Common Weakness Enumeration

CWE-269

Discouraged

Improper Privilege Management

Abstraction: Class · Status: Draft

API response cwe.mitre.org

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

1589 vulnerabilities reference this CWE, most recent first.

CVE-2026-104798 (GCVE-0-2026-104798)

Vulnerability from cvelistv5 – Published: 2026-10-16 04:27 – Updated: 2026-10-16 17:07
VLAI
Title
My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute
Summary
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs, allowing an unauthenticated attacker to inject a nested `[my_calendar above=...]` shortcode; `mc_generate_calendar_nav()` then splits the `above` attribute on commas and dispatches each element via `call_user_func()` with no authentication, authorization, or callable allowlist check. This makes it possible for unauthenticated attackers to invoke arbitrary loaded PHP functions, enabling a call chain in which the shortcode `$params` array is passed to `edit_user()` — which PHP coerces to integer `1` as the `$user_id` argument — overwriting the credentials of the initial Administrator account (user ID 1) and granting the attacker full wp-admin access. Exploitation is trivially reachable via the plugin's auto-generated `/my-calendar/` page, which is publicly accessible by default upon plugin activation.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:48 UTC
CWE
  • CWE-269 - Improper Privilege Management
Assigner
Wordfence CNA
References
Impacted products
Vendor Product Version
joedolson My Calendar – Accessible Event Manager Affected: 0 , ≤ 3.4.24 (semver)
Affected: 3.5 , ≤ 3.5.21 (semver)
Affected: 3.6 , ≤ 3.6.17 (semver)
Affected: 3.7 , ≤ 3.7.17 (semver)
Affected: 3.8 , ≤ 3.8.7 (semver)
Create a notification for this product.
Credits
daroo
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104798",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T16:48:56.803700Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T17:07:17.621Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "My Calendar \u2013 Accessible Event Manager",
          "vendor": "joedolson",
          "versions": [
            {
              "lessThanOrEqual": "3.4.24",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "3.5.21",
              "status": "affected",
              "version": "3.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "3.6.17",
              "status": "affected",
              "version": "3.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "3.7.17",
              "status": "affected",
              "version": "3.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "3.8.7",
              "status": "affected",
              "version": "3.8",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "daroo"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The My Calendar \u2013 Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core\u0027s `do_shortcode` filter runs, allowing an unauthenticated attacker to inject a nested `[my_calendar above=...]` shortcode; `mc_generate_calendar_nav()` then splits the `above` attribute on commas and dispatches each element via `call_user_func()` with no authentication, authorization, or callable allowlist check. This makes it possible for unauthenticated attackers to invoke arbitrary loaded PHP functions, enabling a call chain in which the shortcode `$params` array is passed to `edit_user()` \u2014 which PHP coerces to integer `1` as the `$user_id` argument \u2014 overwriting the credentials of the initial Administrator account (user ID 1) and granting the attacker full wp-admin access. Exploitation is trivially reachable via the plugin\u0027s auto-generated `/my-calendar/` page, which is publicly accessible by default upon plugin activation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T04:27:04.876Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e8aa6ee7-525e-4458-9f5b-1e729afe448c?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-navigation.php#L248"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-navigation.php#L260"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-search.php#L221"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-search.php#L170"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-shortcodes.php#L102"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-output.php#L1622"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3746389%40my-calendar\u0026new=3746389%40my-calendar"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-02T13:27:02.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-15T16:25:37.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "My Calendar \u003c= 3.8.7 - Unauthenticated Privilege Escalation to \u0027mcs\u0027 Parameter via Reflected Shortcode Injection into \u0027above\u0027 Attribute"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104798",
    "datePublished": "2026-10-16T04:27:04.876Z",
    "dateReserved": "2026-10-02T13:12:10.980Z",
    "dateUpdated": "2026-10-16T17:07:17.621Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-104768 (GCVE-0-2026-104768)

