Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2024-27910

Summary
Assigner-lenovo
Assigner Org ID-da227ddf-6e25-4b41-b023-0f976dcaca4b
Published At-05 Apr, 2024 | 20:46
Updated At-20 Aug, 2024 | 15:40
Rejected At-
Credits

A vulnerability was reported in some Lenovo Printers that could allow an unauthenticated attacker to reboot the printer without authentication.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
â–¼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:lenovo
Assigner Org ID:da227ddf-6e25-4b41-b023-0f976dcaca4b
Published At:05 Apr, 2024 | 20:46
Updated At:20 Aug, 2024 | 15:40
Rejected At:
â–¼CVE Numbering Authority (CNA)

A vulnerability was reported in some Lenovo Printers that could allow an unauthenticated attacker to reboot the printer without authentication.

Affected Products
Vendor
Lenovo Group LimitedLenovo
Product
Printers
Default Status
unaffected
Versions
Affected
  • Various
Problem Types
TypeCWE IDDescription
CWECWE-862CWE-862 Missing Authorization
Type: CWE
CWE ID: CWE-862
Description: CWE-862 Missing Authorization
Metrics
VersionBase scoreBase severityVector
3.15.3MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Version: 3.1
Base score: 5.3
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Upgrade printer firmware to the version (or later) listed in the Product Impact section of LEN-148876 - https://iknow.lenovo.com.cn/detail/420425

Configurations
Workarounds
Exploits
Credits
finder
Lenovo thanks Jia-Ju Bai, Wen-Han Xu, Rui-Nan Hu, Dong Zhang, Cheng Li, Zhen-Yu Guan, and Jian-Wei Liu of the School of Cyber Science and Technology of Beihang University for reporting these issues.
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://iknow.lenovo.com.cn/detail/420425
N/A
Hyperlink: https://iknow.lenovo.com.cn/detail/420425
Resource: N/A
â–¼Authorized Data Publishers (ADP)
1. CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://iknow.lenovo.com.cn/detail/420425
x_transferred
Hyperlink: https://iknow.lenovo.com.cn/detail/420425
Resource:
x_transferred
2. CISA ADP Vulnrichment
Affected Products
Vendor
Lenovo Group Limitedlenovo
Product
lingxlang_g262dn_firmware
CPEs
  • cpe:2.3:o:lenovo:lingxlang_g262dn_firmware:1.00.19:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 1.00.19
Vendor
Lenovo Group Limitedlenovo
Product
lingxlang_g336dn_firmware
CPEs
  • cpe:2.3:o:lenovo:lingxlang_g336dn_firmware:1.00.20:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 1.00.20
Vendor
Lenovo Group Limitedlenovo
Product
lingxlang_lj2320dn_firmware
CPEs
  • cpe:2.3:o:lenovo:lingxlang_lj2320dn_firmware:1.00.10:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 1.00.10
Vendor
Lenovo Group Limitedlenovo
Product
lj2310n_firmware
CPEs
  • cpe:2.3:o:lenovo:lj2310n_firmware:1.00.10:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 1.00.10
Vendor
Lenovo Group Limitedlenovo
Product
lingxlang_gm265dn_firmware
CPEs
  • cpe:2.3:o:lenovo:lingxlang_gm265dn_firmware:1.00.26:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 1.00.26
Vendor
Lenovo Group Limitedlenovo
Product
lingxlang_gm337dn_firmware
CPEs
  • cpe:2.3:o:lenovo:lingxlang_gm337dn_firmware:1.00.24:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 1.00.24
Vendor
Lenovo Group Limitedlenovo
Product
lijiang_m280w_firmware
CPEs
  • cpe:2.3:o:lenovo:lijiang_m280w_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 8.54.00.08.00
Vendor
Lenovo Group Limitedlenovo
Product
lijiang_m280dw_firmware
CPEs
  • cpe:2.3:o:lenovo:lijiang_m280dw_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 8.54.00.08.00
Vendor
Lenovo Group Limitedlenovo
Product
lijiang_m1520w_pro_firmware
CPEs
  • cpe:2.3:o:lenovo:lijiang_m1520w_pro_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 8.54.00.08.00
Vendor
Lenovo Group Limitedlenovo
Product
lijiang_m1520d_pro_firmware
CPEs
  • cpe:2.3:o:lenovo:lijiang_m1520d_pro_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 4.54.00.08.00
Vendor
Lenovo Group Limitedlenovo
Product
lijiang_m1688dw_pro_firmware
CPEs
  • cpe:2.3:o:lenovo:lijiang_m1688dw_pro_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 8.54.00.08.00
Vendor
Lenovo Group Limitedlenovo
Product
lijiang_m1688w_pro_firmware
CPEs
  • cpe:2.3:o:lenovo:lijiang_m1688w_pro_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 4.54.00.08.00
Vendor
Lenovo Group Limitedlenovo
Product
lijiang_m101dw_pro_firmware
CPEs
  • cpe:2.3:o:lenovo:lijiang_m101dw_pro_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 8.54.00.08.00
Vendor
Lenovo Group Limitedlenovo
Product
lijiang_m260dw_firmware
CPEs
  • cpe:2.3:o:lenovo:lijiang_m260dw_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 4.54.00.08.00
Vendor
Lenovo Group Limitedlenovo
Product
lijiang_m200dw_firmware
CPEs
  • cpe:2.3:o:lenovo:lijiang_m200dw_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 4.54.00.08.00
Vendor
Lenovo Group Limitedlenovo
Product
lijiang_m7360dnw_firmware
CPEs
  • cpe:2.3:o:lenovo:lijiang_m7360dnw_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 4.54.00.08.00
Vendor
Lenovo Group Limitedlenovo
Product
lijiang_z1_firmware
CPEs
  • cpe:2.3:o:lenovo:lijiang_z1_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 4.54.00.08.00
Vendor
Lenovo Group Limitedlenovo
Product
lijiang_gm265dn_firmware
CPEs
  • cpe:2.3:o:lenovo:lijiang_gm265dn_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 6.54.00.08.00
Vendor
Lenovo Group Limitedlenovo
Product
lijiang_lj2320dn_firmware
CPEs
  • cpe:2.3:o:lenovo:lijiang_lj2320dn_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 4.54.00.08.00
Vendor
Lenovo Group Limitedlenovo
Product
lijiang_lj2320dnp_firmware
CPEs
  • cpe:2.3:o:lenovo:lijiang_lj2320dnp_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 4.54.00.08.00
Vendor
Lenovo Group Limitedlenovo
Product
lijiang_g263dns_firmware
CPEs
  • cpe:2.3:o:lenovo:lijiang_g263dns_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 2.21.00.04.00
Vendor
Lenovo Group Limitedlenovo
Product
lijiang_g266dns_firmware
CPEs
  • cpe:2.3:o:lenovo:lijiang_g266dns_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 7.21.00.04.00
Vendor
Lenovo Group Limitedlenovo
Product
lijiang_g336dn_firmware
CPEs
  • cpe:2.3:o:lenovo:lijiang_g336dn_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 5.10.00.04.00
Vendor
Lenovo Group Limitedlenovo
Product
lijiang_g338dns_firmware
CPEs
  • cpe:2.3:o:lenovo:lijiang_g338dns_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 5.10.00.04.00
Vendor
Lenovo Group Limitedlenovo
Product
lijiang_g337dn_firmware
CPEs
  • cpe:2.3:o:lenovo:lijiang_g337dn_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 5.10.00.04.00
Vendor
Lenovo Group Limitedlenovo
Product
lijiang_g339dns_firmware
CPEs
  • cpe:2.3:o:lenovo:lijiang_g339dns_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 5.10.00.04.00
Vendor
Lenovo Group Limitedlenovo
Product
lijiang_m7360dna_firmware
CPEs
  • cpe:2.3:o:lenovo:lijiang_m7360dna_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 3.17.00.01.00
Vendor
Lenovo Group Limitedlenovo
Product
lijiang_m7365dna_firmware
CPEs
  • cpe:2.3:o:lenovo:lijiang_m7365dna_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 3.17.00.01.00
Vendor
Lenovo Group Limitedlenovo
Product
lijiang_gm268dnas_firmware
CPEs
  • cpe:2.3:o:lenovo:lijiang_gm268dnas_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 3.17.00.01.00
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
â–¼National Vulnerability Database (NVD)
nvd.nist.gov
Source:psirt@lenovo.com
Published At:05 Apr, 2024 | 21:15
Updated At:15 Apr, 2026 | 00:35

