CVE-2026-121492

Fiber Admin < 4.0.1 - Unauthenticated Arbitrary Post and Term Order Modification via fiad_cpo_update and fiad_cpo_tax_update

The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the order of arbitrary posts, including drafts, private posts and navigation menu items, as well as the order of taxonomy terms when term ordering is enabled.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Fiber Admin

CVE-2026-121778

WordPress WP-Lister Lite for Amazon plugin <= 2.9.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Lab WP-Lister Lite for Amazon wp-lister-for-amazon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Lister Lite for Amazon: from n/a through 2.9.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wp Lab

Products

Wp-lister Lite For Amazon Wp Lister Lite For Amazon

CVE-2026-121767

WordPress weDocs plugin <= 2.6.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs: from n/a through 2.6.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wedevs Wordpress-extensions

Products

Wedocs Wedocs

CVE-2026-124274

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mycred Wordpress-extensions

Products

Mycred Mycred

CVE-2026-120849

WordPress WCFM Marketplace plugin <= 3.8.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Marketplace: from n/a through 3.8.3.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wclovers Wordpress-extensions

Products

Wcfm Marketplace Wcfm Marketplace

CVE-2026-119467

WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor: from n/a through 1.3.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpvibes

Products

Anywhere Elementor Anywhere Elementor

CVE-2026-61990

WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wclovers Wordpress-extensions

Products

Wcfm Membership Wcfm Membership

CVE-2026-123657

ProfilePress < 4.17.6 - Unauthenticated Inactive Membership Plan Enrollment via Negative Plan ID

The ProfilePress WordPress plugin before 4.17.6 does not reject negative membership plan identifiers before checking whether a plan is active, allowing unauthenticated visitors to sign up for membership plans an administrator has deactivated and receive the role attached to them.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Profilepress

CVE-2026-123661

ProfilePress 4.16.13 - 4.17.3 - Subscriber+ Inactive Membership Plan Subscription via Plan-Change Checkout

The ProfilePress WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is used to change an existing subscription, allowing subscribers holding any subscription of their own to subscribe to plans the site owner has deactivated, including free plans that grant a user role.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Profilepress

CVE-2026-123696

Security For WooCommerce <= 1.0.16 - Unauthenticated Two-Factor Authentication Reset

The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before resetting two-factor authentication enrolment, allowing unauthenticated users to remove the second factor from any account, or from every account at once.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Security For Woocommerce

CVE-2026-123697

Security For WooCommerce <= 1.0.16 - Unauthenticated Two-Factor Code and Secret Disclosure

The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current two-factor code or two-factor secret, allowing unauthenticated users to obtain them for any account and bypass the second factor on sites where its one-time password library is available.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Security For Woocommerce

CVE-2026-123698

Security For WooCommerce <= 1.0.16 - Unauthenticated Plugin Settings Disclosure via REST API

The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve its full settings, including configured secret keys and the hidden login URL.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Security For Woocommerce

CVE-2026-123699

Security For WooCommerce <= 1.0.16 - Unauthenticated Forced Plugin, Theme and Core Updates

The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running bulk Security For WooCommerce WordPress plugin through 1.0.16, and WordPress core updates, allowing unauthenticated users to force every pending update to be installed on the site.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Security For Woocommerce

CVE-2026-123700

Security For WooCommerce <= 1.0.16 - Unauthenticated Mass Comment Deletion

The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running several of its comment cleanup actions, allowing unauthenticated users to permanently delete all comments on the site, including approved ones and WooCommerce order notes.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Security For Woocommerce

CVE-2026-123701

Security For WooCommerce <= 1.0.16 - Unauthenticated Plugin Settings Reset

The Security For WooCommerce WordPress plugin through 1.0.16 does not have proper authorization checks when resetting its settings, allowing unauthenticated users to reset any section of its configuration to the defaults and so disable security features such as a custom login URL, two-factor authentication, reCAPTCHA, password policies and the firewall.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Security For Woocommerce

CVE-2026-123702

Security For WooCommerce <= 1.0.16 - Unauthenticated wp-config Keys and Salts Reset and Denial of Service

The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before regenerating the secret keys and salts in the site's configuration file, allowing unauthenticated users to log out every user and, on servers that cannot reach the WordPress.org API, corrupt the configuration file and take the whole site offline.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Security For Woocommerce

CVE-2026-123703

Security For WooCommerce <= 1.0.16 - Unauthenticated Arbitrary User Logout via usfw_user_force_logout

The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before ending a user's login sessions, allowing unauthenticated visitors to log out any user, including administrators, and to keep them logged out by repeating the request.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Security For Woocommerce

CVE-2026-124421

WordPress ZoloBlocks plugin <= 2.8.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in BdThemes ZoloBlocks zoloblocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ZoloBlocks: from n/a through 2.8.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bdthemes Wordpress-extensions

Products

Zoloblocks Zoloblocks

CVE-2026-124261

WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.7.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Magepeople Inc. Wordpress-extensions

Products

Taxi Booking Manager For Woocommerce Taxi Booking Manager For Woocommerce

CVE-2026-124753

WordPress WP Job Portal plugin <= 2.7.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ahmad Wordpress-extensions

Products

Wp Job Portal Wp Job Portal