CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 70)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Server-Side Request Forgery
StreamCast – bring live radio to your site with a sleek player
≤2.4.6Update to 2.4.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Document Embedder – let visitors read files without downloading
≤2.5.0Update to 2.5.1
- High8.1Unauthenticated Local File Inclusion
DirectoryPress – Business Directory And Classified Ad Listing
≤3.6.27No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Before After Image Comparison – Visual Comparison for Two Images
≤1.1.21Update to 1.1.22
- Medium4.3Missing Authorization
Upcasted S3 Offload – AWS S3, DigitalOcean Spaces, Backblaze, MinIO Storage Integration
≤3.1.0No patch available
- High8.1Unauthenticated PHP Object Injection
Splendour
≤1.23No patch available
- High8.1Unauthenticated PHP Object Injection
Stargaze
≤1.10No patch available
- High8.1Unauthenticated PHP Object Injection
tipsy
≤1.6No patch available
- High8.1Unauthenticated PHP Object Injection
Wine House | Winery & Restaurant WordPress Theme
≤3.20No patch available
- High8.1Boat Services WordPress Theme <= 2.6 - Unauthenticated PHP Object Injection
Yacht Rental - Boat Services WordPress Theme
≤2.6No patch available
- Medium5.3Missing Authorization
click5 CRM add-on to Contact Form 7
≤1.0.4No patch available
- High7.5Unauthenticated SQL Injection
Post Voting System
≤1.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
SmugMug Embed
≤3.13No patch available
- High7.3Unauthenticated Privilege Escalation
AI Content Generator Marketing
≤1.0.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
click5 CRM add-on to WPForms
≤1.0.3No patch available
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Hotel Booking
≤3.8No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player
≤2.8.8No patch available
- High7.5Authenticated (Subscriber+) PHP Object Injection
Angio - Creative Music Theme
≤1.1.1No patch available
- Medium4.3Authenticated (Vendor+) Information Exposure
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.1.0Update to 5.2.0
- Medium5.3Unauthenticated Arbitrary Order Payment Bypass
Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway
≤1.7.2Update to 1.7.3
- Medium4.3Authenticated (Author+) Information Exposure
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
≤1.16.1Update to 1.16.2
- Medium5.4Authenticated (Custom+) Privilege Escalation to add_child REST endpoint
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning
≤4.0.3Update to 4.0.4
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Veeqo for WooCommerce
≤2.2.8No patch available
- Medium6.5Authenticated (Subscriber+) SQL Injection
paymendo – Bank Transfer (Lite)
≤1.1No patch available
- High7.5Unauthenticated SQL Injection
Loja Automática
≤1.0.0No patch available
- High7.5Unauthenticated SQL Injection
Recordbrowser
≤1.1.7No patch available
- High7.5Unauthenticated SQL Injection
Site Setup Wizard
≤1.5.8No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
KeyWord Collector
≤1.4No patch available
- Medium4.3Disabled Account Authorization Bypass
Disable Users
≤1.0.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
BuddyPress Instant Chat
≤1.6No patch available