A vulnerability was reported in some Lenovo Printers that could allow an unauthenticated attacker to reboot the printer without authentication.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.15.3MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Type: Secondary
Version: 3.1
Base score: 5.3
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CPE Matches
Weaknesses
CWE IDTypeSource
CWE-862Secondarypsirt@lenovo.com
CWE ID: CWE-862
Type: Secondary
Source: psirt@lenovo.com
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://iknow.lenovo.com.cn/detail/420425psirt@lenovo.com
N/A
https://iknow.lenovo.com.cn/detail/420425af854a3a-2127-422b-91ae-364da2661108
N/A
Hyperlink: https://iknow.lenovo.com.cn/detail/420425
Source: psirt@lenovo.com
Resource: N/A
Hyperlink: https://iknow.lenovo.com.cn/detail/420425
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

120Records found
CVE-2020-8329
Matching Score-8
Assigner-Lenovo Group Ltd.
ShareView Details
Matching Score-8
Assigner-Lenovo Group Ltd.
CVSS Score-5.3||MEDIUM
EPSS-1.54% / 72.34%
||
7 Day CHG~0.00%
Published-28 May, 2020 | 16:10
Updated-16 Sep, 2024 | 20:13
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A denial of service vulnerability was reported in the firmware prior to version 1.01 used in Lenovo Printer LJ4010DN that could be triggered by a remote user sending a crafted packet to the device, causing an error to be displayed and preventing printer from functioning until the printer is rebooted.

