Broken Access Control in Ditty <= 3.1.67 versions.CVE-2026-81274 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Subscriber Broken Access Control in Ditty <= 3.1.67 versions.
- Affected
- up to 3.1.67
- What to do
- Affects up to 3.1.67. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.CVE-2026-81272 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions.CVE-2026-27330 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions.
- Affected
- up to 0.4.62
- What to do
- Affects up to 0.4.62. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026WP OAuth Server ( Login with WordPress ): Does not restrict access to the debug log it writesCVE-2026-19715 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user records including password hashes when debug logging is enabled.
- Product
- WP OAuth Server ( Login with WordPress )
- Fixed in
- 6.3.1
- What to do
- Update WP OAuth Server ( Login with WordPress ) to 6.3.1 or newer.
Aug 26, 2026WP Data Access: Insecure Direct Object ReferenceCVE-2026-3235 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'check_app_access' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from protected app containers by exploiting a mismatch between the authorization check (performed against app_id) and data retrieval (performed using cnt_id without verifying container ownership).
- Product
- WP Data Access
- Affected
- up to 5.5.68
- What to do
- Affects up to 5.5.68. Update WP Data Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 26, 2026Eventin: Does not restrict access to non-published content by status or ownership in one of its REST API namespacesCVE-2026-13172 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces, allowing unauthenticated users to retrieve draft, pending and private posts belonging to other users, along with the passwords and contents of password-protected ones.
- Product
- Eventin
- Fixed in
- 4.1.22
- What to do
- Update Eventin to 4.1.22 or newer.
Aug 24, 2026Subscriber Broken Access Control in AutomatorWP <= 5.8.3 versions.CVE-2026-78266 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in AutomatorWP <= 5.8.3 versions.
- Affected
- up to 5.8.3
- What to do
- Affects up to 5.8.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Subscriber Broken Access Control in Style Kits <= 2.6.5 versions.CVE-2026-27364 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Style Kits <= 2.6.5 versions.
- Affected
- up to 2.6.5
- What to do
- Affects up to 2.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions.CVE-2026-78291 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions.
- Affected
- up to 4.1223
- What to do
- Affects up to 4.1223. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions.CVE-2026-78272 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions.
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions.CVE-2026-78258 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions.
- Affected
- up to 2.7.5
- What to do
- Affects up to 2.7.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Subscriber Broken Access Control in ProLancer Element <= 1.4.8 versions.CVE-2026-28190 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Access Control in ProLancer Element <= 1.4.8 versions.
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Broken Access Control in Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More <= 1.7.1 versions.CVE-2026-28153 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More <= 1.7.1 versions.
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 23, 2026Brave Popup Builder (slug: brave-popup-builder) has a broken access control issue in versions through 0.8.5.CVE-2026-77116 · WordPress plugins & themes · reported by WPScanMedium 4.3
Brave Popup Builder (slug: brave-popup-builder) has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL.
- Affected
- up to 0.8.5
- What to do
- Affects up to 0.8.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 21, 2026Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: Does not restrict access to per-vendor commission configuration returned by one of its unauthenticated store REST endpointsCVE-2026-16575 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict access to per-vendor commission configuration returned by one of its unauthenticated store REST endpoints, allowing any unauthenticated user to disclose a vendor's commission type and, when category-based commission is configured, the per-category and default commission rates.
- Product
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
- Fixed in
- 5.0.14
- What to do
- Update Dokan: AI Powered WooCommerce Multivendor Marketplace Solution to 5.0.14 or newer.
Aug 20, 2026Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions.CVE-2026-74021 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions.
- Affected
- up to 2.6.8
- What to do
- Affects up to 2.6.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Unauthenticated Broken Access Control in Koji <= 2.2.1 versions.CVE-2026-74020 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Koji <= 2.2.1 versions.
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions.CVE-2026-74019 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions.
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Subscriber Broken Access Control in Homlisti <= 3.1.2 versions.CVE-2026-66647 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Homlisti <= 3.1.2 versions.
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions.CVE-2026-66595 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions.
- Affected
- up to 5.5.80
- What to do
- Affects up to 5.5.80. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Unauthenticated Broken Access Control in Altair <= 5.2.2 versions.CVE-2025-53999 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Altair <= 5.2.2 versions.
- Affected
- up to 5.2.2
- What to do
- Affects up to 5.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Unauthenticated Broken Access Control in Stitch Express <= 1.9.0 versions.CVE-2026-73394 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Stitch Express <= 1.9.0 versions.
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Unauthenticated Broken Access Control in Outranking Plugin Options <= 1.1.3 versions.CVE-2026-73385 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Outranking Plugin Options <= 1.1.3 versions.
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce < 2.0.8 versions.CVE-2026-73363 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce < 2.0.8 versions.
- What to do
- Update the plugin to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.