All CVEs — page 336 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The Groundhogg plugin for WordPress allows attackers with Sales Representative-level access to escalate privileges by reassigning contact records to an Administrator's user ID, then using an email test feature to gain full admin access.
The flaw allows authenticated attackers with subscriber-level access to extract other users' sensitive information such as email addresses, login names, and registration dates. Unauthenticated attackers can also exploit this vulnerability if the WordPress users_can_register option is enabled.
The Ultimate Member WordPress plugin fails to properly verify user authorization when accessing member profile fields, allowing unauthenticated attackers to view privacy-restricted data through the wp_ajax_nopriv_um_get_members endpoint. This authorization bypass affects all versions up to 2.13.1 and exposes sensitive member information including owner-only, members-only, and role-restricted fields.
The flaw allows execution of arbitrary code through unverified recipe files, posing a critical security risk.