CWE-862 CVEs

Unauthenticated Broken Access Control in ez Form Calculator Premium <= 2.14.1.2 versions.

Subscriber Broken Access Control in Booked <= 3.0.0 versions.

Contributor Broken Access Control in Flatsome <= 3.20.5 versions.

Subscriber Broken Access Control in Flatsome <= 3.20.5 versions.

Subscriber Broken Access Control in Werkstatt <= 4.7.2 versions.

Unauthenticated Broken Access Control in POS Entegratör <= 3.7.103 versions.

Subscriber Broken Access Control in Martfury - WooCommerce Marketplace WordPress Theme <= 3.2.8 versions.

Subscriber Broken Access Control in Advanced Contact form 7 DB <= 2.0.9 versions.

Subscriber Broken Access Control in Classified Listing <= 5.4.2 versions.

Subscriber Broken Access Control in Link Whisper Premium <= 2.9.0 versions.

Unauthenticated Broken Access Control in NOWPayments for WooCommerce <= 1.4.0 versions.

Unauthenticated Broken Access Control in Motors <= 5.6.80 versions.

Unauthenticated Arbitrary Content Deletion in OpenAI Chatbot for WordPress – Helper <= 1.1.4 versions.

Unauthenticated Broken Access Control in Woostify Sites Library <= 1.6.2 versions.

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin…

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.11. This is du…

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.7.8. This is…

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.11 v…

The Envo's Templates & Widgets for Elementor and WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the Envo Tab…

The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versi…

Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.21 and 4.0.0-RC1 through 4.17.14, theAssetsController::actionDeleteFolder() only requires the del…

Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 through 5.9.20, and 4.0.0-RC1 through 4.17.13 contain an authorization issue in the AssetsController::actionRepl…

In versions prior to 7.1.2-26he, the `-concatenate` operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security polic…

Missing Authorization vulnerability in WP Reloaded ApplyOnline allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ApplyOnline: from n/a t…

Missing Authorization vulnerability in Codexpert Inc ThumbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ThumbPress: from n/a t…