CWE-862 · Missing Authorization (page 26)
Page 26 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-15347 | High | 8.8 | 2026-01-20 | The Creator LMS – The LMS for Creators, Coaches, and Trainers plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privileg… |
CVE-2025-15043 | Medium | 5.4 | 2026-01-20 | The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'start_migration', 'cancel_migration… |
CVE-2025-14798 | Medium | 5.3 | 2026-01-20 | The LearnPress – WordPress LMS Plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.3.2.4 via the get_item_… |
CVE-2025-14351 | Medium | 5.3 | 2026-01-20 | The Custom Fonts – Host Your Fonts Locally plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'BCF_Google… |
CVE-2025-14978 | Medium | 5.3 | 2026-01-20 | The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) plugin for WordPress is vulnerable to unauthorized… |
CVE-2025-15466 | Medium | 5.4 | 2026-01-20 | The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on… |
CVE-2026-23875 | Medium | 5.4 | 2026-01-19 | CrawlChat is an open-source, AI-powered platform that transforms technical documentation into intelligent chatbots. Prior to version 0.0.8, a non-existing perm… |
CVE-2026-23721 | Medium | 4.3 | 2026-01-19 | OpenProject is an open-source, web-based project management software. When using groups in OpenProject to manage users, the group members should only be visibl… |
CVE-2026-1169 | Medium | 4.3 | 2026-01-19 | A security vulnerability has been detected in birkir prime up to 0.4.0.beta.0. This vulnerability affects unknown code. Such manipulation leads to cross-site r… |
CVE-2026-23522 | Low | 3.7 | 2026-01-19 | LobeChat is an open source chat application platform. Prior to version 2.0.0-next.193, `knowledgeBase.removeFilesFromKnowledgeBase` tRPC ep allows authenticate… |
CVE-2026-1153 | Medium | 4.3 | 2026-01-19 | A vulnerability was detected in technical-laohu mpay up to 1.2.4. This affects an unknown function. Performing a manipulation results in cross-site request for… |
CVE-2026-1148 | Medium | 4.3 | 2026-01-19 | A vulnerability was determined in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. This vulnerability affects unknown code. Exec… |
CVE-2026-1142 | Medium | 4.3 | 2026-01-19 | A security flaw has been discovered in PHPGurukul News Portal 1.0. The impacted element is an unknown function. Performing a manipulation results in cross-site… |
CVE-2025-14078 | Medium | 5.3 | 2026-01-17 | The PAYGENT for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.6. This is due to missing aut… |
CVE-2025-14029 | Medium | 5.3 | 2026-01-17 | The Community Events plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_admin_event_approval… |
CVE-2025-12825 | Medium | 5.3 | 2026-01-17 | The User Registration Using Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_cf7_… |
CVE-2025-12168 | Medium | 4.3 | 2026-01-17 | The Phrase TMS Integration for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_a… |
CVE-2026-0820 | Medium | 4.3 | 2026-01-17 | The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference due to missing capabili… |
CVE-2025-14463 | Medium | 5.3 | 2026-01-17 | The Payment Button for PayPal plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, and including, 1.2.3.41. This is due to… |
CVE-2025-14450 | Medium | 6.5 | 2026-01-17 | The Wallet System for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'change_wall… |
CVE-2026-1004 | Medium | 5.3 | 2026-01-16 | The Essential Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 6.5.5 via the 'eael… |
CVE-2025-14757 | Medium | 5.3 | 2026-01-16 | The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Payment Status Bypass in all versions up to, and including, 3.6.9 only when u… |
CVE-2026-1003 | Medium | 4.3 | 2026-01-16 | The GetGenie plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.0. This is due to the plugin not properly ver… |
CVE-2026-1000 | Medium | 6.5 | 2026-01-16 | The MailerLite - WooCommerce integration plugin for WordPress is vulnerable to unauthorized data modification and deletion in all versions up to, and including… |
CVE-2025-14982 | Medium | 4.3 | 2026-01-16 | The Booking Calendar plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Exposure in all versions up to, and including… |
CVE-2025-14384 | Medium | 4.3 | 2026-01-16 | The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized access of data due to a mi… |
CVE-2025-12641 | Medium | 6.5 | 2026-01-16 | The Awesome Support - WordPress HelpDesk & Support Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in all versions… |
CVE-2025-64729 | High | 8.1 | 2026-01-16 | The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to tamper with Process Optimization project files, embed code, and… |
CVE-2021-47812 | Critical | 9.8 | 2026-01-16 | GravCMS 1.10.7 contains an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configuration and execute PHP code through the sc… |
CVE-2025-13859 | Medium | 6.4 | 2026-01-15 | The AffiliateX – Amazon Affiliate Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_… |
CVE-2025-12895 | Medium | 5.3 | 2026-01-15 | The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the… |
CVE-2025-14457 | Low | 3.7 | 2026-01-15 | The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ownership ch… |