Action-Not Available
Vendor-Lenovo Group Limited
Product-lj6700dn_firmwarelj6700dnm8960dnflj4010dn_firmwarem8960dnf_firmwarelj4010dnPrinter LJ4010DN
CVE-2020-8330
Matching Score-8
Assigner-Lenovo Group Ltd.
ShareView Details
Matching Score-8
Assigner-Lenovo Group Ltd.
CVSS Score-5.3||MEDIUM
EPSS-1.54% / 72.34%
||
7 Day CHG~0.00%
Published-28 May, 2020 | 16:10
Updated-16 Sep, 2024 | 19:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A denial of service vulnerability was reported in the firmware prior to version 1.01 used in Lenovo Printer LJ4010DN that could be triggered by a remote user sending a crafted packet to the device, preventing subsequent print jobs until the printer is rebooted.

Action-Not Available
Vendor-Lenovo Group Limited
Product-lj6700dn_firmwarelj6700dnm8960dnflj4010dn_firmwarem8960dnf_firmwarelj4010dnPrinter LJ4010DN
CVE-2024-27911
Matching Score-6
Assigner-Lenovo Group Ltd.
ShareView Details
Matching Score-6
Assigner-Lenovo Group Ltd.
CVSS Score-7.5||HIGH
EPSS-0.49% / 39.09%
||
7 Day CHG~0.00%
Published-05 Apr, 2024 | 20:47
Updated-15 Apr, 2026 | 00:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability was reported in some Lenovo Printers that could allow an unauthenticated attacker to obtain the administrator password.

Action-Not Available
Vendor-Lenovo Group Limited
Product-Printerslingxlang_g262dn_firmwarelingxlang_g336dn_firmwarelj2310n_firmwarelingxlang_gm337dn_firmwarelingxlang_gm265dn_firmwarelingxlang_lj2320dn_firmware
CWE ID-CWE-862
Missing Authorization
CVE-2023-4606
Matching Score-6
Assigner-Lenovo Group Ltd.
ShareView Details
Matching Score-6
Assigner-Lenovo Group Ltd.
CVSS Score-8.1||HIGH
EPSS-0.46% / 37.33%
||
7 Day CHG~0.00%
Published-24 Oct, 2023 | 20:25
Updated-11 Sep, 2024 | 18:24
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command.   This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.

Action-Not Available
Vendor-Lenovo Group Limited
Product-thinkagile_vx7531thinksystem_sr670_firmwarethinkagile_mx3531_h_hybridthinkagile_hx3375_firmwarethinksystem_sr675_v3_firmwarethinkagile_hx5530thinksystem_sr850_v2_firmwarethinksystem_sr250_v2thinksystem_sr665_firmwarethinksystem_sd630_v2_firmwarethinkagile_hx2330_firmwarethinksystem_sd650_v2_firmwarethinksystem_sd665_v3_firmwarethinksystem_sr665_v3_firmwarethinkagile_mx3330-h_hybrid_firmwarethinksystem_sr850_v3_firmwarethinksystem_st250_v2_firmwarethinkagile_hx3330thinkagile_hx7530_firmwarethinkagile_hx2330thinksystem_sr645_v3_firmwarethinkagile_mx3331-f_all-flashthinkagile_vx7530_firmwarethinkagile_hx1331_firmwarethinksystem_sd650-n_v2_firmwarethinksystem_sn550_v2_firmwarethinksystem_sr860_v3_firmwarethinkagile_hx7530thinksystem_st658_v2thinkagile_mx3331-f_all-flash_firmwarethinksystem_sr850_v2thinkagile_mx3530_f_all_flashthinksystem_sr650_v2_firmwarethinksystem_sr665thinksystem_sr630_v2thinksystem_sr860_v2thinksystem_sr635_v3_firmwarethinksystem_st650_v2thinksystem_sr258_v2thinkagile_mx3531_h_hybrid_firmwarethinkagile_hx3375thinkagile_mx3530_f_all_flash_firmwarethinkagile_mx3530-h_hybridthinkagile_vx3330thinkagile_hx3331_firmwarethinkagile_mx3330-h_hybridthinkagile_hx5530_firmwarethinkagile_vx3331thinksystem_st258_v2thinksystem_sr645_v3thinkagile_hx3330_firmwarethinksystem_st658_v3_firmwarethinksystem_sd650-n_v2thinksystem_sr670_v2_firmwarethinksystem_sr630_v3_firmwarethinksystem_sr670_v2thinksystem_sd650_v2thinkagile_mx3331-h_hybridthinksystem_sr655_v3_firmwarethinksystem_sr650_v2thinkagile_vx7330thinkagile_hx1331thinkagile_hx3331thinksystem_sr250_firmwarethinkagile_mx3531-f_all-flash_firmwarethinkagile_mx3530-h_hybrid_firmwarethinkagile_vx7530thinksystem_sd630_v2thinkagile_mx3330-f_all-flashthinkagile_hx5531thinksystem_st250_v2thinksystem_sr860_v2_firmwarethinksystem_sr650_v3_firmwarethinkagile_mx3330-f_all-flash_firmwarethinkagile_hx2331thinkagile_vx5530thinkagile_hx7531_firmwarethinksystem_sn550_v2thinksystem_sr645thinksystem_sd650_v3_firmwarethinksystem_sr670thinksystem_sr258_v2_firmwarethinkagile_mx3531-f_all-flashthinkagile_vx3331_firmwarethinkagile_hx2331_firmwarethinkagile_vx2330_firmwarethinksystem_st650_v2_firmwarethinkagile_vx3530-g_firmwarethinksystem_st258_v2_firmwarethinksystem_sr630_v2_firmwarethinksystem_st650_v3_firmwarethinkagile_hx3376_firmwarethinkagile_hx3376thinkagile_hx5531_firmwarethinkagile_vx7531_firmwarethinkagile_vx2330thinkagile_vx7330_firmwarethinkagile_vx5530_firmwarethinkagile_mx3331-h_hybrid_firmwarethinkagile_vx3330_firmwarethinkagile_vx3530-gthinkagile_hx7531thinksystem_st658_v2_firmwarethinksystem_sr645_firmwareLenovo XClarity Controller (XCC)
CWE ID-CWE-862
Missing Authorization
CVE-2021-42848
Matching Score-6
Assigner-Lenovo Group Ltd.
ShareView Details
Matching Score-6
Assigner-Lenovo Group Ltd.
CVSS Score-4.3||MEDIUM
EPSS-0.70% / 49.44%
||
7 Day CHG~0.00%
Published-18 May, 2022 | 16:10
Updated-04 Aug, 2024 | 03:38
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to retrieve device and networking details.