Vulnerability from cvelistv5 – Published: 2026-11-07 11:26 – Updated: 2026-11-08 01:06
VLAI
Title
AutomatorWP <= 6.0.4 - Unauthenticated Privilege Escalation to Insufficient Role Validation in Anonymous Automation 'Role' Option
Summary
The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.0.4. This is due to missing privilege-ceiling validation in the `create_user()` function within the anonymous-user action (and equally in the Create User and Add/Change Role WordPress-integration actions), which verify only that the submitted role exists via `automatorwp_get_editable_roles()` without confirming the role falls at or below the acting context's privilege level — allowing attacker-controlled trigger tag data (e.g., a `{comment_author}` tag bound to the Role option) to supply any role, including `administrator`, unchallenged. This makes it possible for unauthenticated attackers to create a new administrator-role account tied to an attacker-controlled email address, receiving the generated password via WordPress's new-user notification email and thereby gaining full administrative access to the site. Exploitation requires the site to have an anonymous automation configured with the Role option bound to a dynamic trigger tag such as `{comment_author}`, and is triggered when a site administrator performs the routine action of approving a comment — an action that provides no in-UI indication that it will mint a new privileged account from the comment author field.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-08 01:06 UTC
CWE
  • CWE-269 - Improper Privilege Management
Assigner
Wordfence CNA
References
Impacted products
Credits
John Ryan Albon
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104768",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-08T01:06:47.285033Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-08T01:06:54.511Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "AutomatorWP \u2013 No-Code Workflow Automation, Integration \u0026 Webhooks Plugin, now with AI",
          "vendor": "rubengc",
          "versions": [
            {
              "lessThanOrEqual": "6.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Ryan Albon"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The AutomatorWP \u2013 No-Code Workflow Automation, Integration \u0026 Webhooks Plugin, now with AI plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.0.4. This is due to missing privilege-ceiling validation in the `create_user()` function within the anonymous-user action (and equally in the Create User and Add/Change Role WordPress-integration actions), which verify only that the submitted role exists via `automatorwp_get_editable_roles()` without confirming the role falls at or below the acting context\u0027s privilege level \u2014 allowing attacker-controlled trigger tag data (e.g., a `{comment_author}` tag bound to the Role option) to supply any role, including `administrator`, unchallenged. This makes it possible for unauthenticated attackers to create a new administrator-role account tied to an attacker-controlled email address, receiving the generated password via WordPress\u0027s new-user notification email and thereby gaining full administrative access to the site. Exploitation requires the site to have an anonymous automation configured with the Role option bound to a dynamic trigger tag such as `{comment_author}`, and is triggered when a site administrator performs the routine action of approving a comment \u2014 an action that provides no in-UI indication that it will mint a new privileged account from the comment author field."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:29.486Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6138f184-4475-4288-835f-9bf8c21f9147?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/integrations/automatorwp/actions/anonymous-user.php#L500"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/integrations/automatorwp/actions/anonymous-user.php#L487"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/includes/events.php#L1303"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/integrations/wordpress/triggers/anonymous-comment-post-type.php#L111"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/integrations/wordpress/actions/create-user.php#L174"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/integrations/wordpress/actions/user-role.php#L149"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3754573%40automatorwp\u0026new=3754573%40automatorwp"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-06T23:15:57.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "AutomatorWP \u003c= 6.0.4 - Unauthenticated Privilege Escalation to Insufficient Role Validation in Anonymous Automation \u0027Role\u0027 Option"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104768",
    "datePublished": "2026-11-07T11:26:29.486Z",
    "dateReserved": "2026-10-02T13:02:33.640Z",
    "dateUpdated": "2026-11-08T01:06:54.511Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-104767 (GCVE-0-2026-104767)

