CWE-862 · Missing Authorization (page 24)
Page 24 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-15260 | Medium | 6.5 | 2026-02-04 | The MyRewards – Loyalty Points and Rewards for WooCommerce plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 5… |
CVE-2025-14461 | Medium | 5.3 | 2026-02-04 | The Xendit Payment plugin for WordPress is vulnerable to unauthorized order status manipulation in all versions up to, and including, 6.0.2. This is due to the… |
CVE-2026-1835 | Medium | 4.3 | 2026-02-04 | A vulnerability was identified in lcg0124 BootDo up to e93dd428ef6f5c881aa74d49a2099ab0cf1e0fcb. This affects an unknown part. The manipulation leads to cross-… |
CVE-2026-25036 | Medium | 6.5 | 2026-02-03 | Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2026-25028 | Medium | 5.4 | 2026-02-03 | Missing Authorization vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Exploiting Incorrectly Co… |
CVE-2026-25021 | Medium | 5.4 | 2026-02-03 | Missing Authorization vulnerability in Mizan Themes Mizan Demo Importer mizan-demo-importer allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-25020 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in WP connect WP Sync for Notion wp-sync-for-notion allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2026-25019 | Medium | 5.3 | 2026-02-03 | Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-25016 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in Nelio Software Nelio Popups nelio-popups allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2026-25012 | Medium | 5.3 | 2026-02-03 | Missing Authorization vulnerability in gfazioli WP Bannerize Pro wp-bannerize-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-25011 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in Northern Beaches Websites WP Custom Admin Interface wp-custom-admin-interface allows Exploiting Incorrectly Configured A… |
CVE-2026-25010 | Medium | 5.3 | 2026-02-03 | Missing Authorization vulnerability in ILLID Share This Image share-this-image allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-24997 | Medium | 5.3 | 2026-02-03 | Missing Authorization vulnerability in Wired Impact Wired Impact Volunteer Management wired-impact-volunteer-management allows Exploiting Incorrectly Configure… |
CVE-2026-24996 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in wpelemento WPElemento Importer wpelemento-importer allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-24995 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in Iulia Cazan Latest Post Shortcode latest-post-shortcode allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-24994 | Medium | 5.3 | 2026-02-03 | Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2026-24990 | Medium | 5.4 | 2026-02-03 | Missing Authorization vulnerability in Fahad Mahmood WP Docs wp-docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-24985 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in approveme WP Forms Signature Contract Add-On wp-forms-signature-contract-add-on allows Exploiting Incorrectly Configured… |
CVE-2026-24984 | Medium | 6.5 | 2026-02-03 | Missing Authorization vulnerability in Brecht Visual Link Preview visual-link-preview allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2026-24982 | Medium | 5.3 | 2026-02-03 | Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-24967 | Medium | 5.3 | 2026-02-03 | Missing Authorization vulnerability in ameliabooking Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2026-24965 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Exploiting Incorrectly Configured Acc… |
CVE-2026-24957 | Medium | 6.5 | 2026-02-03 | Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2026-24951 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCr… |
CVE-2026-24947 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Contr… |
CVE-2026-24945 | Medium | 5.3 | 2026-02-03 | Missing Authorization vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addons-for-contact-form-7 allows Exploiting Incorrectly Configured… |
CVE-2026-24940 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in Themefic Travelfic Toolkit travelfic-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2026-24939 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-1751 | Low | 3.1 | 2026-02-02 | A vulnerability has been discovered in GitLab CE/EE affecting all versions starting with 16.8 before 18.5.0 that could have allowed unauthorized edits to merge… |
CVE-2026-1745 | Medium | 4.3 | 2026-02-02 | A vulnerability was determined in SourceCodester Medical Certificate Generator App 1.0. This affects an unknown part. This manipulation causes cross-site reque… |
CVE-2025-13348 | | 2026-02-02 | An improper access control vulnerability exists in ASUS Secure Delete Driver of ASUS Business Manager. This vulnerability can be triggered by a local user send… | |
CVE-2026-1734 | Medium | 5.3 | 2026-02-02 | A security flaw has been discovered in Zhong Bang CRMEB up to 5.6.3. This vulnerability affects unknown code of the file crmeb/app/api/controller/v1/CrontabCon… |
CVE-2026-1431 | Medium | 5.3 | 2026-01-31 | The Booking Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wpbc_ajax_WPBC_FLEXTIMELINE_NAV… |
CVE-2025-15510 | Medium | 5.3 | 2026-01-31 | The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the NF5_Export_Forms clas… |
