Advisories · Weakness

Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-107433 CVE record

CVSS 6.5 Medium

WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability
- miniOrange WP OAuth Server
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-85298 CVE record

CVSS 7.3 High

Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation
- Google Cloud Application Integration
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-108072 CVE record

CVSS 5.4 Medium

Insecure Permissions on Shared Startup Scripts Allow Cross-User Code Execution and Potential Privilege Escalation
- TSplus Remote Access
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-107431 CVE record

CVSS 7.5 High

WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability
- Crocoblock JetFormBuilder
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-101301 CVE record

CVSS 5.3 Medium

WPCode 2.0.0 - 2.3.9 - Unauthenticated Snippet Suppression via Safe Mode Bypass
- WPCode
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-103907 CVE record

CVSS 6.5 Medium

Jeg Kit for Elementor <= 3.2.19 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg_find_author' AJAX Action
- jegtheme Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-103366 CVE record

CVSS 7.5 High

Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters
- Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-110227 CVE record

CVSS 5.3 Medium

WordPress Restricted Site Access plugin <= 7.6.2 - Broken Access Control vulnerability
- 10up Restricted Site Access
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-110467 CVE record

CVSS 5.3 Medium

WisdomGarden｜Tronclass - Insecure Direct Object Reference
- WisdomGarden Tronclass
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-110465 CVE record

CVSS 5.3 Medium

WisdomGarden｜Tronclass - Insecure Direct Object Reference
- WisdomGarden Tronclass
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-96900 CVE record

CVSS 5.3 Medium

Cart Abandonment Recovery for WooCommerce < 2.1.4 - Unauthenticated Abandoned Cart Record Deletion and Modification via IDOR
- Cart Abandonment Recovery for WooCommerce
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-94360 CVE record

CVSS 5.3 Medium

Paymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Order Payment Forgery via Unverified Card Callbacks
- Paymentfor Gateway for WooCommerce
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-94261 CVE record

CVSS 5.3 Medium

Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Payment Confirmation Forgery via an Unbound Transaction Id
- Sifalo Pay
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-94260 CVE record

CVSS 5.3 Medium

Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Order Payment Metadata Modification and Forced Order Failure
- Sifalo Pay
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-94254 CVE record

CVSS 5.3 Medium

SellKit 2.3.5 - 2.7.0 - Unauthenticated Arbitrary Price Manipulation via 'sellkit_product_prices' Parameter
- SellKit
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-92426 CVE record

CVSS 4.9 Medium

YITH WooCommerce Popup < 1.60.0 - Contributor+ Arbitrary Post Meta Deletion
- YITH WooCommerce Popup
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-91076 CVE record

CVSS 5.3 Medium

Robokassa payment for WooCommerce < 1.9.0 - Unauthenticated Arbitrary Order Status Change to Failed
- Robokassa payment gateway for Woocommerce
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-88927 CVE record

CVSS 4.3 Medium

rtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Subscriber+ Arbitrary Album Media Injection via IDOR
- rtMedia for WordPress, BuddyPress and bbPress
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-87968 CVE record

CVSS 5.3 Medium

Product Feed for Google Shopping < 5.3.2 - Unauthenticated Forced Store Registration
- Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-87843 CVE record

CVSS 6.5 Medium

Trust Payments Gateway for WooCommerce < 3.1.0 - Unauthenticated Order Payment Completion via Payment Return Page
- Trust Payments Gateway for WooCommerce
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-85000 CVE record

CVSS 5.3 Medium

EmbedPress < 4.6.8 - Unauthenticated YouTube API Quota Consumption and Database Bloating
- EmbedPress
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-108066 CVE record

CVSS 2.7 Low

WP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR
- WP 2FA
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-108064 CVE record

CVSS 6.5 Medium

WP Encryption < 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Order Replacement via wple_auto_handler
- WP Encryption
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-107319 CVE record

CVSS 4.3 Medium

GamiPress < 8.0.6 - Subscriber+ Activity Log Disclosure
- GamiPress
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-107158 CVE record

