Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10,136 results · page 66 of 203
Mar 13, 2026GLB: Missing AuthorizationCVE-2026-32388 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in linethemes GLB glb allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GLB: from n/a through <= 1.2.2.
- Product
- GLB
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update GLB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Checkout for PayPal: Missing AuthorizationCVE-2026-32387 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Noor Alam Checkout for PayPal checkout-for-paypal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Checkout for PayPal: from n/a through <= 1.0.46.
- Product
- Checkout for PayPal
- Affected
- up to 1.0.46
- What to do
- Affects up to 1.0.46. Update Checkout for PayPal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Envo Extra: Missing AuthorizationCVE-2026-32386 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in EnvoThemes Envo Extra envo-extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envo Extra: from n/a through <= 1.9.13.
- Product
- Envo Extra
- Affected
- up to 1.9.13
- What to do
- Affects up to 1.9.13. Update Envo Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026RegistrationMagic: Missing AuthorizationCVE-2026-32385 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RegistrationMagic: from n/a through <= 6.0.7.6.
- Product
- RegistrationMagic
- Affected
- up to 6.0.7.6
- What to do
- Affects up to 6.0.7.6. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Ridhi: Missing AuthorizationCVE-2026-32383 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Ridhi ridhi allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ridhi: from n/a through <= 1.1.2.
- Product
- Ridhi
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Ridhi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Digital Download: Missing AuthorizationCVE-2026-32382 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Digital Download digital-download allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Digital Download: from n/a through <= 1.1.4.
- Product
- Digital Download
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Digital Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026App Landing Page: Missing AuthorizationCVE-2026-32381 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme App Landing Page app-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects App Landing Page: from n/a through <= 1.2.2.
- Product
- App Landing Page
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update App Landing Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Numinous: Missing AuthorizationCVE-2026-32380 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Numinous numinous allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Numinous: from n/a through <= 1.3.0.
- Product
- Numinous
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Numinous to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Rara Academic: Missing AuthorizationCVE-2026-32379 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Rara Academic rara-academic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rara Academic: from n/a through <= 1.2.2.
- Product
- Rara Academic
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Rara Academic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Book Landing Page: Missing AuthorizationCVE-2026-32378 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Book Landing Page book-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Book Landing Page: from n/a through <= 1.2.7.
- Product
- Book Landing Page
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Book Landing Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Pranayama Yoga: Missing AuthorizationCVE-2026-32377 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Pranayama Yoga pranayama-yoga allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pranayama Yoga: from n/a through <= 1.2.2.
- Product
- Pranayama Yoga
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Pranayama Yoga to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Kalon: Missing AuthorizationCVE-2026-32376 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Kalon kalon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kalon: from n/a through <= 1.2.9.
- Product
- Kalon
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update Kalon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Travel Diaries: Missing AuthorizationCVE-2026-32375 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Travel Diaries travel-diaries allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Diaries: from n/a through <= 1.2.4.
- Product
- Travel Diaries
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Travel Diaries to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026The Minimal: Missing AuthorizationCVE-2026-32374 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme The Minimal the-minimal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Minimal: from n/a through <= 1.2.9.
- Product
- The Minimal
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update The Minimal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026SMS Alert Order Notifications: Missing AuthorizationCVE-2026-32373 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: from n/a through <= 3.9.0.
- Product
- SMS Alert Order Notifications
- Affected
- up to 3.9.0
- What to do
- Affects up to 3.9.0. Update SMS Alert Order Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026ShopBuilder – Elementor WooCommerce Builder Addons: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-32372 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in RadiusTheme ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Retrieve Embedded Sensitive Data.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through <= 3.2.4.
- Product
- ShopBuilder – Elementor WooCommerce Builder Addons
- Affected
- up to 3.2.4
- What to do
- Affects up to 3.2.4. Update ShopBuilder – Elementor WooCommerce Builder Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Elegant Pink: Missing AuthorizationCVE-2026-32371 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Elegant Pink elegant-pink allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elegant Pink: from n/a through <= 1.3.3.
- Product
- Elegant Pink
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Elegant Pink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Influencer: Missing AuthorizationCVE-2026-32370 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Influencer influencer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Influencer: from n/a through <= 1.1.7.
