CVE-2026-110955

Wurdey <= 1.0.0 - Unauthenticated Administrator Authentication Bypass

The Wurdey WordPress plugin through 1.0.0 does not verify a request signature before logging a user in, allowing unauthenticated attackers to authenticate as an administrator knowing only the administrator's username.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Wurdey

CVE-2026-87784

Cool Media Filter <= 1.0.1 - Subscriber+ Privilege Escalation via role_permission

The Cool Media Filter WordPress plugin through 1.0.1 does not perform any capability or nonce check when updating the capabilities of a role, allowing any authenticated user, such as a subscriber, to grant their own role administrator capabilities and take over the site.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Cool Media Filter

CVE-2026-118239

AutomatorWP < 6.0.7 - Unauthenticated Zoom/AWeber Integration Connection Hijack via OAuth Callback

The AutomatorWP WordPress plugin before 6.0.7 does not check that the user completing its Zoom and AWeber integration connections is allowed to do so, allowing unauthenticated attackers to replace the stored integration credentials with their own and divert the data the site sends to those services into an account they control. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Automatorwp

CVE-2026-97191

Advanced Custom Fields < 6.8.11 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path

The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to administrators onto their own posts.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Advanced Custom Fields

CVE-2026-121380

Tournamatch < 4.7.1 - Unauthenticated Team Invitation Email Disclosure via REST API

The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Tournamatch

CVE-2026-123656

ProfilePress < 4.17.6 - Unauthenticated Restricted Content Disclosure via REST API

The ProfilePress WordPress plugin before 4.17.6 does not correctly evaluate some of its content protection rule conditions when content is rendered outside the main query, allowing unauthenticated users to read the content of pages protected by such rules via the REST API.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Profilepress

CVE-2026-124817

Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification

The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating leave requests, allowing unauthenticated users to modify any leave record, including approving or rejecting requests and reassigning them to other users.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Clockinator Lite

CVE-2026-110003

Azul Payara Administration REST Interface Authentication Bypass via X-GlassFish-authToken Header Leading to Remote Code Execution

A vulnerability in the administration REST interface of Azul Payara allows a remote, unauthenticated attacker to bypass secure-admin remote-access restrictions by supplying an arbitrary value in the X-GlassFish-authToken HTTP header. The header's presence waives the remote-rejection check before the token is validated, and an invalid token falls through to password-based authentication, which succeeds without credentials on default domains configured with an empty administrative password. Successful exploitation grants execution of arbitrary administrative commands, equivalent to complete compromise of the server.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Payara

Products

Payara Server

CVE-2026-110948

Download Manager (Free & Pro) - Unauthenticated Protected File Download via Media Preview Download Key

The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify that a visitor is allowed to access a package before its media-preview renderers issue a download key for it, allowing unauthenticated visitors to download password-locked and role-restricted files by reading the key from a public page.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-109873

User Registration & Membership < 5.3.2 - Unauthenticated Payment Before Login Bypass via Omitted Membership Field

The User Registration & Membership WordPress plugin before 5.3.2 does not enforce its payment-before-login restriction when a registration is submitted without a membership selection, allowing unauthenticated users to create an account on a payment-gated registration form and log in without completing payment.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-110949

Download Manager (Free & Pro) - Unauthenticated Missing Authorization via Password Validation

The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify a package's configured role restriction when validating a package password, allowing an unauthenticated user who knows the password of a role-restricted package to obtain a download key and download the protected file.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-117523

Dynific Addons for Elementor < 1.3.1 - Subscriber+ Module Settings Update via aep_module AJAX Action

The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a capability or nonce check on an AJAX action that saves its module configuration, allowing any authenticated user, including Subscribers, to enable or disable the Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1's modules site-wide.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Dynific Addons For Elementor

CVE-2026-115733

PrintAura WooCommerce API <= 4.0.2 - Unauthenticated WooCommerce REST API Authentication Bypass

The Printaura-Woocommerce WordPress plugin through 4.0.2 does not properly restrict access to the WooCommerce REST API, causing every WooCommerce REST route to accept unauthenticated requests, which allows unauthenticated attackers to read and modify store data including customer orders and personal information, store and payment settings, and webhooks.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Printaura Woocommerce Api

CVE-2026-109871

User Registration & Membership < 5.3.2 - Subscriber+ Payment Bypass via Membership Renewal

The User Registration & Membership WordPress plugin before 5.3.2 does not verify that a payment has actually been completed before extending a paid membership subscription, allowing authenticated users with an active paid subscription to renew it indefinitely without paying.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-121873

Redirection for Contact Form 7 2.6.0 - 3.2.15 - Unauthenticated Forged Personal Data Request Creation

The Redirection for Contact Form 7 WordPress plugin before 3.2.16 does not verify ownership of the email address supplied through its data request form action and by default records the resulting request as already confirmed, allowing unauthenticated visitors to create verified WordPress personal data erasure or export requests for addresses they do not control.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-123872

Node.js is vulnerable to a client certificate authentication bypass via TLS 1.2 renegotiation servername change

A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-certificate policies per hostname, for example stricter admin-only client-cert auth on one host and ordinary client-cert auth on another, a client that authenticates for a permitted host can renegotiate the TLS 1.2 connection under a different servername and carry its existing authentication to the protected host, bypassing the stricter policy. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Nodejs

Products

Nodejs

CVE-2026-117550

Joomla Extension - jdownloads.com - Publishing of files without approval in jDownloads < 4.1.8

Joomla Extension - jdownloads.com - Publishing of files without approval in jDownloads < 4.1.8 - Manipulated frontend submission parameters could bypass the intended publication and ownership rules. In particular, submissions could be published despite automatic publication being disabled, and ownership could be assigned contrary to the intended policy.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-121690

CVE-2026-121690

FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) executes code with unnecessary privileges. All processes run as root and the system lacks privilege separation. The compromise of any single service results in full administrative control of the device.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Frodobots

Products

Frodobots Earthrover Mini+ Firmware

CVE-2026-121689

CVE-2026-121689

FrodoBots EarthRover Mini+ firmware (v6.2.4_6.2.5_0.614.0) exposes sensitive credentials through multiple insecure mechanisms. The Wi‑Fi PSK is stored in plaintext in wpa_supplicant.conf and is disclosed through unauthenticated API endpoints and diagnostic exports. Additionally, unauthenticated ADB access allows retrieval of the /etc/shadow file.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Frodobots

Products

Frodobots Earthrover Mini+ Firmware

CVE-2026-121687

CVE-2026-121687

FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains several local interfaces that are exposed without authentication. 1. HTTP REST API (port 80): motor control, telemetry/GPS/IMEI, plaintext WiFi password (GET /api/v1/wifi/status), join-arbitrary-WiFi, diagnostic export. 2. ADB (Android Debug Bridge, port 5555) access to root shell 3. SSH (port 22)

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Frodobots

Products

Frodobots Earthrover Mini+ Firmware