CVE-2026-23477 | High | 7.7 | 2026-01-14 | Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0, the API endpoint GET /api/v1/oauth-app… |
CVE-2025-15512 | Medium | 5.3 | 2026-01-14 | The Aplazo Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the check_success_respo… |
CVE-2025-15475 | Medium | 5.3 | 2026-01-14 | The PayHere Payment Gateway Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improper validation logic… |
CVE-2025-14173 | Medium | 5.3 | 2026-01-14 | The Perfit WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.1. This is due to missing authoriz… |
CVE-2026-0635 | Medium | 4.3 | 2026-01-14 | The Responsive Accordion Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'resp_accordio… |
CVE-2025-14880 | Medium | 5.3 | 2026-01-14 | The Netcash WooCommerce Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle… |
CVE-2025-14854 | Medium | 5.4 | 2026-01-14 | The WP-CRM System plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on the wpcrm_get_email_recipients and wpcrm_system… |
CVE-2025-14482 | Medium | 4.3 | 2026-01-14 | The Crush.pics Image Optimizer - Image Compression and Optimization plugin for WordPress is vulnerable to unauthorized modification of data due to missing capa… |
CVE-2025-68947 | Medium | 4.7 | 2026-01-13 | NSecsoft 'NSecKrnl' is a Windows driver that allows a local, authenticated attacker to terminate processes owned by other users, including SYSTEM and Protected… |
CVE-2025-11669 | High | 8.1 | 2026-01-13 | Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 are vulnerable to an… |
CVE-2025-59022 | High | 8.1 | 2026-01-13 | Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had per… |
CVE-2025-59021 | Medium | 6.4 | 2026-01-13 | Backend users with access to the redirects module and write permission on the sys_redirect table were able to read, create, and modify any redirect record with… |
CVE-2025-14001 | Medium | 5.4 | 2026-01-13 | The WP Duplicate Page plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'duplicateBulkHandle' and… |
CVE-2026-0511 | High | 8.1 | 2026-01-13 | SAP Fiori App Intercompany Balance Reconciliation does not perform necessary authorization checks for an authenticated user, resulting in escalation of privile… |
CVE-2026-0506 | High | 8.1 | 2026-01-13 | Due to a Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform, an authenticated attacker could misuse an RFC function to exec… |
CVE-2026-0503 | Medium | 6.4 | 2026-01-13 | Due to missing authorization check in the SAP ERP Central Component (SAP ECC) and SAP S/4HANA (SAP EHS Management), an attacker could extract hardcoded clear-t… |
CVE-2026-0497 | Medium | 4.3 | 2026-01-13 | SAP Product Designer Web UI of Business Server Pages allows authenticated non-administrative users to access non-sensitive information. This results in a low i… |
CVE-2025-14948 | Medium | 5.3 | 2026-01-10 | The miniOrange OTP Verification and SMS Notification for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing c… |
CVE-2026-0817 | Medium | 5.3 | 2026-01-09 | Missing Authorization vulnerability in Wikimedia Foundation MediaWiki - CampaignEvents extension allows Privilege Abuse.This issue affects MediaWiki - Campaign… |
CVE-2025-14172 | Medium | 6.5 | 2026-01-09 | The WP Page Permalink Extension plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.4. This is due to missing… |
CVE-2025-13717 | Medium | 5.3 | 2026-01-09 | The Contact Form vCard Generator plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wp_gvccf_check_dow… |
CVE-2025-13781 | Medium | 6.5 | 2026-01-09 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed… |
CVE-2025-13772 | High | 7.1 | 2026-01-09 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed… |
CVE-2025-14741 | Critical | 9.1 | 2026-01-09 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modification and deletion due to a missing ca… |
CVE-2025-14657 | High | 7.2 | 2026-01-09 | The Eventin – Event Manager, Events Calendar, Event Tickets and Registrations plugin for WordPress is vulnerable to unauthorized modification of data due to a… |
CVE-2025-14146 | Medium | 5.3 | 2026-01-09 | The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 10.14.10 via the `WPBC_FLEXTIME… |
CVE-2025-13935 | Medium | 4.3 | 2026-01-09 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course completion in all versions up to, and including… |
CVE-2025-13934 | Medium | 4.3 | 2026-01-09 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course enrollment in all versions up to, and including… |
CVE-2025-13628 | Medium | 4.3 | 2026-01-09 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification and deletion of data due to a missing capa… |
CVE-2025-14782 | Medium | 5.3 | 2026-01-09 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and i… |
CVE-2025-14720 | Medium | 5.3 | 2026-01-09 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on multipl… |
CVE-2025-14718 | Medium | 5.4 | 2026-01-09 | The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.9.3. This… |
CVE-2025-14886 | Medium | 5.3 | 2026-01-09 | The Japanized for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `order` REST API… |
CVE-2026-22522 | Medium | 6.5 | 2026-01-08 | Missing Authorization vulnerability in Munir Kamal Block Slider block-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-22517 | Medium | 5.4 | 2026-01-08 | Missing Authorization vulnerability in Passionate Brains GA4WP: Google Analytics for WordPress ga-for-wp allows Exploiting Incorrectly Configured Access Contro… |
