The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
8,261 vulnerabilities with CWE-862
CVE-2025-68045
HIGH
WordPress WP Event SOlution plugin <= 4.1.12 - Broken Access Control vulnerability
CVSS 7.5
CVE-2025-69332
MEDIUM
WordPress Bookify plugin <= 1.1.1 - Broken Access Control vulnerability
CVSS 6.5
CVE-2025-68049
MEDIUM
WordPress bunny.net plugin <= 2.3.6 - Broken Access Control vulnerability
CVSS 6.3
CVE-2025-64215
MEDIUM
WordPress MasterStudy LMS Pro plugin < 4.7.16 - Broken Access Control vulnerability
CVSS 6.5
CVE-2025-53346
MEDIUM
WordPress Thim Core Plugin <= 2.3.3 - Broken Access Control Vulnerability
CVSS 4.3
CVE-2025-53345
HIGH
WordPress Thim Core plugin <= 2.3.3 - Arbitrary Plugin Installation vulnerability
CVSS 8.8
CVE-2025-53302
MEDIUM
WordPress Constructor theme <= 1.6.5 - Broken Access Control Vulnerability
CVSS 5.3
CVE-2025-52766
MEDIUM
WordPress Printeers Print & Ship plugin <= 1.17.0 - Broken Access Control vulnerability
CVSS 6.5
CVE-2025-26418
HIGH
CarDevicePolicyService - Local Privilege Escalation via Missing Permission Check
CVSS 7.8
CVE-2025-12714
MEDIUM
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.271 - Missing Authorization to Unauthenticated Homepage Settings Modification
CVSS 5.3
CVE-2025-14481
MEDIUM
Yoast SEO <= 26.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'post_id' Parameter
CVSS 4.3
CVE-2025-14361
HIGH
WordPress Woocommerce Envato Affiliates plugin <= 1.2.1 - Settings Change vulnerability
CVSS 7.1
CVE-2025-15369
MEDIUM
Xpro Addons — 140+ Widgets for Elementor <= 1.5.0 - Missing Authorization to Unauthenticated Xpro Template Creation
CVSS 5.3
CVE-2025-4202
MEDIUM
Multicollab: Content Team Collaboration and Editorial Workflow <= 5.2 - Missing Authorization to Authenticated (Subscriber+) Collaboration Comment
CVSS 4.3
CVE-2025-14755
MEDIUM
Cost Calculator Builder <= 4.0.1 - Unauthenticated Price Manipulation and Insecure Direct Object Reference
CVSS 5.3
CVE-2025-15634
MEDIUM
HCL BigFix WebUI is affected by a missing authorization vulnerability
CVSS 4.3
CVE-2025-66105
MEDIUM
WordPress Bus Ticket Booking with Seat Reservation plugin < 5.6.8 - Broken Access Control vulnerability
CVSS 5.3
CVE-2025-11762
MEDIUM
HubSpot All-In-One Marketing - Forms, Popups, Live Chat <= 11.3.32 - Missing Authorization to Authenticated (Contributor+) Installed Plugin Disclosure
CVSS 4.3
CVE-2025-62104
MEDIUM
WordPress ACF Galerie 4 plugin <= 1.4.2 - Broken Access Control vulnerability
CVSS 4.3
CVE-2025-15565
MEDIUM
Nexi XPay <= 8.3.0 - Missing Authorization to Unauthenticated Order Status Modification
CVSS 5.3
CVE-2025-9484
MEDIUM
Missing Authorization in GitLab
CVSS 4.3
CVE-2025-14944
MEDIUM
Backup Migration <= 2.0.0 - Missing Authorization to Unauthenticated Backup Upload to Offline Storage
CVSS 5.3
CVE-2025-15445
MEDIUM
Restaurant Cafeteria <= 0.4.6 - Subscriber+ Arbitrary Plugin Installation/Activation
CVSS 5.4
CVE-2025-69358
HIGH
WordPress EventPrime plugin <= 4.2.6.0 - Broken Access Control vulnerability
CVSS 7.5
CVE-2025-14595
MEDIUM
Missing Authorization in GitLab
CVSS 4.3
Details
Vulnerabilities
8,261
Exploit Likelihood
High