CVE-2026-82305

YITH WooCommerce Wishlist < 4.18.1 - Unauthenticated Arbitrary Wishlist Rename via change_wishlist_title

The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Yith Woocommerce Wishlist

CVE-2026-86782

Visualizer < 4.0.6 - Contributor+ Arbitrary Post/Page Modification via IDOR

The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Visualizer

CVE-2026-82213

Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDOR

The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Nexi Xpay Build

CVE-2026-77705

Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the password and email address of other users' WordPress accounts and take them over.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Amelia

CVE-2026-82851

Masteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDOR

The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft courses.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Masteriyo Lms

CVE-2026-84025

BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Authenticated Product Download URL and Meta Disclosure via IDOR

The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and private product metadata.

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Bear

CVE-2026-87894

Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDOR

The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email, phone, booking details and payment status by enumerating that identifier.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Rox Appointment Booking

CVE-2026-88912

rtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Subscriber+ Arbitrary Activity Privacy Modification via IDOR

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to make another user's private activity public or hide it.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Rtmedia

CVE-2026-88910

KBoard < 6.7 - Unauthenticated Board Media Deletion via IDOR

The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently delete its uploaded media files and their database records by iterating identifiers.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Kboard

CVE-2026-126061

Winter CMS: My Account preview exposes another backend user's profile by record ID

Winter CMS is a content management system built on the Laravel PHP framework. From 1.2.13 until 1.2.14, the Backend\Controllers\MyAccount controller inherits the FormController actions create, update, and preview while declaring an empty $requiredPermissions array, and formFindModelObject() resolves a caller-supplied record identifier through an unscoped Backend\Models\User query. Any authenticated backend user can request another sequential user identifier through /backend/backend/myaccount/preview/{other_user_id} or the inherited update action and read profile data including name, login, email, avatar, role, group membership, superuser status, and throttle state. Password material is not exposed, and existing model authorization guards block cross-user writes. This issue is fixed in version 1.2.14.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wintercms

Products

Winter

CVE-2026-126496

1Panel-dev CordysCRM before 1.9.6 Authorization Bypass via /account/contact/get/{id}

1Panel-dev CordysCRM before 1.9.6 contains an authorization bypass vulnerability in CustomerContactController.get that allows authenticated users to read other users' contacts because no organization, owner or data-scope check is applied. Attackers holding ordinary contact or customer read permission can request GET /account/contact/get/{id} with another contact's ID to obtain names, phone numbers, owners, departments, linked customers and custom fields.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

1panel 1panel-dev

Products

Cordyscrm Cordyscrm

CVE-2026-126275

NocoDB before 2026.09.0 IDOR in Row Comment Operations

NocoDB before 2026.09.0 contains an insecure direct object reference vulnerability that allows authenticated users to read cross-base row comments by supplying only model and row ids. Attackers with a Viewer or Creator role on an unrelated base can read private comments and author emails, or plant decoy tables and duplicate comment ids to spoof teammates' comments.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-127076

OpsTree BuildPiper before 2.7.0 Broken Access Control via git_repo API

OpsTree BuildPiper before 2.7.0 contains a broken access control vulnerability that allows authenticated users to list and build from Git repositories restricted to other projects. Attackers can enumerate repositories via GET /api/v1/git_repo/?all=true and submit any git_repo_id to the ci endpoint, cloning other projects' source code, manifests, and committed secrets.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-127078

OpsTree BuildPiper before 2.7.0 Authorization Bypass via project_env_id Parameter

OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to attach another application's environment to their service by supplying a foreign project_env_id. Attackers can configure CI and trigger builds and deployments through the component env endpoints using the other application's configuration, registries and deployment infrastructure.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-127081

OpsTree BuildPiper before 2.7.0 Authorization Bypass via Pipeline Stage project_env_id

OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to link pipeline stages to environments of other projects by supplying a foreign project_env_id. Attackers can submit another project's environment identifier to the POST /api/v1/pipeline/{pipeline_id}/stages/ endpoint, persisting cross-project associations that bypass project separation.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128045

OpenMage Magento-LTS before 20.18.2 Authorization Bypass via Forgeable RSS Order Key

OpenMage Magento-LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an authorization bypass in the /rss/order/status feed because its URL key is unsigned Base64-encoded JSON of the order, increment, and customer ids. Unauthenticated attackers can forge keys from enumerated sequential ids to read other customers' names, items, prices, totals, and status comments when order-status RSS is enabled.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-76078

Probo: Broken access control in public e-signature API

Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, the public Trust Center GraphQL API exposes acceptElectronicSignature and recordSigningEvent, both gated only by @authentication(required: PRESENT) @sessionOnly — any self-provisioned trust center identity can call them. The underlying esign.Service.AcceptSignature and esign.Service.recordEvent build the tenant scope from the client-supplied signatureId GID (coredata.NewScopeFromObjectID(req.SignatureID)) and load the signature by that GID. At no point do they verify that the signature belongs to the caller or that the caller's email matches the signature's SignerEmail. As a result, any authenticated trust-center visitor who possesses another visitor's signature GID can: (1) complete that visitor's NDA signature — overwriting signer name/IP/UA with attacker data and setting status to Accepted, which triggers the sealing worker to generate a completion certificate; (2) inject arbitrary audit-trail events into any signature's log. Both attacks defeat the non-repudiation and integrity guarantees of the e-signature system. This issue has been patched in version 0.224.0.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Getprobo

Products

Probo

CVE-2026-76080

Probo: Unauthenticated cross-tenant and hidden-item disclosure via Query.node in the public Trust Center API

Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, the public Trust Center GraphQL API exposes Query.node(id:) with @authentication(required: OPTIONAL) — an unauthenticated internet visitor to any published trust center can call it. Six of its type branches — Organization, Framework, Audit, ThirdParty (subprocessor), TrustCenter, and TrustCenterReference — resolve the object with a tenant scope derived from the client-supplied GID itself (coredata.NewScopeFromObjectID(id)) and load it with a bare Get(scope, id) that performs no comparison to the current trust center's OrganizationID and no showOnTrustCenter/visibility check. (The Document and File branches, by contrast, correctly pass trustCenter.OrganizationID and check visibility). This issue has been patched in version 0.224.0.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Getprobo

Products

Probo

CVE-2026-67540

Heym - Horizontal IDOR: get-by-id on workflow/node templates skips the visibility check the list path enforces

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, get_workflow_template / get_node_template fetches a template by ID with no visibility / author / shared_with predicate, so any authenticated user can read (and use) any other tenant's private (visibility=specific_users) template — including its full node/edge graph and the email addresses it was shared with. The list endpoint enforces visibility correctly; the single-item get/use paths do not. This issue has been patched in version 0.0.70.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Heymrun

Products

Heym

CVE-2026-70642

ToolJet < 3.21.94 Authorization Bypass via app-environments/init

ToolJet before 3.21.94, fixed in commit e5f387a, contains an authorization bypass vulnerability in the app environments init endpoint that allows authenticated users to read app version metadata belonging to other workspaces. Attackers can send GET requests to /api/app-environments/init with an editing_version_id from another workspace to retrieve the version name, description, status, current environment ID, and app ID, because the lookup is not scoped to the caller's organization.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tooljet

Products

Tooljet