CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 44)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Responsive WordPress Theme <= 7.0 - Unauthenticated PHP Object Injection
Hostme v2 - Responsive WordPress Theme
≤7.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
VikRentCar Car Rental Management System
≤1.4.8Update to 1.4.9
- Medium6.5Authenticated (Subscriber+) SQL Injection
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
≤8.0.7Update to 8.0.8
- High7.2Unauthenticated Stored Cross-Site Scripting
VikRentCar Car Rental Management System
≤1.4.8Update to 1.4.9
- Medium5.3Missing Authorization
Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more
≤9.6.3.0Update to 9.6.3.1
- Medium5.3Missing Authorization
WPMobile.App – Android and iOS App Builder
≤11.86Update to 11.87
- Medium4.34.0.4 - Authenticated (Subscriber+) Comment reCAPTCHA Protection Bypass
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
4.0.0 – 4.0.4Update to 4.0.5
- Medium6.3Authenticated (Custom Role+) Privilege Escalation
Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website
<3.3.3Update to 3.3.3
- Medium5.3Missing Authorization
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
<34.0.1Update to 34.0.1
- Medium5.3Unauthenticated Information Exposure
Booking Package
<1.7.31Update to 1.7.31
- Medium5.34.1.20 - Missing Authorization to Unauthenticated Maintenance Mode Bypass
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
4.1.19 – 4.1.20Update to 4.1.21
- Medium4.3Missing Authorization
News Kit Addons For Elementor
≤1.4.7No patch available
- Medium4.3Missing Authorization
SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher
<5.3.5No patch available
- High7.2Creative eCommerce Multi-Purpose WordPress Theme <= 4.25.0 - Unauthenticated Stored Cross-Site Scripting
KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme
≤4.25.0No patch available
- High8.1Unauthenticated PHP Object Injection
Little Birdies | Multipurpose Children PSD Template
≤1.3.16No patch available
- High8.1Business Portfolio Elementor Blocks & Template Kit <= 1.3.3 - Unauthenticated PHP Object Injection
Rhodos - Business Portfolio Elementor Blocks & Template Kit
≤1.3.3No patch available
- High8.1Unauthenticated PHP Object Injection
Hallelujah | Religion & Church Charity WordPress Theme
≤1.1.1No patch available
- High8.1Unauthenticated Local File Inclusion
Your Dress | Dress Rental & Clothing Store WordPress Theme + Shop
≤1.4.1No patch available
- High7.2Responsive WordPress Theme <= 7.0 - Unauthenticated Stored Cross-Site Scripting
Hostme v2 - Responsive WordPress Theme
≤7.0No patch available
- High8.1Unauthenticated PHP Object Injection
ZenSoul - Spa Salon & Wellness WordPress Theme + Shop & AI
≤1.13No patch available
- Medium4.3Missing Authorization
Car Rental Manager – Online Vehicle Booking System
≤1.5.3Update to 1.5.4
- Medium4.3Missing Authorization
MAS Videos
<1.3.5Update to 1.3.5
- Medium4.3Missing Authorization
Advanced Twenty Seventeen
≤1.3.1No patch available
- Medium5.3Unauthenticated Payment Forgery
Payment Gateway for Telcell
<2.0.5Update to 2.0.5
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Participants Database
≤2.7.8.5No patch available
- Medium4.3Missing Authorization
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.9.25Update to 2.9.26
- Medium5.3Missing Authorization
Bus Ticket Booking with Seat Reservation
≤5.9.7Update to 5.9.8
- Medium5.3Missing Authorization
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.30Update to 1.0.31
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Rootblox – Header & Footer Builder for Full Site Editing (FSE)
≤1.0.7Update to 1.0.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.5Update to 4.9.6