Action-Not Available
Vendor-Lenovo Group Limited
Product-t2prot1_firmwaret2pro_firmwarex1t1x1_firmwaret2t2_firmwarea1_firmwarea1Personal Cloud Storage X1Personal Cloud Storage T1Personal Cloud Storage A1Personal Cloud Storage T2Personal Cloud Storage T2Pro
CWE ID-CWE-862
Missing Authorization
CVE-2021-42851
Matching Score-6
Assigner-Lenovo Group Ltd.
ShareView Details
Matching Score-6
Assigner-Lenovo Group Ltd.
CVSS Score-6.3||MEDIUM
EPSS-0.56% / 43.06%
||
7 Day CHG~0.00%
Published-18 May, 2022 | 16:10
Updated-04 Aug, 2024 | 03:38
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to create a standard user account.

Action-Not Available
Vendor-Lenovo Group Limited
Product-t2prot1_firmwaret2pro_firmwaret1x1x1_firmwaret2_firmwaret2a1_firmwarea1Personal Cloud Storage X1Personal Cloud Storage T1Personal Cloud Storage A1Personal Cloud Storage T2Personal Cloud Storage T2Pro
CWE ID-CWE-862
Missing Authorization
CVE-2024-3610
Matching Score-4
Assigner-Wordfence
ShareView Details
Matching Score-4
Assigner-Wordfence
CVSS Score-5.3||MEDIUM
EPSS-0.53% / 41.65%
||
7 Day CHG~0.00%
Published-21 Jun, 2024 | 02:05
Updated-08 Apr, 2026 | 18:21
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WP Child Theme Generator <= 1.1.1 - Missing Authorization to Unauthenticated Child Theme Creation/Activation

The WP Child Theme Generator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wctg_easy_child_theme() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to create a blank child theme and activate it cause the site to whitescreen.

Action-Not Available
Vendor-wensolutionswen-solutionswensolutions
Product-wp_child_theme_generatorWP Child Theme Generatorwp_child_theme_generator
CWE ID-CWE-862
Missing Authorization
CVE-2024-35742
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.32% / 23.88%
||
7 Day CHG~0.00%
Published-10 Jun, 2024 | 07:40
Updated-28 Apr, 2026 | 16:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Easy Forms for Mailchimp plugin <= 6.9.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Code Parrots Easy Forms for Mailchimp.This issue affects Easy Forms for Mailchimp: from n/a through 6.9.0.

Action-Not Available
Vendor-codeparrotsCode Parrots
Product-easy_forms_for_mailchimpEasy Forms for Mailchimp
CWE ID-CWE-862
Missing Authorization
CVE-2024-3608
Matching Score-4
Assigner-Wordfence
ShareView Details
Matching Score-4
Assigner-Wordfence
CVSS Score-5.3||MEDIUM
EPSS-0.56% / 43.36%
||
7 Day CHG~0.00%
Published-09 Jul, 2024 | 08:33
Updated-15 Apr, 2026 | 00:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Product Designer <= 1.0.33 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion

The Product Designer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the product_designer_ajax_delete_attach_id() function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to delete arbitrary attachments. CVE-2024-38726 appears to be a duplicate of this issue.

Action-Not Available
Vendor-pickpluginspickplugins
Product-PickPlugins Product Designer for WooCommerceproduct_designer
CWE ID-CWE-862
Missing Authorization
CVE-2024-3599
Matching Score-4
Assigner-Wordfence
ShareView Details
Matching Score-4
Assigner-Wordfence
CVSS Score-5.3||MEDIUM
EPSS-0.53% / 41.63%
||
7 Day CHG~0.00%
Published-02 May, 2024 | 16:52
Updated-08 Apr, 2026 | 18:21
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) <= 3.0.2 - Missing Authorization to Unauthenticated Arbitrary Post Deletion

The WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the gdpr_policy_process_delete() function in all versions up to, and including, 3.0.2. This makes it possible for unauthenticated attackers to delete arbitrary posts.