Vulnerability from cvelistv5 – Published: 2026-10-14 01:27 – Updated: 2026-10-15 16:43
VLAI
Title
Membership & User Roles for WooCommerce (Automatic Role Changer) <= 20260828 - Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache
Summary
The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. This is due to the `maybe_add_role_to_user()` function unconditionally re-assigning every role stored in the `dfxwcrc_foreign_roles` user meta cache without verifying that each cached role is still actively assigned by the external provider — a condition made permanent by `remember_foreign_roles()`, which merges new foreign roles into the cache but never evicts roles that have since been revoked. This makes it possible for authenticated attackers with subscriber-level access and above to restore a previously revoked Administrator role to their own account, gaining full administrative control of the site, by triggering any role-assignment event such as completing a purchase for a role-mapped product. Exploitation requires Replace Roles mode to be enabled and the attacker's account to have previously received Administrator legitimately through a separate role-management mechanism while the plugin was active, so that `administrator` was written into the `dfxwcrc_foreign_roles` user meta cache before the external provider revoked it.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 10:52 UTC
CWE
  • CWE-269 - Improper Privilege Management
Assigner
Wordfence CNA
References
Impacted products
Credits
Azgnt
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104767",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T10:52:56.368683Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T16:43:51.168Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Membership \u0026 User Roles for WooCommerce (Automatic Role Changer)",
          "vendor": "davefx",
          "versions": [
            {
              "lessThanOrEqual": "20260828",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Azgnt"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Membership \u0026 User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. This is due to the `maybe_add_role_to_user()` function unconditionally re-assigning every role stored in the `dfxwcrc_foreign_roles` user meta cache without verifying that each cached role is still actively assigned by the external provider \u2014 a condition made permanent by `remember_foreign_roles()`, which merges new foreign roles into the cache but never evicts roles that have since been revoked. This makes it possible for authenticated attackers with subscriber-level access and above to restore a previously revoked Administrator role to their own account, gaining full administrative control of the site, by triggering any role-assignment event such as completing a purchase for a role-mapped product. Exploitation requires Replace Roles mode to be enabled and the attacker\u0027s account to have previously received Administrator legitimately through a separate role-management mechanism while the plugin was active, so that `administrator` was written into the `dfxwcrc_foreign_roles` user meta cache before the external provider revoked it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T01:27:14.736Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/833d9f92-9af1-4332-9b1d-2d1d37073b4b?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/dfx-woo-role-changer/trunk/dfx-woo-role-changer.php#L468"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/dfx-woo-role-changer/trunk/dfx-woo-role-changer.php#L427"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/dfx-woo-role-changer/trunk/dfx-woo-role-changer.php#L414"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/dfx-woo-role-changer/trunk/dfx-woo-role-changer.php#L351"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3732550%40dfx-woo-role-changer\u0026new=3732550%40dfx-woo-role-changer"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-07T11:22:33.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-13T12:40:58.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Membership \u0026 User Roles for WooCommerce (Automatic Role Changer) \u003c= 20260828 - Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104767",
    "datePublished": "2026-10-14T01:27:14.736Z",
    "dateReserved": "2026-10-02T12:46:50.279Z",
    "dateUpdated": "2026-10-15T16:43:51.168Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-104766 (GCVE-0-2026-104766)

