CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 32)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Authenticated (Contributor+) PHP Object Injection
10WebSocial
≤1.5.6No patch available
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Hotel Booking
≤3.8No patch available
- Medium5.3Unauthenticated Information Exposure
WP Crowdfunding
≤2.2.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
GlobalPayments Gateway Provider for WooCommerce
≤1.23.3No patch available
- High7.5Authenticated (Subscriber+) PHP Object Injection
BuddyPress Xprofile Custom Field Types
≤1.3.1No patch available
- High7.5Authenticated (Contributor+) PHP Object Injection
Extra Fees for WooCommerce
≤4.4.0No patch available
- High7.5Authenticated (Author+) PHP Object Injection
WPCargo Track & Trace
≤8.0.5No patch available
- Medium6.6Authenticated (Editor+) PHP Object Injection
Zippy
≤1.7.0No patch available
- High8.8Authenticated (Subscriber+) Privilege Escalation
BuddyBoss Platform
≤3.5.0Update to 3.6.1
- High8.1Unauthenticated Authentication Bypass
Security Plugin, Firewall & Malware Scanner with Auto Removal
≤2.190Update to 2.191
- Medium5.3Missing Authorization
Bricks Builder
≤2.4.3Update to 2.4.4
- Medium5.3Missing Authorization
Court Reservation – Tennis, Padel & Sports Court Booking
<1.12.4Update to 1.12.4
- Medium4.3Authenticated (Contributor+) Information Exposure
Page Builder by SiteOrigin
<2.38.0Update to 2.38.0
- Medium5.8Unauthenticated CSV Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.15.3Update to 3.15.4
- Medium5.3Missing Authorization to Unauthenticated Information Exposure
PiWeb Disable payment method / Partial payment for WooCommerce
<1.1.10.9No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Firelight Lightbox
≤2.3.22Update to 2.3.23
- Medium4.3Missing Authorization
BuddyForms
≤2.10.0Update to 2.10.1
- Medium5.3Unauthenticated Information Exposure
BuddyForms
≤2.10.2Update to 2.10.3
- Medium4.3Missing Authorization
Fraud Prevention For WooCommerce and EDD
≤2.3.5Update to 2.3.6
- Medium6.46.4.1 - Authenticated (Author+) Stored Cross-Site Scripting
Joinchat – Enhanced “click to chat”
6.3.2 – 6.4.1Update to 6.4.2
- Medium4.9Authenticated (Administrator+) SQL Injection
WP Visitor Statistics (Real Time Traffic)
≤8.7Update to 8.8
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Visitor Statistics (Real Time Traffic)
≤8.7Update to 8.8
- Medium4.3Missing Authorization
My auctions allegro
≤4.0.3Update to 4.0.4
- Medium6.53.6.3 - Authenticated (Contributor+) SQL Injection
Recipe Card Blocks Lite
3.5.0 – 3.6.3Update to 3.6.4
- Medium6.1Reflected Cross-Site Scripting
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.13Update to 4.3.14
- High7.2Unauthenticated Server-Side Request Forgery
Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation
<2.0.2Update to 2.0.2
- Medium4.9Authenticated (Administrator+) SQL Injection
Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation
<2.0.2Update to 2.0.2
- High7.2Authenticated (Administrator+) Remote Code Execution
Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation
<2.0.2Update to 2.0.2
- Low2.7Authenticated (Administrator+) Information Exposure
Security Plugin, Firewall & Malware Scanner with Auto Removal
≤2.190Update to 2.191
- High8.14.2.2 - Unauthenticated PHP Object Injection
Enable Media Replace
4.1.4 – 4.2.2Update to 4.2.3