Action-Not Available
Vendor-wpekawplegalpages
Product-wp_cookie_consentCookie Banner for GDPR / CCPA – WPLP Cookie Consent
CWE ID-CWE-862
Missing Authorization
CVE-2024-33652
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.52% / 41.34%
||
7 Day CHG~0.00%
Published-29 Apr, 2024 | 08:09
Updated-28 Apr, 2026 | 16:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Client Dash plugin <= 2.2.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Real Big Plugins Client Dash.This issue affects Client Dash: from n/a through 2.2.1.

Action-Not Available
Vendor-Real Big Pluginsrealbigplugins
Product-Client Dashclient_dash
CWE ID-CWE-862
Missing Authorization
CVE-2024-32677
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-6.5||MEDIUM
EPSS-0.53% / 41.72%
||
7 Day CHG~0.00%
Published-24 Apr, 2024 | 15:24
Updated-28 Apr, 2026 | 16:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress LoginPress Pro plugin < 3.0.0 - Unauth. License Activation/Deactivation vulnerability

Missing Authorization vulnerability in LoginPress LoginPress Pro.This issue affects LoginPress Pro: from n/a before 3.0.0.

Action-Not Available
Vendor-LoginPress
Product-LoginPress Pro
CWE ID-CWE-862
Missing Authorization
CVE-2024-32532
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.52% / 41.10%
||
7 Day CHG~0.00%
Published-17 Apr, 2024 | 07:13
Updated-28 Apr, 2026 | 16:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Speed Optimizer plugin <= 7.4.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in SiteGround Speed Optimizer.This issue affects Speed Optimizer: from n/a through 7.4.6.

Action-Not Available
Vendor-SiteGround
Product-Speed Optimizer
CWE ID-CWE-862
Missing Authorization
CVE-2025-28872
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.45% / 36.85%
||
7 Day CHG~0.00%
Published-11 Mar, 2025 | 21:00
Updated-28 Apr, 2026 | 16:11
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Block Spam By Math Reloaded plugin <= 2.2.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in jwpegram Block Spam By Math Reloaded block-spam-by-math-reloaded allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Block Spam By Math Reloaded: from n/a through <= 2.2.4.

Action-Not Available
Vendor-jwpegramjwpegram
Product-block_spam_by_math_reloadedBlock Spam By Math Reloaded
CWE ID-CWE-862
Missing Authorization
CVE-2025-69364
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.23% / 13.94%
||
7 Day CHG~0.00%
Published-06 Jan, 2026 | 16:36
Updated-28 Apr, 2026 | 16:14
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Breeze plugin <= 2.2.21 - Broken Access Control vulnerability

Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.2.21.

Action-Not Available
Vendor-Cloudways
Product-Breeze
CWE ID-CWE-862
Missing Authorization
CVE-2025-69359
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.23% / 13.94%
||
7 Day CHG~0.00%
Published-06 Jan, 2026 | 16:36
Updated-28 Apr, 2026 | 16:14
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Creator LMS plugin <= 1.1.12 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPFunnels Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Creator LMS: from n/a through <= 1.1.12.

Action-Not Available
Vendor-WPFunnels
Product-Creator LMS
CWE ID-CWE-862
Missing Authorization
CVE-2025-69031
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.24% / 14.62%
||
7 Day CHG~0.00%
Published-30 Dec, 2025 | 10:47
Updated-28 Apr, 2026 | 16:14
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Arcane theme <= 3.6.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Skywarrior Arcane arcane allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arcane: from n/a through <= 3.6.6.

Action-Not Available
Vendor-Skywarrior
Product-Arcane
CWE ID-CWE-862
Missing Authorization
CVE-2025-67965
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.29% / 21.05%
||
7 Day CHG~0.00%
Published-16 Dec, 2025 | 08:12
Updated-28 Apr, 2026 | 16:14
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Homey Core plugin <= 2.4.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in favethemes Homey Core homey-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Homey Core: from n/a through <= 2.4.3.

Action-Not Available
Vendor-favethemes
Product-Homey Core
CWE ID-CWE-862
Missing Authorization
CVE-2025-68565
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.29% / 21.05%
||
7 Day CHG+0.01%
Published-24 Dec, 2025 | 13:10
Updated-28 Apr, 2026 | 16:14
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Twitch Player plugin <= 2.1.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in JayBee Twitch Player ttv-easy-embed-player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Twitch Player: from n/a through <= 2.1.3.

Action-Not Available
Vendor-JayBee
Product-Twitch Player
CWE ID-CWE-862
Missing Authorization
CVE-2025-67566
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.28% / 20.21%
||
7 Day CHG~0.00%
Published-09 Dec, 2025 | 14:14
Updated-28 Apr, 2026 | 16:14
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Woffice Core plugin <= 5.4.30 - Broken Access Control vulnerability

Missing Authorization vulnerability in WofficeIO Woffice Core woffice-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woffice Core: from n/a through <= 5.4.30.