Vulnerability from cvelistv5 – Published: 2026-10-10 05:30 – Updated: 2026-10-11 16:55
VLAI
Title
Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter
Summary
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.7.3. This is due to the `OsSettingsController::update()` handler iterating over attacker-supplied `settings` parameters without an allowlist of permitted setting names or values, and `OsSettingsHelper::prepare_value()` performing no role allowlist validation before persisting the `default_wp_role_for_customer` setting — a restriction that exists only in the UI dropdown and is never enforced server-side. This makes it possible for authenticated attackers holding a LatePoint role with the `settings__edit` capability (such as an agent or custom role) to overwrite the default WordPress role for new customers with `administrator`, causing any subsequently self-registered LatePoint customer account to be created with full WordPress administrator privileges. Exploitation requires that a WordPress administrator has granted the `settings__edit` capability to a LatePoint agent or custom role, and that a new customer account is registered through LatePoint after the malicious setting change is persisted.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 16:38 UTC
CWE
  • CWE-269 - Improper Privilege Management
Assigner
Wordfence CNA
References
Impacted products
Credits
Wordfence PRISM
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104766",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-11T16:38:26.953919Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-11T16:55:18.205Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
          "vendor": "latepoint",
          "versions": [
            {
              "lessThanOrEqual": "5.7.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.7.3. This is due to the `OsSettingsController::update()` handler iterating over attacker-supplied `settings` parameters without an allowlist of permitted setting names or values, and `OsSettingsHelper::prepare_value()` performing no role allowlist validation before persisting the `default_wp_role_for_customer` setting \u2014 a restriction that exists only in the UI dropdown and is never enforced server-side. This makes it possible for authenticated attackers holding a LatePoint role with the `settings__edit` capability (such as an agent or custom role) to overwrite the default WordPress role for new customers with `administrator`, causing any subsequently self-registered LatePoint customer account to be created with full WordPress administrator privileges. Exploitation requires that a WordPress administrator has granted the `settings__edit` capability to a LatePoint agent or custom role, and that a new customer account is registered through LatePoint after the malicious setting change is persisted."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-10T05:30:57.307Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/38870e14-2e8f-4281-adb6-4be3b1d3d2ce?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/controllers/settings_controller.php#L469"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/settings_helper.php#L754"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/customer_helper.php#L297"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/settings_helper.php#L953"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3728691%40latepoint\u0026new=3728691%40latepoint"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-02T12:55:22.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-09T17:19:05.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Appointment Booking Plugin \u003c= 5.7.3 - Authenticated (Custom+) Privilege Escalation to \u0027settings[default_wp_role_for_customer]\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104766",
    "datePublished": "2026-10-10T05:30:57.307Z",
    "dateReserved": "2026-10-02T12:39:39.043Z",
    "dateUpdated": "2026-10-11T16:55:18.205Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-104755 (GCVE-0-2026-104755)

Vulnerability from cvelistv5 – Published: 2026-10-16 06:41 – Updated: 2026-10-16 15:09
VLAI
Title
WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint
Summary
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the `start_comms` dispatcher (`wps_ic_comms::start_comms`), hooked on every front-end request, gates access only by comparing the caller-supplied `apikey` parameter against the stored plugin API key with no WordPress capability check and no nonce verification, then passes the unvalidated `group`, `setting`, and `value` parameters directly to `change_setting()`, which writes them into the `WPS_IC_SETTINGS` option without an allow-list. This makes it possible for unauthenticated attackers to write arbitrary permission keys into the plugin's settings, causing `wps_ic_users::checkAndAddCaps()` to grant any WordPress role — including Subscriber — the `manage_wpc_settings` capability and thereby achieve plugin-administrator-equivalent control over the plugin's optimization, CDN, and critical-CSS surfaces. The API key required to pass the authorization check can itself be obtained without authentication via the `wpc_send_critical_remote` nopriv AJAX action: when the external critical-CSS service returns an `apiResults` field, `initCritical()` echoes the stored plugin API key back to the caller in a `wp_send_json_success` response, completing the exploit chain entirely without a WordPress login.
Severity
4.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:55 UTC
CWE
  • CWE-269 - Improper Privilege Management
Assigner
Wordfence CNA
References
Impacted products
Credits
Wordfence PRISM
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104755",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T14:55:02.789066Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T15:09:38.262Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Compress \u2013 Instant Performance \u0026 Speed Optimization",
          "vendor": "aresit",
          "versions": [
            {
              "lessThanOrEqual": "7.25.00",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Compress \u2013 Instant Performance \u0026 Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the `start_comms` dispatcher (`wps_ic_comms::start_comms`), hooked on every front-end request, gates access only by comparing the caller-supplied `apikey` parameter against the stored plugin API key with no WordPress capability check and no nonce verification, then passes the unvalidated `group`, `setting`, and `value` parameters directly to `change_setting()`, which writes them into the `WPS_IC_SETTINGS` option without an allow-list. This makes it possible for unauthenticated attackers to write arbitrary permission keys into the plugin\u0027s settings, causing `wps_ic_users::checkAndAddCaps()` to grant any WordPress role \u2014 including Subscriber \u2014 the `manage_wpc_settings` capability and thereby achieve plugin-administrator-equivalent control over the plugin\u0027s optimization, CDN, and critical-CSS surfaces. The API key required to pass the authorization check can itself be obtained without authentication via the `wpc_send_critical_remote` nopriv AJAX action: when the external critical-CSS service returns an `apiResults` field, `initCritical()` echoes the stored plugin API key back to the caller in a `wp_send_json_success` response, completing the exploit chain entirely without a WordPress login."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T06:41:04.957Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/67e9bfb8-b274-422a-a50d-a6b6b24bb193?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/comms.class.php#L49"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/users.class.php#L30"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/comms.class.php#L1042"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/ajax.class.php#L816"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/addons/criticalCss/criticalCss.php#L409"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3734610%40wp-compress-image-optimizer%2Ftags%2F7.26.00\u0026old=3723132%40wp-compress-image-optimizer%2Ftags%2F7.25.00"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-02T12:30:28.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-15T17:35:06.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Compress \u003c= 7.25.00 - Unauthenticated Privilege Escalation to \u0027group\u0027/\u0027setting\u0027/\u0027value\u0027 Parameters on comms Endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104755",
    "datePublished": "2026-10-16T06:41:04.957Z",
    "dateReserved": "2026-10-02T12:15:34.261Z",
    "dateUpdated": "2026-10-16T15:09:38.262Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-104749 (GCVE-0-2026-104749)