CVSS 5.3 Medium

LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated FreightDesk Integration Option Update via REST Route
- LTL Freight Quotes
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-106646 CVE record

CVSS 5.9 Medium

Classified Listing < 6.1.1 - Subscriber+ Unattached Media Deletion and Modification via Gallery AJAX Handlers
- Classified Listing
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-106166 CVE record

CVSS 5.3 Medium

NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_entry_update_id' Parameter
- NEX-Forms
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-106098 CVE record

CVSS 5.3 Medium

WP Data Access < 5.5.77 - Unauthenticated Incorrect Authorization via Inline App Update
- WP Data Access
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-105975 CVE record

CVSS 5.3 Medium

CamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Payment Status Forgery via external_reference
- CamPay Shortcode Payment Gateway
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-104751 CVE record

CVSS 5.3 Medium

Rank Math SEO < 1.0.280 - Unauthenticated SEO Analyzer Results Deletion
- Rank Math SEO
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-110459 CVE record

CVSS 8.6 High

Improper access control in Ubiquiti Inc UniFi Protect AI Key
- Ubiquiti Inc UniFi Protect AI Key
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-110456 CVE record

CVSS 5.3 Medium

Improper access control in Ubiquiti Inc UniFi Protect AI Key
- Ubiquiti Inc UniFi Protect AI Key
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-110454 CVE record

CVSS 5.3 Medium

Improper access control in Ubiquiti Inc UniFi Protect AI Key
- Ubiquiti Inc UniFi Protect AI Key
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-110453 CVE record

CVSS 4.3 Medium

Incorrect authorization in Nix
- Nix
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-110451 CVE record

CVSS 4.3 Medium

Incorrect authorization in Nix
- Nix
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-97657 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Parameter
- Tyche Softwares Abandoned Cart Pro for WooCommerce
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-17092 CVE record

CVSS 8.1 High

Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' Parameter
- wpwax Directorist: AI-Powered Business Directory, Listings & Classified Ads
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-107652 CVE record

CVSS 5.3 Medium

Database Addon for Contact Form 7 <= 1.4.1 - Unauthenticated Limited File Deletion via Injected 'attackcfdb7_file' Submission Field
- arshidkv12 Database Addon for Contact Form 7 – CFDB7
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-103423 CVE record

CVSS 7.5 High

Booking Package <= 1.7.29 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'public=0'
- masaakitanaka Booking Package
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-110359 CVE record

CVSS 7.8 High

Incorrect default permissions in Hyland Desktop Host
- Hyland Desktop Host
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-92817 CVE record

CVSS 8.7 High

Inductive Automation Ignition Software Incorrect Authorization
- Inductive Automation Ignition
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-15468 CVE record

CVSS 6.9 Medium

Insecure direct object reference in HYPR Passwordless
- HYPR Passwordless
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-100114 CVE record

CVSS 7.5 High

CAI Content Credentials | Improper Access Control (CWE-284)
- Adobe Content Credentials Rust SDK
- Adobe C2PA Tool
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-100115 CVE record

CVSS 7.5 High

CAI Content Credentials | Improper Access Control (CWE-284)
- Adobe Content Credentials Rust SDK
- Adobe C2PA Tool
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-110144 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-110159 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-110160 CVE record

CVSS 4.2 Medium

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-95639 CVE record

CVSS 8.6 High

Photoshop Desktop | Incorrect Authorization (CWE-863)
- Adobe Photoshop
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-108388 CVE record

CVSS 3.5 Low

Indico legacy contribution export cache poisoning discloses restricted metadata
- indico
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-106618 CVE record

CVSS 8.8 High

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-105994 CVE record

CVSS 7.7 High

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-106089 CVE record

CVSS 8.8 High

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-106614 CVE record

CVSS 7.8 High

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-105898 CVE record

CVSS 8.2 High

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-75994 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-106090 CVE record

CVSS 8.8 High

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-106620 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-106612 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-106615 CVE record

CVSS 8.8 High

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-105901 CVE record

CVSS 8.8 High

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026