CWE-862
Missing Authorization
Description
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-665
CVEs mapped to this weakness (10,936)
page 292 of 547| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-94080 | Med | 0.34 | 5.3 | 0.00 | Sep 23, 2026 | Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions. | ||
| CVE-2026-94079 | Med | 0.34 | 5.3 | 0.00 | Sep 23, 2026 | Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions. | ||
| CVE-2026-87979 | Med | 0.34 | 5.3 | 0.00 | Sep 23, 2026 | The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts. | ||
| CVE-2026-86785 | Med | 0.34 | 5.3 | 0.00 | Sep 23, 2026 | The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to update Social Commerce for WooCommerce WordPress plugin through 2.5.4 configuration and product… | ||
| CVE-2026-83555 | Med | 0.34 | 5.3 | 0.00 | Sep 23, 2026 | The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email… | ||
| CVE-2025-14487 | Med | 0.34 | 5.3 | 0.00 | Sep 22, 2026 | The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment configuration settings,… | ||
| CVE-2025-14486 | Med | 0.34 | 5.3 | 0.00 | Sep 22, 2026 | The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to delete arbitrary API keys (Pixabay, Unsplash, Pixels,… | ||
| CVE-2025-14484 | Med | 0.34 | 5.3 | 0.00 | Sep 22, 2026 | The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys (Pixabay, Unsplash, Pixels)… | ||
| CVE-2026-69190 | Med | 0.34 | 6.3 | 0.00 | Sep 21, 2026 | Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an… | ||
| CVE-2026-94394 | Med | 0.34 | — | 0.00 | Sep 21, 2026 | When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are also allowed for that user. Because of this, someone who can view an event could… | ||
| CVE-2026-18346 | Med | 0.34 | 5.3 | 0.00 | Sep 19, 2026 | The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite… | ||
| CVE-2026-4792 | Med | 0.34 | 5.3 | 0.01 | Sep 19, 2026 | The Bread plugin for WordPress is vulnerable to information exposure in versions up to and including 2.9.12. This is due to the lack of authentication and authorization checks on the settings export functionality (download_settings function) which is registered on the… | ||
| CVE-2026-1984 | Med | 0.34 | 5.3 | 0.00 | Sep 19, 2026 | The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepa_use_gt_editor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated… | ||
| CVE-2026-92435 | Med | 0.34 | 5.3 | 0.00 | Sep 19, 2026 | The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger… | ||
| CVE-2026-92430 | Med | 0.34 | 5.3 | 0.00 | Sep 19, 2026 | The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying. | ||
| CVE-2026-91707 | Med | 0.34 | 5.3 | 0.00 | Sep 18, 2026 | The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it… | ||
| CVE-2026-92992 | Med | 0.34 | 6.3 | 0.00 | Sep 17, 2026 | A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected element is an unknown function of the file server/internal/ai/api/ai.go of the component AI Assistant. The manipulation leads to missing authorization. Remote exploitation of the attack is… | ||
| CVE-2026-78528 | Med | 0.34 | 5.3 | 0.00 | Sep 17, 2026 | Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions. | ||
| CVE-2026-74017 | Med | 0.34 | 5.3 | 0.00 | Sep 17, 2026 | Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions. | ||
| CVE-2026-74002 | Med | 0.34 | 5.3 | 0.00 | Sep 17, 2026 | Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions. |
- risk 0.34cvss 5.3epss 0.00
Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions.
- risk 0.34cvss 5.3epss 0.00
Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.
- risk 0.34cvss 5.3epss 0.00
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts.
- risk 0.34cvss 5.3epss 0.00
The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to update Social Commerce for WooCommerce WordPress plugin through 2.5.4 configuration and product…
- risk 0.34cvss 5.3epss 0.00
The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email…
- risk 0.34cvss 5.3epss 0.00
The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment configuration settings,…
- risk 0.34cvss 5.3epss 0.00
The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to delete arbitrary API keys (Pixabay, Unsplash, Pixels,…
- risk 0.34cvss 5.3epss 0.00
The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys (Pixabay, Unsplash, Pixels)…
- risk 0.34cvss 6.3epss 0.00
Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an…
- risk 0.34cvss —epss 0.00
When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are also allowed for that user. Because of this, someone who can view an event could…
- risk 0.34cvss 5.3epss 0.00
The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite…
- risk 0.34cvss 5.3epss 0.01
The Bread plugin for WordPress is vulnerable to information exposure in versions up to and including 2.9.12. This is due to the lack of authentication and authorization checks on the settings export functionality (download_settings function) which is registered on the…
- risk 0.34cvss 5.3epss 0.00
The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepa_use_gt_editor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated…
- risk 0.34cvss 5.3epss 0.00
The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger…
- risk 0.34cvss 5.3epss 0.00
The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying.
- risk 0.34cvss 5.3epss 0.00
The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it…
- risk 0.34cvss 6.3epss 0.00
A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected element is an unknown function of the file server/internal/ai/api/ai.go of the component AI Assistant. The manipulation leads to missing authorization. Remote exploitation of the attack is…
- risk 0.34cvss 5.3epss 0.00
Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions.
- risk 0.34cvss 5.3epss 0.00
Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.
- risk 0.34cvss 5.3epss 0.00
Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions.