CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 45)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery
VikRentCar Car Rental Management System
≤1.4.8Update to 1.4.9
- Medium4.3Missing Authorization
Meta Box – A Framework for Dynamic Websites
≤5.15.2Update to 5.15.3
- Medium5.3Missing Authorization
Seriously Simple Podcasting
≤3.17.0Update to 3.17.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Seriously Simple Podcasting
≤3.17.0Update to 3.17.1
- High7.1Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.3Update to 4.0.4
- High8.8Unauthenticated PHP Object Injection
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
≤1.5.17Update to 5.0.0
- High8.1Unauthenticated Local File Inclusion
Rootblox – Header & Footer Builder for Full Site Editing (FSE)
≤1.0.6Update to 1.0.7
- Medium5.3Missing Authorization
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.1.2Update to 3.1.3
- Medium6.5Authenticated (Subscriber+) SQL Injection
Workreap Core
<3.4.4Update to 3.4.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Brizy – Page Builder
2.8.23 – 2.8.23Update to 2.8.24
- High7.2Unauthenticated Stored Cross-Site Scripting
Advanced Custom Fields: Extended
≤0.9.2.7Update to 0.9.2.8
- High8.8Authenticated (Contributor+) Remote Code Execution
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1068Update to 1.7.1069
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Mailster
≤1.9.1.0Update to 1.9.2.0
- Medium6.3Authenticated (Author+) Privilege Escalation
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.4Update to 4.0.5
- High7.5Unauthenticated SQL Injection
Booking for Appointments and Events Calendar – Amelia
≤2.4.11Update to 2.4.12
- High7.2Unauthenticated Stored Cross-Site Scripting
Contact Form Email
≤1.3.68Update to 1.3.69
- High7.2Unauthenticated Stored Cross-Site Scripting
WebP Express
≤0.25.15Update to 0.25.16
- Medium4.32.3.2 - Authenticated (Author+) Arbitrary Email Header Injection
Subscribe to Comments
2.3 – 2.3.2Update to 2.3.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Link Library
≤7.9.5Update to 7.9.6
- Medium4.3Missing Authorization
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.10Update to 4.4.11
- Medium6.1WordPress Event & Booking Manager Plugin <= 0.1.1 - Reflected Cross-Site Scripting
Eventer
≤0.1.1No patch available
- Medium4.3Authenticated (Custom+) Insecure Direct Object Reference
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
<4.4.10No patch available
- High8.1Unauthenticated Local File Inclusion
Academist Core
≤1.4.1No patch available
- Medium5.3Missing Authorization
Advanced Custom Fields: Extended
≤0.9.2.7Update to 0.9.2.8
- Critical9.1Unauthenticated Arbitrary File Deletion
Advanced Custom Fields: Extended
≤0.9.2.7Update to 0.9.2.8
- Medium5.3Missing Authorization
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.5Update to 4.9.6
- Medium4.3Authenticated (Author+) Insecure Direct Object Reference
Photo Engine (Media Organizer & Lightroom)
≤6.5.7Update to 6.5.8
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Photo Engine (Media Organizer & Lightroom)
≤6.5.7Update to 6.5.8
- High7.5Authentication Bypass
Royal MCP – Secure AI Connector for Claude, ChatGPT & any LLM via MCP
<1.5.7Update to 1.5.7
- Medium4.32.12.2 - Missing Authorization
MB Custom Post Types & Custom Taxonomies
2.4.0 – 2.12.2Update to 2.12.3