CVE-2026-21865 | Medium | 6.5 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, moderators can convert some personal messages… |
CVE-2025-68479 | High | 7.1 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, some subscription endpoints lack proper checki… |
CVE-2026-1280 | High | 7.5 | 2026-01-28 | The Frontend File Manager Plugin for WordPress is vulnerable to unauthorized file sharing due to a missing capability check on the 'wpfm_send_file_in_email' AJ… |
CVE-2025-15511 | Medium | 5.3 | 2026-01-28 | The Rupantorpay plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_webhook() function in a… |
CVE-2025-14386 | High | 8.8 | 2026-01-28 | The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authentication bypass… |
CVE-2026-1054 | Medium | 5.3 | 2026-01-28 | The RegistrationMagic plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.0.7.4. This is due to missing nonce verif… |
CVE-2026-1310 | Medium | 5.3 | 2026-01-28 | The Simple calendar for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.6.6. This is due to missi… |
CVE-2026-0832 | High | 7.3 | 2026-01-28 | The New User Approve plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on multiple R… |
CVE-2026-0825 | Medium | 5.3 | 2026-01-28 | The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the CS… |
CVE-2026-1298 | Medium | 4.3 | 2026-01-28 | The Easy Replace Image plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.5.2. This is due to missing capabili… |
CVE-2026-24134 | Medium | 6.5 | 2026-01-28 | StudioCMS is a server-side-rendered, Astro native, headless content management system. Versions prior to 0.2.0 contain a Broken Object Level Authorization (BOL… |
CVE-2025-14971 | Medium | 5.3 | 2026-01-27 | The Link Invoice Payment for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the creat… |
CVE-2026-23683 | Medium | 4.3 | 2026-01-27 | SAP Fiori App Intercompany Balance Reconciliation does not perform necessary authorization checks for an authenticated user, resulting in escalation of privile… |
CVE-2026-0593 | Medium | 5.3 | 2026-01-24 | The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the proce… |
CVE-2026-0687 | Medium | 4.3 | 2026-01-24 | The Meta-box GalleryMeta plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mb_gallery' custom p… |
CVE-2025-15516 | Medium | 4.3 | 2026-01-24 | The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_callback_sto… |
CVE-2026-1103 | Medium | 5.4 | 2026-01-24 | The AIKTP plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization checks on the /aiktp/getToken REST API endpoint… |
CVE-2025-14843 | Medium | 5.3 | 2026-01-24 | The Wizit Gateway for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Order Cancellation in all versions up to, and including, 1.3… |
CVE-2025-14629 | Medium | 5.3 | 2026-01-24 | The Alchemist Ajax Upload plugin for WordPress is vulnerable to unauthorized media file deletion due to a missing capability check on the 'delete_file' functio… |
CVE-2025-14609 | Medium | 5.3 | 2026-01-24 | The Wise Analytics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1.9. This is due to missing capability c… |
CVE-2026-24421 | Medium | 6.5 | 2026-01-24 | phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below have flawed authorization logic which exposes the /api/setup/backup endpoint to any a… |
CVE-2026-24139 | Medium | 6.5 | 2026-01-24 | MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below do not safeguard against authorization bypass, allowing gue… |
CVE-2025-52024 | Critical | 9.4 | 2026-01-23 | A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users. By ac… |
CVE-2025-70986 | High | 7.5 | 2026-01-23 | Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data. |
CVE-2025-70985 | Critical | 9.1 | 2026-01-23 | Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scope. |
CVE-2025-70983 | Critical | 9.9 | 2026-01-23 | Incorrect access control in the authRoutes function of SpringBlade v4.5.0 allows attackers with low-level privileges to escalate privileges. |
CVE-2025-14947 | Medium | 6.5 | 2026-01-23 | The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_callback_cr… |
CVE-2026-24636 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in Syed Balkhi Sugar Calendar (Lite) sugar-calendar-lite allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2026-24633 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in Passionate Brains Add Expires Headers & Optimized Minify add-expires-headers allows Exploiting Incorrectly Configured Ac… |
CVE-2026-24627 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in Trusona Trusona for WordPress trusona allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-24625 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in Imaginate Solutions File Uploads Addon for WooCommerce woo-addon-uploads allows Exploiting Incorrectly Configured Access… |
CVE-2026-24622 | Medium | 5.4 | 2026-01-23 | Missing Authorization vulnerability in Sergiy Dzysyak Suggestion Toolkit suggestion-toolkit allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-24619 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in PopCash PopCash.Net Code Integration Tool popcashnet-code-integration-tool allows Exploiting Incorrectly Configured Acce… |