Vulnerability from cvelistv5 – Published: 2026-10-14 01:27 – Updated: 2026-10-14 18:05
VLAI
Title
Bit integrations <= 2.10.6 - Unauthenticated Privilege Escalation via Identity-Confused Log Re-execution to Account Takeover via Log Re-execution of Anonymous-Captured Field Data
Summary
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execution in all versions up to, and including, 2.10.6 The vulnerability exists because `IntegrationHandler::executeWithCapture()` stores raw, attacker-controlled field values — including `user_pass` and `user_email` — verbatim into `wp_btcbi_log.field_data` on anonymous front-end requests with no capability check, and `LogHandler::reexecute()` feeds that stored payload back through `Flow::execute()` inside the replaying administrator's session without validating the identity that originally produced the data, causing `RegistrationController::updateUser()` to resolve the target user ID to the administrator and write the attacker-supplied password via `wp_update_user()`. This makes it possible for unauthenticated attackers to overwrite the administrator's password and fully take over the administrator account. Exploitation requires that an administrator has configured a flow mapping a user-supplied form field to the `user_pass` parameter of the WP User Registration "Update User" action, and that the administrator subsequently clicks "Re-execute" on the failure log row produced by the anonymous submission from the plugin's log screen.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 18:05 UTC
CWE
  • CWE-269 - Improper Privilege Management
Assigner
Wordfence CNA
References
Impacted products
Credits
crow
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104749",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T18:05:29.960311Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T18:05:48.700Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Bit integrations \u2013 Form Integration, Webhook, Spreadsheets, CRM, LMS \u0026 Email Automation",
          "vendor": "bitpressadmin",
          "versions": [
            {
              "lessThanOrEqual": "2.10.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "crow"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Bit integrations \u2013 Form Integration, Webhook, Spreadsheets, CRM, LMS \u0026 Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execution in all versions up to, and including, 2.10.6 The vulnerability exists because `IntegrationHandler::executeWithCapture()` stores raw, attacker-controlled field values \u2014 including `user_pass` and `user_email` \u2014 verbatim into `wp_btcbi_log.field_data` on anonymous front-end requests with no capability check, and `LogHandler::reexecute()` feeds that stored payload back through `Flow::execute()` inside the replaying administrator\u0027s session without validating the identity that originally produced the data, causing `RegistrationController::updateUser()` to resolve the target user ID to the administrator and write the attacker-supplied password via `wp_update_user()`. This makes it possible for unauthenticated attackers to overwrite the administrator\u0027s password and fully take over the administrator account. Exploitation requires that an administrator has configured a flow mapping a user-supplied form field to the `user_pass` parameter of the WP User Registration \"Update User\" action, and that the administrator subsequently clicks \"Re-execute\" on the failure log row produced by the anonymous submission from the plugin\u0027s log screen."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T01:27:13.619Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/24f112eb-4abe-4acf-a769-c93246e30958?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Actions/Registration/RegistrationController.php#L309"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Log/LogHandler.php#L290"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Log/LogHandler.php#L553"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Core/Integration/IntegrationHandler.php#L39"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Triggers/CF7/CF7Controller.php#L139"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3730118/bit-integrations/trunk/backend/Log/LogHandler.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-02T12:22:14.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-13T12:13:21.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Bit integrations \u003c= 2.10.6 - Unauthenticated Privilege Escalation via Identity-Confused Log Re-execution to Account Takeover via Log Re-execution of Anonymous-Captured Field Data"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104749",
    "datePublished": "2026-10-14T01:27:13.619Z",
    "dateReserved": "2026-10-02T12:07:19.141Z",
    "dateUpdated": "2026-10-14T18:05:48.700Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-104748 (GCVE-0-2026-104748)