- Product
- Influencer
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Influencer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026WPLifeCycle: Missing AuthorizationCVE-2026-32363 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Funlus Oy WPLifeCycle free-php-version-info allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPLifeCycle: from n/a through <= 3.3.1.
- Product
- WPLifeCycle
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update WPLifeCycle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026WP Sessions Time Monitoring Full Automatic: Missing AuthorizationCVE-2026-32362 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in activity-log.com WP Sessions Time Monitoring Full Automatic activitytime allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Sessions Time Monitoring Full Automatic: from n/a through <= 1.1.3.
- Product
- WP Sessions Time Monitoring Full Automatic
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update WP Sessions Time Monitoring Full Automatic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Chocolate House: Missing AuthorizationCVE-2026-32350 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpradiant Chocolate House chocolate-house allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chocolate House: from n/a through <= 1.1.5.
- Product
- Chocolate House
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Chocolate House to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026MAS Videos: Missing AuthorizationCVE-2026-32348 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in MadrasThemes MAS Videos masvideos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MAS Videos: from n/a through <= 1.3.2.
- Product
- MAS Videos
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update MAS Videos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Restaurant and Cafe: Missing AuthorizationCVE-2026-32347 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Restaurant and Cafe restaurant-and-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restaurant and Cafe: from n/a through <= 1.2.5.
- Product
- Restaurant and Cafe
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Restaurant and Cafe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Travel Agency: Missing AuthorizationCVE-2026-32346 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Travel Agency travel-agency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Agency: from n/a through <= 1.5.5.
- Product
- Travel Agency
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update Travel Agency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Perfect Portfolio: Missing AuthorizationCVE-2026-32345 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Perfect Portfolio perfect-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Perfect Portfolio: from n/a through <= 1.2.4.
- Product
- Perfect Portfolio
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Perfect Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Benevolent: Missing AuthorizationCVE-2026-32341 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Benevolent benevolent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Benevolent: from n/a through <= 1.3.9.
- Product
- Benevolent
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Benevolent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Business One Page: Missing AuthorizationCVE-2026-32340 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Business One Page business-one-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Business One Page: from n/a through <= 1.3.2.
- Product
- Business One Page
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Business One Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Bakes And Cakes: Missing AuthorizationCVE-2026-32339 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Bakes And Cakes bakes-and-cakes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bakes And Cakes: from n/a through <= 1.2.9.
- Product
- Bakes And Cakes
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update Bakes And Cakes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Construction Landing Page: Missing AuthorizationCVE-2026-32338 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Construction Landing Page construction-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Construction Landing Page: from n/a through <= 1.4.1.
- Product
- Construction Landing Page
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Construction Landing Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Preschool and Kindergarten: Missing AuthorizationCVE-2026-32337 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Preschool and Kindergarten preschool-and-kindergarten allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Preschool and Kindergarten: from n/a through <= 1.2.5.
- Product
- Preschool and Kindergarten
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Preschool and Kindergarten to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Rara Business: Missing AuthorizationCVE-2026-32336 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Rara Business rara-business allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rara Business: from n/a through <= 1.3.0.
- Product
- Rara Business
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Rara Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026The Conference: Missing AuthorizationCVE-2026-32335 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme The Conference the-conference allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Conference: from n/a through <= 1.2.5.
- Product
- The Conference
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update The Conference to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026JobScout: Missing AuthorizationCVE-2026-32334 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme JobScout jobscout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobScout: from n/a through <= 1.1.7.
- Product
- JobScout
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update JobScout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Easy Form: Missing AuthorizationCVE-2026-32332 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ays Pro Easy Form easy-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Form: from n/a through <= 2.7.9.
- Product
- Easy Form
- Affected
- up to 2.7.9
- What to do
- Affects up to 2.7.9. Update Easy Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Textmetrics: Missing AuthorizationCVE-2026-32331 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Israpil Textmetrics webtexttool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Textmetrics: from n/a through <= 3.6.4.