CVE-2026-24616 | Medium | 6.5 | 2026-01-23 | Missing Authorization vulnerability in Damian WP Popups wp-popups-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2026-24615 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in themebeez Cream Magazine cream-magazine allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-24613 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping Cart ecwid-shopping-cart allows Exploiting Incorrectly Config… |
CVE-2026-24612 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in themebeez Orchid Store orchid-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2026-24607 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in wptravelengine Travel Monster travel-monster allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2026-24606 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-24605 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in pencilwp X Addons for Elementor x-addons-elementor allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-24604 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in themebeez Simple GDPR Cookie Compliance simple-gdpr-cookie-compliance allows Exploiting Incorrectly Configured Access Co… |
CVE-2026-24603 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in themebeez Universal Google Adsense and Ads manager universal-google-adsense-and-ads-manager allows Exploiting Incorrectl… |
CVE-2026-24598 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in bestwebsoft Multilanguage by BestWebSoft multilanguage allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-24595 | Medium | 5.4 | 2026-01-23 | Missing Authorization vulnerability in zohocrm Zoho CRM Lead Magnet zoho-crm-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-24588 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in topdevs Smart Product Viewer smart-product-viewer allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2026-24587 | Medium | 5.4 | 2026-01-23 | Missing Authorization vulnerability in kutsy AJAX Hits Counter + Popular Posts Widget ajax-hits-counter allows Exploiting Incorrectly Configured Access Control… |
CVE-2026-24585 | Medium | 6.5 | 2026-01-23 | Missing Authorization vulnerability in Hyyan Abo Fakher Hyyan WooCommerce Polylang Integration woo-poly-integration allows Exploiting Incorrectly Configured Ac… |
CVE-2026-24583 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in sumup SumUp Payment Gateway For WooCommerce sumup-payment-gateway-for-woocommerce allows Exploiting Incorrectly Configur… |
CVE-2026-24581 | Medium | 5.4 | 2026-01-23 | Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce points-and-rewards-for-woocommerce allows Exploiting Incorrectly Configured… |
CVE-2026-24580 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping Cart ecwid-shopping-cart allows Exploiting Incorrectly Config… |
CVE-2026-24579 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in WP Messiah Ai Image Alt Text Generator for WP ai-image-alt-text-generator-for-wp allows Exploiting Incorrectly Configure… |
CVE-2026-24578 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in Jahid Hasan Admin login URL Change admin-login-url-change allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2026-24577 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in Genetech Products Pie Register pie-register allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-24571 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in boxnow BOX NOW Delivery box-now-delivery allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2026-24570 | Medium | 5.4 | 2026-01-23 | Missing Authorization vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-24569 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in Sully Media Library File Size media-library-file-size allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2026-24568 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in WP Travel WP Travel wp-travel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-24567 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in briarinc Anything Order by Terms anything-order-by-terms allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-24566 | Medium | 6.5 | 2026-01-23 | Missing Authorization vulnerability in iNET iNET Webkit inet-webkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-24563 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in Ashan Perera LifePress lifepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2026-24562 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in Ryviu Ryviu – Product Reviews for WooCommerce ryviu allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2026-24561 | Medium | 5.4 | 2026-01-23 | Missing Authorization vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2026-24560 | Medium | 5.4 | 2026-01-23 | Missing Authorization vulnerability in Cloudinary Cloudinary cloudinary-image-management-and-manipulation-in-the-cloud-cdn allows Exploiting Incorrectly Config… |
CVE-2026-24556 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in wpdive ElementCamp element-camp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2026-24551 | Medium | 5.4 | 2026-01-23 | Missing Authorization vulnerability in monetagwp Monetag Official Plugin monetag-official allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-24544 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in Harmonic Design HD Quiz hd-quiz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |