CVE-2026-13250

Solace Extra <= 1.5.3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion via delete_previously_imported AJAX Action

The Solace Extra plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete all content previously imported via the Starter Template feature, including posts, pages, media attachments, WooCommerce products, taxonomy terms, and sitebuilder templates. The required nonce is emitted on every wp-admin page via wp_localize_script() hooked to admin_enqueue_scripts without a page guard, meaning any Subscriber visiting /wp-admin/profile.php can obtain it; the handler is additionally registered via wp_ajax_nopriv_, making it reachable by fully unauthenticated users as well.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Solacewp Wordpress

Products

Solace Extra Wordpress

CVE-2026-57392

WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through <= 2.22.5.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Themefic Wordpress

Products

Tourfic Wordpress

CVE-2026-57405

WordPress Open Shop theme <= 1.7.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in themehunk Open Shop open-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Open Shop: from n/a through <= 1.7.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Themehunk Wordpress

Products

Open Shop Wordpress

CVE-2026-15541

will-moss Isaiah Master Websocket server.go Server.Handle authorization

A flaw has been found in will-moss Isaiah up to 1.36.9. The impacted element is the function Server.Handle of the file app/server/server/server.go of the component Master Websocket Handler. Executing a manipulation of the argument Agent can lead to missing authorization. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Will-moss

Products

Isaiah

CVE-2026-57378

WordPress Advanced Forms plugin <= 1.9.3.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in Phil Kurth Advanced Forms advanced-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Forms: from n/a through <= 1.9.3.7.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Phil Kurth Wordpress

Products

Advanced Forms Wordpress

CVE-2026-57406

WordPress FundEngine plugin <= 1.7.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Roxnor FundEngine wp-fundraising-donation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FundEngine: from n/a through <= 1.7.6.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Roxnor Wordpress

Products

Fundengine Wordpress

CVE-2026-57424

WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in knitpay Razorpay Payment Links for WooCommerce rzp-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Razorpay Payment Links for WooCommerce: from n/a through <= 2.1.4.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Knitpay Wordpress

Products

Razorpay Payment Links For Woocommerce Wordpress

CVE-2026-57774

WordPress VW Food Corner theme <= 1.1.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in vowelweb VW Food Corner vw-food-corner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Food Corner: from n/a through <= 1.1.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Vowelweb Wordpress

Products

Vw Food Corner Wordpress

CVE-2026-57776

WordPress VW Wedding theme <= 1.3.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in vowelweb VW Wedding vw-wedding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Wedding: from n/a through <= 1.3.7.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Vowelweb Wordpress

Products

Vw Wedding Wordpress

CVE-2026-57779

WordPress Fascinate theme <= 1.1.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in themebeez Fascinate fascinate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fascinate: from n/a through <= 1.1.5.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Themebeez Wordpress

Products

Fascinate Wordpress

CVE-2026-57781

WordPress MeetingHub plugin <= 1.25.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in Sovlix MeetingHub meetinghub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MeetingHub: from n/a through <= 1.25.10.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sovlix Wordpress

Products

Meetinghub Wordpress

CVE-2026-57782

WordPress Universal Clocks plugin <= 1.2.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in PressTigers Universal Clocks universal-clocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Universal Clocks: from n/a through <= 1.2.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Presstigers Wordpress

Products

Universal Clocks Wordpress

CVE-2026-61952

WordPress WooCommerce Bulk Edit Products – WP Sheet Editor plugin <= 1.8.21 - Broken Access Control vulnerability

Missing Authorization vulnerability in Jose Vega WooCommerce Bulk Edit Products – WP Sheet Editor woo-bulk-edit-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Bulk Edit Products – WP Sheet Editor: from n/a through <= 1.8.21.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Jose Vega Wordpress

Products

Woocommerce Bulk Edit Products – Wp Sheet Editor Wordpress

CVE-2026-61985

WordPress Car Rental Manager plugin <= 1.3.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through <= 1.3.7.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Magepeopleteam Wordpress

Products

Car Rental Manager Wordpress

CVE-2026-14934

Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise

A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escalate privileges and perform cross-tenant repository takeover. This vulnerability was patched on 10 May 2026, and no customer action is needed.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Google Google Cloud

Products

Cloud Platform Bigquery Colab Enterprise

CVE-2026-9824

Remote cluster metadata enumeration via /share-channel autocomplete

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to check the manage_shared_channels permission in the /share-channel autocomplete handler, which allows an authenticated user without that permission to enumerate configured remote cluster connection metadata via slash command autocomplete.. Mattermost Advisory ID: MMSA-2026-00676

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost Mattermost Server

CVE-2026-12103

Wallet for WooCommerce <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) User/Email Enumeration via terawallet_export_user_search AJAX Action

The Wallet for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate the login name, email address, and user ID of all WordPress accounts — including administrators — by submitting arbitrary search terms to the AJAX handler. The required 'search-user' nonce is localized into the wallet_param object on the standard WooCommerce My Account page, which is accessible to any authenticated user, making it trivially obtainable by a Subscriber.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Subratamal Wordpress

Products

Wallet For Woocommerce Wordpress

CVE-2026-61968

WordPress myCred plugin <= 3.1.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through <= 3.1.2.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-61983

WordPress Church Admin plugin <= 5.0.30 - Broken Access Control vulnerability

Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through <= 5.0.30.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Andymoyle Wordpress

Products

Church Admin Wordpress

CVE-2026-57797

WordPress EduMall theme <= 4.5.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThemeMove EduMall edumall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EduMall: from n/a through <= 4.5.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Thememove Wordpress

Products

Edumall Wordpress