- Product
- Textmetrics
- Affected
- up to 3.6.4
- What to do
- Affects up to 3.6.4. Update Textmetrics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Advanced Related Posts: Missing AuthorizationCVE-2026-32329 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ays Pro Advanced Related Posts advanced-related-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Related Posts: from n/a through <= 1.9.1.
- Product
- Advanced Related Posts
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update Advanced Related Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Advanced Coupons for WooCommerce Coupons: Missing AuthorizationCVE-2026-31919 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Josh Kohlbach Advanced Coupons for WooCommerce Coupons advanced-coupons-for-woocommerce-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Coupons for WooCommerce Coupons: from n/a through <= 4.7.1.
- Product
- Advanced Coupons for WooCommerce Coupons
- Affected
- up to 4.7.1
- What to do
- Affects up to 4.7.1. Update Advanced Coupons for WooCommerce Coupons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Latest Post Shortcode: Missing AuthorizationCVE-2026-31916 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Iulia Cazan Latest Post Shortcode latest-post-shortcode allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Latest Post Shortcode: from n/a through <= 14.2.1.
- Product
- Latest Post Shortcode
- Affected
- up to 14.2.1
- What to do
- Affects up to 14.2.1. Update Latest Post Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Flatsome: Missing AuthorizationCVE-2026-31915 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in UX-themes Flatsome flatsome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flatsome: from n/a through <= 3.19.6.
- Product
- Flatsome
- Affected
- up to 3.19.6
- What to do
- Affects up to 3.19.6. Update Flatsome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Formidable Forms: An authorization bypass through user-controlled keyCVE-2026-2888 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Formidable Forms plugin for WordPress is vulnerable to an authorization bypass through user-controlled key in all versions up to, and including, 6.28. This is due to the `frm_strp_amount` AJAX handler (`update_intent_ajax`) overwriting the global `$_POST` data with attacker-controlled JSON input and then using those values to recalculate payment amounts via field shortcode resolution in `generate_false_entry()`. The handler relies on a nonce that is publicly exposed in the page's JavaScript (`frm_stripe_vars.nonce`), which provides CSRF protection but not authorization. This makes it possible for unauthenticated attackers to manipulate PaymentIntent amounts before payment completion on forms using dynamic pricing with field shortcodes, effectively paying a reduced amount for goods or services.
- Product
- Formidable Forms
- Affected
- up to 6.28
- What to do
- Affects up to 6.28. Update Formidable Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 13, 2026wpDiscuz before 7.6.47 contains a missing rate limiting vulnerability that allows unauthenticated attackers to subscribe arbitrary email addresses to post notifCVE-2026-22216 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
wpDiscuz before 7.6.47 contains a missing rate limiting vulnerability that allows unauthenticated attackers to subscribe arbitrary email addresses to post notifications by sending POST requests to the wpdAddSubscription handler in class.WpdiscuzHelperAjax.php. Attackers can exploit LIKE wildcard characters in the subscription query to match multiple email addresses and generate unwanted notification emails to victim accounts.
- Fixed in
- 7.6.47
- What to do
- Update the plugin to 7.6.47 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Mar 13, 2026wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvertently expose OAuth secrets by exporting plugin optCVE-2026-22203 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvertently expose OAuth secrets by exporting plugin options as JSON. Attackers can obtain exported files containing plaintext API secrets like fbAppSecret, googleClientSecret, twitterAppSecret, and other social login credentials from support tickets, backups, or version control repositories.
- Fixed in
- 7.6.47
- What to do
- Update the plugin to 7.6.47 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Mar 13, 2026wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users to trigger mass notification emails by exploitingCVE-2026-22182 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users to trigger mass notification emails by exploiting the checkNotificationType() function. Attackers can repeatedly call the wpdiscuz-ajax.php endpoint with arbitrary postId and comment_id parameters to flood subscribers with notifications, as the handler lacks nonce verification, authentication checks, and rate limiting.
- Fixed in
- 7.6.47
- What to do
- Update the plugin to 7.6.47 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Mar 12, 2026Timetics: Does not have authorization in a REST endpointCVE-2025-15473 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Timetics WordPress plugin before 1.0.52 does not have authorization in a REST endpoint, allowing unauthenticated users to arbitrarily change a booking's payment status and post status for the "timetics-booking" custom post type.