Action-Not Available
Vendor-WofficeIO
Product-Woffice Core
CWE ID-CWE-862
Missing Authorization
CVE-2025-67575
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.29% / 21.05%
||
7 Day CHG~0.00%
Published-09 Dec, 2025 | 14:14
Updated-28 Apr, 2026 | 16:14
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Sitewide Notice WP plugin <= 2.4.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Andrew Lima Sitewide Notice WP sitewide-notice-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sitewide Notice WP: from n/a through <= 2.4.1.

Action-Not Available
Vendor-Andrew Lima
Product-Sitewide Notice WP
CWE ID-CWE-862
Missing Authorization
CVE-2025-66121
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.28% / 20.21%
||
7 Day CHG~0.00%
Published-16 Dec, 2025 | 08:12
Updated-28 Apr, 2026 | 16:14
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress SiteGround Security plugin <= 1.5.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in SiteGround SiteGround Security sg-security allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteGround Security: from n/a through <= 1.5.8.

Action-Not Available
Vendor-SiteGround
Product-SiteGround Security
CWE ID-CWE-862
Missing Authorization
CVE-2025-66131
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.23% / 14.43%
||
7 Day CHG~0.00%
Published-16 Dec, 2025 | 08:12
Updated-28 Apr, 2026 | 16:14
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Yaad Sarig Payment Gateway For WC plugin <= 2.2.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in yaadsarig Yaad Sarig Payment Gateway For WC yaad-sarig-payment-gateway-for-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Yaad Sarig Payment Gateway For WC: from n/a through <= 2.2.11.

Action-Not Available
Vendor-yaadsarig
Product-Yaad Sarig Payment Gateway For WC
CWE ID-CWE-862
Missing Authorization
CVE-2025-66080
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.24% / 14.62%
||
7 Day CHG~0.00%
Published-30 Dec, 2025 | 16:10
Updated-28 Apr, 2026 | 16:14
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.0.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through <= 4.0.3.

Action-Not Available
Vendor-WP Legal Pages
Product-WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
CWE ID-CWE-862
Missing Authorization
CVE-2025-23862
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.58% / 44.40%
||
7 Day CHG~0.00%
Published-16 Jan, 2025 | 20:07
Updated-11 May, 2026 | 22:45
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Contact Form 7 Anti Spambot plugin <= 1.0.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in SzMake Contact Form 7 Anti Spambot contact-form-7-anti-spambot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form 7 Anti Spambot: from n/a through <= 1.0.1.

Action-Not Available
Vendor-SzMake
Product-Contact Form 7 Anti Spambot
CWE ID-CWE-862
Missing Authorization
CVE-2024-1175
Matching Score-4
Assigner-Wordfence
ShareView Details
Matching Score-4
Assigner-Wordfence
CVSS Score-5.3||MEDIUM
EPSS-0.39% / 31.96%
||
7 Day CHG~0.00%
Published-06 Jun, 2024 | 03:53
Updated-08 Apr, 2026 | 18:20
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WP-Recall – Registration, Profile, Commerce & More <= 16.26.6 - Unauthenticated Payment Deletion via delete_payment

The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'delete_payment' function in all versions up to, and including, 16.26.6. This makes it possible for unauthenticated attackers to delete arbitrary payments.

Action-Not Available
Vendor-plechevandreywppostwppost
Product-wp-recallWP-Recall – Registration, Profile, Commerce & Morewp-recall
CWE ID-CWE-862
Missing Authorization
CVE-2025-62976
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.26% / 17.86%
||
7 Day CHG+0.01%
Published-27 Oct, 2025 | 01:34
Updated-28 Apr, 2026 | 16:14
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Sendle Shipping plugin <= 6.02 - Broken Access Control vulnerability

Missing Authorization vulnerability in Joovii Sendle Shipping official-sendle-shipping-method allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Sendle Shipping: from n/a through <= 6.02.

Action-Not Available
Vendor-Joovii
Product-Sendle Shipping
CWE ID-CWE-862
Missing Authorization
CVE-2025-62122
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.22% / 13.35%
||
7 Day CHG~0.00%
Published-31 Dec, 2025 | 15:38
Updated-28 Apr, 2026 | 16:14
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Trash Duplicate and 301 Redirect plugin <= 1.9.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in solwininfotech Trash Duplicate and 301 Redirect trash-duplicate-and-301-redirect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trash Duplicate and 301 Redirect: from n/a through <= 1.9.1.

Action-Not Available
Vendor-solwininfotech
Product-Trash Duplicate and 301 Redirect
CWE ID-CWE-862
Missing Authorization
CVE-2026-57774
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.29% / 21.51%
||
7 Day CHG~0.00%
Published-13 Jul, 2026 | 08:41
Updated-13 Jul, 2026 | 16:57
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress VW Food Corner theme <= 1.1.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in vowelweb VW Food Corner vw-food-corner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Food Corner: from n/a through <= 1.1.0.