Vulnerability from cvelistv5 – Published: 2026-10-14 07:43 – Updated: 2026-10-15 16:43
VLAI
Title
SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register
Summary
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the `wp_ajax_nopriv_simpleform_wp_register` AJAX action lacking any capability check for role assignment and the `save_custom_fields_to_user_meta()` function using an exclusion list that omits `wp_capabilities`, combined with `get_form_settings()` returning a hard-coded defaults array that unconditionally enables meta writing regardless of the supplied `form_id`. This makes it possible for unauthenticated attackers to create a new Administrator-level WordPress account by supplying `wp_capabilities[administrator]=1` alongside standard registration fields. The nonce required by the endpoint is publicly emitted into the `front_end_data` JavaScript object on every front-end page via `wp_enqueue_scripts`, making it trivially obtainable by any unauthenticated visitor before submitting the malicious request.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 10:51 UTC
CWE
  • CWE-269 - Improper Privilege Management
Assigner
Wordfence CNA
References
Impacted products
Credits
Sebastian Albrecht (mySebbe)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104748",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T10:51:33.935369Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T16:43:48.707Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SimpleForm \u2013 Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications",
          "vendor": "wpazleen",
          "versions": [
            {
              "lessThanOrEqual": "3.10.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sebastian Albrecht (mySebbe)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The SimpleForm \u2013 Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the `wp_ajax_nopriv_simpleform_wp_register` AJAX action lacking any capability check for role assignment and the `save_custom_fields_to_user_meta()` function using an exclusion list that omits `wp_capabilities`, combined with `get_form_settings()` returning a hard-coded defaults array that unconditionally enables meta writing regardless of the supplied `form_id`. This makes it possible for unauthenticated attackers to create a new Administrator-level WordPress account by supplying `wp_capabilities[administrator]=1` alongside standard registration fields. The nonce required by the endpoint is publicly emitted into the `front_end_data` JavaScript object on every front-end page via `wp_enqueue_scripts`, making it trivially obtainable by any unauthenticated visitor before submitting the malicious request."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T07:43:35.763Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b2b973fe-1209-43dc-b2a3-74086b12fe97?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAuth.php#L291"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAuth.php#L184"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Integrations/WordPressAuth.php#L32"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.0/app/Assets.php#L265"
        },
        {
          "url": "https://plugins.svn.wordpress.org/simple-form/trunk/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3726513/simple-form/trunk/app/Integrations/WordPressAuth.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-03T14:35:51.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-13T19:40:33.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "SimpleForm \u003c= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104748",
    "datePublished": "2026-10-14T07:43:35.763Z",
    "dateReserved": "2026-10-02T12:06:56.683Z",
    "dateUpdated": "2026-10-15T16:43:48.707Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-104745 (GCVE-0-2026-104745)