- Product
- Timetics
- Fixed in
- 1.0.52
- What to do
- Update Timetics to 1.0.52 or newer.
Mar 11, 2026LearnPress – WordPress LMS: Unauthorized email notification triggeringCVE-2026-3226 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized email notification triggering due to missing capability checks on all 10 functions in the SendEmailAjax class in all versions up to, and including, 4.3.2.8. The AbstractAjax::catch_lp_ajax() dispatcher verifies a wp_rest nonce but performs no current_user_can() check before dispatching to handler functions. The wp_rest nonce is embedded in the frontend JavaScript for all authenticated users. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger arbitrary email notifications to admins, instructors, and users, enabling email flooding, social engineering, and impersonation of admin decisions regarding instructor requests.
- Product
- LearnPress – WordPress LMS
- Affected
- up to 4.3.2.8
- What to do
- Affects up to 4.3.2.8. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 11, 2026WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1.CVE-2026-3906 · WordPress plugins & themes · reported by WordfenceMedium 4.3
WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature (block-level collaboration annotations) was introduced in WordPress 6.9 to allow editorial comments directly on posts in the block editor. However, the REST API `create_item_permissions_check()` method in the comments controller did not verify that the authenticated user has `edit_post` permission on the target post when creating a note. This makes it possible for authenticated attackers with Subscriber-level access to create notes on any post, including posts authored by other users, private posts, and posts in any status.
- Affected
- up to 6.9.1
- What to do
- Affects up to 6.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcore.trac.wordpress.orgcore.trac.wordpress.org
Mar 11, 2026Datalogics Ecommerce Delivery: Exposes an unauthenticated REST endpoint that allows any remote user to modify the option `datalogics_token` without verificationCVE-2026-2631 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Datalogics Ecommerce Delivery WordPress plugin before 2.6.60 exposes an unauthenticated REST endpoint that allows any remote user to modify the option `datalogics_token` without verification. This token is subsequently used for authentication in a protected endpoint that allows users to perform arbitrary WordPress `update_option()` operations. Attackers can use this to enable registartion and to set the default role as Administrator.
- Product
- Datalogics Ecommerce Delivery
- Fixed in
- 2.6.60
- What to do
- Update Datalogics Ecommerce Delivery to 2.6.60 or newer.
Mar 11, 2026divi-booster: Does not have authorization and CSRF checks in one of its fixing functionCVE-2026-2626 · WordPress plugins & themes · reported by WPScanHigh 8.1
The divi-booster WordPress plugin before 5.0.2 does not have authorization and CSRF checks in one of its fixing function, allowing unauthenticated users to modify stored divi-booster WordPress plugin before 5.0.2 options. Furthermore, due to the use of unserialize() on the data, this could be further exploited when combined with a PHP gadget chain to achieve PHP Object Injection
- Product
- divi-booster
- Fixed in
- 5.0.2
- What to do
- Update divi-booster to 5.0.2 or newer.
Mar 10, 2026MC4WP: Mailchimp for: Missing AuthorizationCVE-2026-1781 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.11.1. This is due to the plugin trusting the `_mc4wp_action` POST parameter without validation, allowing unauthenticated attackers to force the form to process unsubscribe actions instead of subscribe actions. This makes it possible for unauthenticated attackers to arbitrarily unsubscribe any email address from the connected Mailchimp audience via the `_mc4wp_action` parameter, granted they can obtain the form ID (which is publicly exposed in the HTML source).
- Product
- MC4WP: Mailchimp for
- Affected
- up to 4.11.1
- What to do
- Affects up to 4.11.1. Update MC4WP: Mailchimp for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Mar 10, 2026Booking Calendar for Appointments and Service Businesses – Booktics: Unauthorized modification of dataCVE-2026-1920 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'Extension_Controller::update_item_permissions_check' function in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to install addon plugins.
- Product
- Booking Calendar for Appointments and Service Businesses – Booktics
- Affected
- up to 1.0.16
- What to do
- Affects up to 1.0.16. Update Booking Calendar for Appointments and Service Businesses – Booktics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.