CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 65)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Unauthenticated PHP Object Injection
Bonbon
≤1.11No patch available
- High8.1Unauthenticated PHP Object Injection
Avventure
≤1.1.12No patch available
- High8.1Unauthenticated PHP Object Injection
Filmax | Cinema & Movie News Magazine WordPress Theme
≤1.1.11No patch available
- High8.1Unauthenticated PHP Object Injection
Orpheus
≤1.8No patch available
- High8.1Unauthenticated PHP Object Injection
Nuts
≤1.12No patch available
- High8.1Music Festival & Concert WordPress Theme <= 1.15 - Unauthenticated PHP Object Injection
Muzicon - Music Festival & Concert WordPress Theme
≤1.15No patch available
- High8.1Unauthenticated PHP Object Injection
Mission
≤1.22No patch available
- High8.1Personal Blog & Magazine WordPress Theme <= 1.2.14 - Unauthenticated PHP Object Injection
Marcell - Personal Blog & Magazine WordPress Theme
≤1.2.14No patch available
- High8.1Unauthenticated PHP Object Injection
Le Truffe
≤1.1.7No patch available
- High8.1Unauthenticated PHP Object Injection
Legal Stone | Lawyers & Attorneys WordPress Theme
≤1.2.11No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Easy Property Listings
≤3.5.25Update to 3.5.26
- High7.2Unauthenticated Stored Cross-Site Scripting
Auction Nudge – Your eBay Listings
≤8.4.0No patch available
- Medium5.3Unauthenticated Race Condition
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤7.4.8No patch available
- High8.1Unauthenticated PHP Object Injection
Affiliates
≤7.0.1Update to 7.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
JetEngine
≤3.8.16Update to 3.8.16.1
- High7.2Unauthenticated Stored Cross-Site Scripting
JetProductTables
≤1.2.4Update to 1.2.4.1
- Critical9.1Unauthenticated Arbitrary File Deletion
File Upload to Order for WooCommerce
≤1.1.3Update to 1.1.4
- Medium5.3Missing Authorization
WP OAuth Server ( Login with WordPress )
≤6.4.0Update to 6.5.0
- Medium5.3Missing Authorization
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.6Update to 3.6.6.1
- Medium5.3Missing Authorization
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.5.12Update to 7.5.13
- Medium4.3Missing Authorization
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.5.12Update to 7.5.13
- High7.2Unauthenticated Stored Cross-Site Scripting
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.5.12Update to 7.5.13
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Frontend Dashboard
≤3.0.7Update to 3.0.8
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP w3all phpBB
≤3.1.0Update to 3.1.2
- Medium5.3Unauthenticated Session Hijacking
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤7.3.2Update to 7.3.3
- Medium5.3Missing Authorization
Flexible Quantity & Price Calculator for WooCommerce
≤2.3.22Update to 2.3.23
- High7.5Authenticated (Custom Role+) PHP Object Injection
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.3Update to 4.9.4
- High7.2Unauthenticated Stored Cross-Site Scripting
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.3Update to 4.9.4
- Medium6.5Authenticated (Subscriber+) SQL Injection
Modern Events Calendar Lite
<7.37.0Update to 7.37.0
- Medium6.5Unauthenticated Arbitrary Shortcode Injection
Mailonix – Email Template Customizer for WooCommerce
≤1.3.4Update to 1.3.5