CVE-2026-22492 | Medium | 4.3 | 2026-01-08 | Missing Authorization vulnerability in Nawawi Jamili Docket Cache docket-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-22490 | Medium | 5.4 | 2026-01-08 | Missing Authorization vulnerability in niklaslindemann Bulk Landing Page Creator for WordPress LPagery lpagery allows Exploiting Incorrectly Configured Access… |
CVE-2026-22488 | Medium | 5.3 | 2026-01-08 | Missing Authorization vulnerability in IdeaBox Creations Dashboard Welcome for Beaver Builder dashboard-welcome-for-beaver-builder allows Exploiting Incorrectl… |
CVE-2026-22487 | Medium | 4.3 | 2026-01-08 | Missing Authorization vulnerability in baqend Speed Kit baqend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Speed… |
CVE-2026-22486 | Medium | 5.3 | 2026-01-08 | Missing Authorization vulnerability in Re Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Re Gallery: from n… |
CVE-2026-0676 | Medium | 5.3 | 2026-01-08 | Missing Authorization vulnerability in G5Theme Zorka zorka allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zorka: fr… |
CVE-2026-0674 | Medium | 4.3 | 2026-01-08 | Missing Authorization vulnerability in Campaign Monitor Campaign Monitor for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-67926 | Medium | 6.5 | 2026-01-08 | Missing Authorization vulnerability in Shahjahan Jewel Fluent Support fluent-support allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-67917 | Medium | 6.5 | 2026-01-08 | Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-67913 | Medium | 6.5 | 2026-01-08 | Missing Authorization vulnerability in Aruba.it Dev Aruba HiSpeed Cache aruba-hispeed-cache allows Accessing Functionality Not Properly Constrained by ACLs.Thi… |
CVE-2025-22715 | High | 7.5 | 2026-01-08 | Missing Authorization vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem allows Exploiting In… |
CVE-2025-14360 | High | 7.5 | 2026-01-08 | Missing Authorization vulnerability in Kaira Blockons blockons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blockons: fro… |
CVE-2025-14358 | High | 7.5 | 2026-01-08 | Missing Authorization vulnerability in sizam REHub Framework rehub-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects… |
CVE-2025-13679 | Medium | 6.5 | 2026-01-08 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the… |
CVE-2025-12640 | Medium | 4.3 | 2026-01-08 | The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Unauthorized Arbitrary Media… |
CVE-2025-69221 | Medium | 4.3 | 2026-01-07 | LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control when querying agent permissions. An authenticat… |
CVE-2025-69220 | High | 7.1 | 2026-01-07 | LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file uploads to an agents file context and… |
CVE-2025-46434 | Medium | 6.5 | 2026-01-07 | Missing Authorization vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro theplus_elementor_addon allows Exploiting Incorrectly Configured A… |
CVE-2026-0656 | High | 8.2 | 2026-01-07 | The iPaymu Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 2.0.2 via the 'ch… |
CVE-2026-0628 | High | 8.8 | 2026-01-07 | Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious extensi… |
CVE-2025-69344 | Medium | 4.3 | 2026-01-07 | Missing Authorization vulnerability in themehunk Oneline Lite oneline-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-69333 | Medium | 4.3 | 2026-01-07 | Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-14901 | Medium | 6.5 | 2026-01-07 | The Bit Form – Contact Form Plugin plugin for WordPress is vulnerable to unauthorized workflow execution due to missing authorization in the triggerWorkFlow fu… |
CVE-2025-14460 | Medium | 5.3 | 2026-01-07 | The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress is vulnerable to unauthorized order status modification in all versions up to, and including… |
CVE-2025-14370 | Medium | 4.3 | 2026-01-07 | The Quote Comments plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0.0. This is due to missing authorizatio… |
CVE-2025-14070 | High | 7.5 | 2026-01-07 | The Reviewify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'send_test_email' AJAX action in… |
CVE-2025-13722 | Medium | 5.3 | 2026-01-07 | The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Missing Authorization in all v… |
CVE-2025-13529 | Medium | 5.3 | 2026-01-07 | The Unify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'init' action in all versions up to… |
CVE-2025-13496 | Medium | 5.3 | 2026-01-07 | The Moosend Landing Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the moosend_landings_aut… |
CVE-2025-13493 | High | 7.5 | 2026-01-07 | The Latest Registered Users plugin for WordPress is vulnerable to unauthorized user data export in all versions up to, and including, 1.4. This is due to missi… |
CVE-2025-13419 | Medium | 5.3 | 2026-01-07 | The Guest posting / Frontend Posting / Front Editor – WP Front User Submit plugin for WordPress is vulnerable to unauthorized modification of data due to a mis… |
CVE-2025-12449 | Medium | 5.4 | 2026-01-07 | The aBlocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data and disclosure of sensitive information due to… |
CVE-2025-11877 | High | 7.5 | 2026-01-07 | The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler 'ual_shook_wp_login_fail… |