Action-Not Available
Vendor-vowelweb
Product-VW Food Corner
CWE ID-CWE-862
Missing Authorization
CVE-2023-50373
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.61% / 45.82%
||
7 Day CHG~0.00%
Published-09 Dec, 2024 | 11:29
Updated-29 Apr, 2026 | 10:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Alt Manager plugin <= 1.6.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPSAAD Alt Manager alt-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Alt Manager: from n/a through <= 1.6.1.

Action-Not Available
Vendor-WPSAADwpsaad
Product-Alt Manageralt_manager
CWE ID-CWE-862
Missing Authorization
CVE-2023-50904
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.66% / 47.81%
||
7 Day CHG~0.00%
Published-09 Dec, 2024 | 11:29
Updated-29 Apr, 2026 | 10:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Poll Maker plugin <= 4.8.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Ays Pro Poll Maker poll-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poll Maker: from n/a through <= 4.8.0.

Action-Not Available
Vendor-poll_maker_teamAYS Pro Extensions
Product-poll_makerPoll Makerpoll_maker
CWE ID-CWE-862
Missing Authorization
CVE-2026-45212
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.22% / 13.35%
||
7 Day CHG~0.00%
Published-12 May, 2026 | 11:02
Updated-12 May, 2026 | 14:03
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster wp-asset-clean-up allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Asset CleanUp: Page Speed Booster: from n/a through <= 1.4.0.3.

Action-Not Available
Vendor-Gabe Livan
Product-Asset CleanUp: Page Speed Booster
CWE ID-CWE-862
Missing Authorization
CVE-2023-48739
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.37% / 29.99%
||
7 Day CHG~0.00%
Published-02 Jan, 2025 | 14:15
Updated-29 Apr, 2026 | 10:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Porto Theme Functionality plugin < 2.12.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Porto Theme Porto Theme - Functionality porto-functionality allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Porto Theme - Functionality: from n/a through < 2.12.1.

Action-Not Available
Vendor-Porto Theme
Product-Porto Theme - Functionality
CWE ID-CWE-862
Missing Authorization
CVE-2026-39716
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.23% / 14.44%
||
7 Day CHG~0.00%
Published-08 Apr, 2026 | 08:30
Updated-24 Jul, 2026 | 20:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Flipmart theme <= 2.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in CKThemes Flipmart flipmart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flipmart: from n/a through <= 2.8.

Action-Not Available
Vendor-CKThemes
Product-Flipmart
CWE ID-CWE-862
Missing Authorization
CVE-2026-39675
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.23% / 14.30%
||
7 Day CHG~0.00%
Published-08 Apr, 2026 | 08:30
Updated-24 Jul, 2026 | 20:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Court Reservation plugin <= 1.10.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in webmuehle Court Reservation court-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Court Reservation: from n/a through <= 1.10.11.

Action-Not Available
Vendor-webmuehle
Product-Court Reservation
CWE ID-CWE-862
Missing Authorization
CVE-2026-39658
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.28% / 20.38%
||
7 Day CHG~0.00%
Published-08 Apr, 2026 | 08:30
Updated-20 Jul, 2026 | 20:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Panda Pods Repeater Field plugin <= 1.5.12 - Broken Access Control vulnerability

Missing Authorization vulnerability in Coding Panda Panda Pods Repeater Field panda-pods-repeater-field allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Panda Pods Repeater Field: from n/a through <= 1.5.12.

Action-Not Available
Vendor-Coding Panda
Product-Panda Pods Repeater Field
CWE ID-CWE-862
Missing Authorization
CVE-2026-39664
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.22% / 12.45%
||
7 Day CHG~0.00%
Published-08 Apr, 2026 | 08:30
Updated-24 Jul, 2026 | 20:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Leadrebel plugin <= 1.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in leadrebel Leadrebel leadrebel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leadrebel: from n/a through <= 1.0.2.

Action-Not Available
Vendor-leadrebel
Product-Leadrebel
CWE ID-CWE-862
Missing Authorization
CVE-2026-39687
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.21% / 11.94%
||
7 Day CHG~0.00%
Published-08 Apr, 2026 | 08:30
Updated-24 Jul, 2026 | 20:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Rapid Car Check Vehicle Data plugin <= 2.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Rapid Car Check Rapid Car Check Vehicle Data free-vehicle-data-uk allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rapid Car Check Vehicle Data: from n/a through <= 2.0.

Action-Not Available
Vendor-Rapid Car Check
Product-Rapid Car Check Vehicle Data
CWE ID-CWE-862
Missing Authorization
CVE-2026-39688
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.22% / 12.45%
||
7 Day CHG~0.00%
Published-08 Apr, 2026 | 08:30
Updated-24 Jul, 2026 | 20:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress WP Frontend Profile plugin <= 1.3.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Glowlogix WP Frontend Profile wp-front-end-profile allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Frontend Profile: from n/a through <= 1.3.9.