Vulnerability from cvelistv5 – Published: 2026-10-16 03:38 – Updated: 2026-10-16 15:09
VLAI
Title
Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter
Summary
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0. The vulnerability exists because `alg_wc_ev_generate_user_code()` generates the per-user activation secret using `wp_rand(100)` when the plugin's 'Encoding method' is set to 'hashids', producing only ~101 possible values (~7 bits of entropy); the resulting token is a reversible Hashids encoding with no cryptographic MAC, and the unauthenticated `verify()` handler — hooked to `init` at `PHP_INT_MAX` with no nonce check and no rate limiting — accepts and acts on the attacker-controlled `?alg_wc_ev_verify_email=` GET parameter directly. This makes it possible for unauthenticated attackers to gain authentication as any unverified WordPress account, including administrator-level accounts, by brute-forcing the trivially small activation code space via a forged verification URL. Exploitation requires that the 'Encoding method' setting be changed to 'hashids' (non-default), that the attacker recover or brute-force the Hashids salt (which defaults to an `md5(time())` value set at first initialization), and that the target account's email address remain unverified.
Severity
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:50 UTC
CWE
  • CWE-269 - Improper Privilege Management
Assigner
Wordfence CNA
References
Impacted products
Credits
Wordfence PRISM
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104745",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T14:50:43.348176Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T15:09:41.042Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Customer Email Verification for WooCommerce",
          "vendor": "wpcodefactory",
          "versions": [
            {
              "lessThanOrEqual": "3.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0. The vulnerability exists because `alg_wc_ev_generate_user_code()` generates the per-user activation secret using `wp_rand(100)` when the plugin\u0027s \u0027Encoding method\u0027 is set to \u0027hashids\u0027, producing only ~101 possible values (~7 bits of entropy); the resulting token is a reversible Hashids encoding with no cryptographic MAC, and the unauthenticated `verify()` handler \u2014 hooked to `init` at `PHP_INT_MAX` with no nonce check and no rate limiting \u2014 accepts and acts on the attacker-controlled `?alg_wc_ev_verify_email=` GET parameter directly. This makes it possible for unauthenticated attackers to gain authentication as any unverified WordPress account, including administrator-level accounts, by brute-forcing the trivially small activation code space via a forged verification URL. Exploitation requires that the \u0027Encoding method\u0027 setting be changed to \u0027hashids\u0027 (non-default), that the attacker recover or brute-force the Hashids salt (which defaults to an `md5(time())` value set at first initialization), and that the target account\u0027s email address remain unverified."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T03:38:41.491Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6df7b3ed-a1e3-4df9-828e-95530661e27a?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/alg-wc-ev-functions.php#L331"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L784"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L498"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L1258"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3744623%40emails-verification-for-woocommerce\u0026new=3744623%40emails-verification-for-woocommerce"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-02T12:19:20.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-15T15:31:05.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Customer Email Verification for WooCommerce \u003c= 3.3.0 - Unauthenticated Privilege Escalation to \u0027alg_wc_ev_verify_email\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104745",
    "datePublished": "2026-10-16T03:38:41.491Z",
    "dateReserved": "2026-10-02T12:04:27.373Z",
    "dateUpdated": "2026-10-16T15:09:41.042Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-104725 (GCVE-0-2026-104725)

