CWE-862

8,211 vulnerabilities with CWE-862

CVE-2026-24364 MEDIUM

WordPress WP User Frontend plugin <= 4.2.5 - Broken Access Control vulnerability

CVSS 6.5

CVE-2026-24363 HIGH

WordPress WP Cost Estimation & Payment Forms Builder plugin < 10.3.0 - Broken Access Control vulnerability

CVSS 7.5

CVE-2026-24362 MEDIUM

WordPress Ultimate Post Kit plugin <= 4.0.21 - Broken Access Control vulnerability

CVSS 6.4

CVE-2026-23977 HIGH

WordPress Helpdesk Support Ticket System for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerability

CVSS 7.5

CVE-2026-23972 MEDIUM

WordPress Booking and Rental Manager plugin <= 2.6.0 - Broken Access Control vulnerability

CVSS 6.5

CVE-2026-23806 HIGH

WordPress Jobs for WordPress plugin <= 2.8 - Broken Access Control vulnerability

CVSS 7.5

CVE-2026-22485 MEDIUM

WordPress My Album Gallery plugin <= 1.0.4 - Arbitrary File Deletion vulnerability

CVSS 6.5

CVE-2026-33353 MEDIUM

Soft Serve: Authenticated repo import can clone server-local private repositories

CVSS 6.5

CVE-2026-33768 MEDIUM

Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`

CVSS 6.5

CVE-2026-33162 MEDIUM

Craft CMS 5.3.0-5.9.13 - Entry Section Move Authorization Bypass

CVSS 6.5

CVE-2026-33161 MEDIUM

Craft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users

CVSS 4.3

CVE-2026-33160 MEDIUM

Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL

CVSS 5.3

CVE-2026-33159 MEDIUM

Craft CMS 4.x and 5.x - Unauthenticated Config Sync Operations

CVSS 6.5

CVE-2026-33316 HIGH

Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement

CVSS 8.1

CVE-2026-33484 HIGH

Langflow has Unauthenticated IDOR on Image Downloads

CVSS 7.5

CVE-2026-4283 CRITICAL

WP DSGVO Tools (GDPR) <= 3.1.38 - Missing Authorization to Unauthenticated Account Destruction of Non-Admin Users

CVSS 9.1

CVE-2026-3138 MEDIUM

Product Filter for WooCommerce by WBW <= 3.1.2 - Missing Authorization to Unauthenticated Filter Data Deletion via TRUNCATE TABLE

CVSS 6.5

CVE-2026-33290 MEDIUM

WPGraphQL < 2.10.0 - Comment Moderation Authorization Bypass

CVSS 4.3

CVE-2026-4056 MEDIUM

WordPress User Registration & Membership 5.0.1-5.1.4 - Auth Bypass

CVSS 5.4

CVE-2026-4066 MEDIUM

Smart Custom Fields WordPress Plugin <=5.0.6 - Info Disclosure

CVSS 4.3

CVE-2026-3225 MEDIUM

LearnPress WordPress Plugin <=4.3.2.8 - Auth Bypass

CVSS 4.3

CVE-2026-33685 MEDIUM

AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data

CVSS 5.3

CVE-2026-33501 MEDIUM

AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin

CVSS 5.3

CVE-2026-4590 LOW

kalcaddle kodbox loginSubmit API index.class.php cross-site request forgery

CVSS 3.1

CVE-2026-4261 HIGH

Expire Users <= 1.2.2 - Authenticated (Subscriber+) Privilege Escalation to Administrator via save_extra_user_profile_fields

CVSS 8.8