Action-Not Available
Vendor-Glowlogix
Product-WP Frontend Profile
CWE ID-CWE-862
Missing Authorization
CVE-2026-39701
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.24% / 14.75%
||
7 Day CHG~0.00%
Published-08 Apr, 2026 | 08:30
Updated-24 Jul, 2026 | 20:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress ShopWP plugin <= 5.2.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in Andrew ShopWP wpshopify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopWP: from n/a through <= 5.2.4.

Action-Not Available
Vendor-Andrew
Product-ShopWP
CWE ID-CWE-862
Missing Authorization
CVE-2023-49154
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.61% / 45.82%
||
7 Day CHG~0.00%
Published-09 Dec, 2024 | 11:30
Updated-28 Apr, 2026 | 16:08
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Button Generator – easily Button Builder plugin <= 2.3.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in Wow-Company Button Generator – easily Button Builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Button Generator – easily Button Builder: from n/a through 2.3.8.

Action-Not Available
Vendor-Wow-Companywow-company
Product-Button Generator – easily Button Builderbutton_generator
CWE ID-CWE-862
Missing Authorization
CVE-2026-32346
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.21% / 11.93%
||
7 Day CHG~0.00%
Published-13 Mar, 2026 | 11:41
Updated-29 Apr, 2026 | 10:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Travel Agency theme <= 1.5.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in raratheme Travel Agency travel-agency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Agency: from n/a through <= 1.5.5.

Action-Not Available
Vendor-raratheme
Product-Travel Agency
CWE ID-CWE-862
Missing Authorization
CVE-2026-32383
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.21% / 11.94%
||
7 Day CHG~0.00%
Published-13 Mar, 2026 | 11:42
Updated-29 Apr, 2026 | 10:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Ridhi theme <= 1.1.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in raratheme Ridhi ridhi allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ridhi: from n/a through <= 1.1.2.

Action-Not Available
Vendor-raratheme
Product-Ridhi
CWE ID-CWE-862
Missing Authorization
CVE-2026-32427
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.24% / 15.63%
||
7 Day CHG~0.00%
Published-13 Mar, 2026 | 11:42
Updated-29 Apr, 2026 | 10:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress VW Education Lite plugin <= 2.2.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in vowelweb VW Education Lite vw-education-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Education Lite: from n/a through <= 2.2.0.

Action-Not Available
Vendor-vowelweb
Product-VW Education Lite
CWE ID-CWE-862
Missing Authorization
CVE-2026-32435
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.23% / 14.30%
||
7 Day CHG~0.00%
Published-13 Mar, 2026 | 11:42
Updated-29 Apr, 2026 | 10:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress VW Pet Shop theme <= 1.4.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in vowelweb VW Pet Shop vw-pet-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Pet Shop: from n/a through <= 1.4.7.

Action-Not Available
Vendor-vowelweb
Product-VW Pet Shop
CWE ID-CWE-862
Missing Authorization
CVE-2026-32436
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.24% / 15.63%
||
7 Day CHG~0.00%
Published-13 Mar, 2026 | 11:42
Updated-29 Apr, 2026 | 10:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress VW Photography theme <= 1.3.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in vowelweb VW Photography vw-photography allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Photography: from n/a through <= 1.3.8.

Action-Not Available
Vendor-vowelweb
Product-VW Photography
CWE ID-CWE-862
Missing Authorization
CVE-2026-32438
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.24% / 15.63%
||
7 Day CHG~0.00%
Published-13 Mar, 2026 | 11:42
Updated-29 Apr, 2026 | 10:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress VW School Education theme <= 1.4.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in vowelweb VW School Education vw-school-education allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW School Education: from n/a through <= 1.4.6.

Action-Not Available
Vendor-vowelweb
Product-VW School Education
CWE ID-CWE-862
Missing Authorization
CVE-2022-47601
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.40% / 32.66%
||
7 Day CHG~0.00%
Published-02 Jan, 2025 | 15:07
Updated-28 Apr, 2026 | 19:19
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress WP Table Manager plugin <= 3.5.2 - Broken Access Control

Missing Authorization vulnerability in JoomUnited WP Table Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Table Manager: from n/a through 3.5.2.

Action-Not Available
Vendor-JoomUnited
Product-WP Table Manager
CWE ID-CWE-862
Missing Authorization
CVE-2025-58600
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.33% / 25.41%
||
7 Day CHG~0.00%
Published-03 Sep, 2025 | 14:36
Updated-13 May, 2026 | 00:07
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Paid Member Subscriptions Plugin <= 2.15.9 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through <= 2.15.9.

Action-Not Available
Vendor-Cozmoslabs
Product-Paid Member Subscriptions
CWE ID-CWE-862
Missing Authorization
CVE-2026-27355
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.3||MEDIUM
EPSS-0.28% / 19.95%
||
7 Day CHG~0.00%
Published-23 Jul, 2026 | 11:17
Updated-23 Jul, 2026 | 15:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Ditty plugin <= 3.1.66 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.

Action-Not Available
Vendor-metaphorcreations
Product-Ditty
CWE ID-CWE-862
Missing Authorization
  • Previous
  • 1
  • 2
  • 3
  • Next
Details not found