Vulnerability from cvelistv5 – Published: 2026-10-10 05:30 – Updated: 2026-10-11 16:55
VLAI
Title
Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter
Summary
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9 This is due to a missing ownership and capability check on the `user` parameter within the `process_edit()` function, which allows any authenticated user with the `edit_contacts` capability to reassign a contact record's linked WordPress user ID to any arbitrary account without requiring the `edit_users` or `promote_users` capabilities. This makes it possible for authenticated attackers, with sales_rep-level access and above, to escalate their privileges to administrator by linking a contact to an administrator's WordPress user ID, then creating a note containing the `{auto_login_link}` replacement tag to trigger generation of a valid auto-login permissions-key URL for the administrator-linked contact, and finally visiting that URL to authenticate as the targeted administrator. The auto-login URL is stored in the note content and is readable back by the attacker via the `view_notes` and `add_notes` capabilities that the sales_rep role holds by default.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 16:37 UTC
CWE
  • CWE-269 - Improper Privilege Management
Assigner
Wordfence CNA
References
Impacted products
Credits
Wordfence PRISM
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104725",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-11T16:37:53.351548Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-11T16:55:17.817Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Groundhogg \u2014 CRM, Newsletters, and Marketing Automation",
          "vendor": "trainingbusinesspros",
          "versions": [
            {
              "lessThanOrEqual": "4.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Groundhogg \u2014 CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9 This is due to a missing ownership and capability check on the `user` parameter within the `process_edit()` function, which allows any authenticated user with the `edit_contacts` capability to reassign a contact record\u0027s linked WordPress user ID to any arbitrary account without requiring the `edit_users` or `promote_users` capabilities. This makes it possible for authenticated attackers, with sales_rep-level access and above, to escalate their privileges to administrator by linking a contact to an administrator\u0027s WordPress user ID, then creating a note containing the `{auto_login_link}` replacement tag to trigger generation of a valid auto-login permissions-key URL for the administrator-linked contact, and finally visiting that URL to authenticate as the targeted administrator. The auto-login URL is stored in the note content and is readable back by the attacker via the `view_notes` and `add_notes` capabilities that the sales_rep role holds by default."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-10T05:30:59.219Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/715b4d10-b19a-4b37-8a76-985c37975c93?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9/admin/contacts/contacts-page.php#L565"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9/admin/contacts/contacts-page.php#L507"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9/includes/classes/note.php#L58"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9/includes/replacements.php#L1811"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9/includes/rewrites.php#L471"
        },
        {
          "url": "https://github.com/groundhoggwp/groundhogg/commit/804abf42a"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3724910%40groundhogg%2Ftags%2F4.9.1\u0026old=3724058%40groundhogg%2Ftags%2F4.9"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-02T12:00:46.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-09T17:12:54.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Groundhogg \u003c= 4.9 - Authenticated (Custom+) Privilege Escalation to \u0027user\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104725",
    "datePublished": "2026-10-10T05:30:59.219Z",
    "dateReserved": "2026-10-02T11:45:33.727Z",
    "dateUpdated": "2026-10-11T16:55:17.817Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-104412 (GCVE-0-2026-104412)

Vulnerability from cvelistv5 – Published: 2026-10-02 11:37 – Updated: 2026-10-06 02:34
VLAI
Title
Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment
Summary
Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to other staff despite lacking permission to do so. An authenticated Editor or Super Editor can promote Author and Contributor users to Editor or Super Editor.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 02:34 UTC
CWE
  • CWE-269 - Improper Privilege Management
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
TryGhost Ghost Affected: 0.5.0 , < 6.64.0 (semver)
Unaffected: 6.64.0 (semver)
    cpe:2.3:a:ghost:ghost:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-09-17 00:00
Credits
Santoshkumarpuppala nhattanhh
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104412",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T02:34:11.956387Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T02:34:23.786Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/ghost",
          "product": "Ghost",
          "vendor": "TryGhost",
          "versions": [
            {
              "lessThan": "6.64.0",
              "status": "affected",
              "version": "0.5.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.64.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ghost:ghost:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.64.0",
                  "versionStartIncluding": "0.5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Santoshkumarpuppala"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "nhattanhh"
        }
      ],
      "datePublic": "2026-09-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to other staff despite lacking permission to do so. An authenticated Editor or Super Editor can promote Author and Contributor users to Editor or Super Editor."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T11:37:56.456Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-4pvx-fwjj-8gpc)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/TryGhost/Ghost/security/advisories/GHSA-4pvx-fwjj-8gpc"
        },
        {
          "name": "VulnCheck Advisory: Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/ghost-0.5.0-before-6.64.0-privilege-escalation-via-staff-role-assignment"
        }
      ],
      "title": "Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-104412",
    "datePublished": "2026-10-02T11:37:56.456Z",
    "dateReserved": "2026-10-02T00:44:44.528Z",
    "dateUpdated": "2026-10-06T02:34:23.786Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
Mitigation MIT-1
Architecture and Design Operation

Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

Mitigation MIT-48
Architecture and Design

Strategy: Separation of Privilege

Follow the principle of least privilege when assigning access rights to entities in a software system.

Mitigation MIT-49
Architecture and Design

Strategy: Separation of Privilege

Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

CAPEC-122: Privilege Abuse

An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.

CAPEC-233: Privilege Escalation

An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.

CAPEC-58: Restful Privilege Elevation

An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.

← Back to the CWE list