CWE-862— Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.— MITRE CWE catalog

8,560 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-862page 96 of 172

CVE-2025-12751MEDIUMCVSS 4.3EG 4.3
2025-11-19
The WSChat – WordPress Live Chat plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'reset_settings' AJAX endpoint in all versions up to, and including, 3.1.6. This makes it p…
CVE-2025-12778MEDIUMCVSS 5.3EG 5.3
2025-11-20
The Ultimate Member Widgets for Elementor – WordPress User Directory plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the handle_filter_users function in all versions up to, and inclu…
CVE-2025-12782MEDIUMCVSS 4.3EG 4.3
2025-12-04
The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.9.4. This is due to the plugin not properly verifying a user's authorization in the disable() …
CVE-2025-12783MEDIUMCVSS 4.3EG 4.3
2025-12-12
The Premmerce Brands for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveBrandsSettings function in all versions up to, and including, 1.2.13. This makes it p…
CVE-2025-1279HIGHCVSS 8.8EG 8.8
2025-04-25
The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ux_cb_tools_import_item_ajax AJAX action in all versions up to, a…
CVE-2025-12809MEDIUMCVSS 5.3EG 5.3
2025-12-16
The Dokan Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `/dokan/v1/wholesale/register` REST API endpoint in all versions up to, and including, 4.1.3. This makes it possible f…
CVE-2025-12817LOWCVSS 3.1EG 3.1
2025-11-13
Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user havi…
CVE-2025-12822MEDIUMCVSS 4.3EG 4.3
2025-11-19
The WP Login and Register using JWT plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mo_jwt_generate_new_api_key' function in all versions up to, and including, 3.0.0. This makes i…
CVE-2025-12825MEDIUMCVSS 5.3EG 5.3
2026-01-17
The User Registration Using Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_cf7_form_data' function in all versions up to, and including, 2.5. This makes it pos…
CVE-2025-12826MEDIUMCVSS 4.8EG 4.8
2025-12-04
The Custom Post Type UI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.18.0. This is due to the plugin not verifying that a user has the required capability to perform actions in the "cpt…
CVE-2025-12845HIGHCVSS 8.8EG 8.8
2026-02-19
The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to unauthorized access of data that leads to privilege escalation due to a missing capability check on the get_table_d…
CVE-2025-12847MEDIUMCVSS 4.3EG 4.3
2025-11-15
The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized arbitrary media attachment deletion due to a missing authorization check in all versions up to, and incl…
CVE-2025-12849MEDIUMCVSS 5.3EG 5.3
2025-11-15
The Contest Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 28.0.2. This is due to the plugin registering the `cg_check_wp_admin_upload_v10` AJAX action for both authenticated and un…
CVE-2025-1285MEDIUMCVSS 5.3EG 5.3
2025-03-14
The Resido - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the delete_api_key and save_api_key AJAX actions in all versions up to, and including, 3.6. This makes i…
CVE-2025-12876MEDIUMCVSS 5.3EG 5.3
2025-12-05
The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pto_delete_file AJAX action in all versions up to, and including, 5.1.19. Thi…
CVE-2025-12877MEDIUMCVSS 5.3EG 5.3
2025-11-22
The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized modification od data due to a missing capability check on the panding_blood_request_action() function in all versions up…
CVE-2025-12887MEDIUMCVSS 5.4EG 5.4
2025-12-03
The Post SMTP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.1. This is due to the plugin not properly verifying that a user is authorized to update OAuth tokens on the 'handle_gmail_oa…
CVE-2025-12891MEDIUMCVSS 5.3EG 5.3
2025-11-13
The Survey Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ays_survey_show_results' AJAX endpoint in all versions up to, and including, 5.1.9.4. This makes it possible for u…
CVE-2025-12892MEDIUMCVSS 5.3EG 5.3
2025-11-13
The Survey Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_plugin_option() function in all versions up to, and including, 5.1.9.4. This makes it possible for…
CVE-2025-12895MEDIUMCVSS 5.3EG 5.3
2026-01-15
The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the kalium_vc_contact_form_request() function in all versions up to, and including, …
CVE-2025-12898MEDIUMCVSS 5.3EG 5.3
2025-12-20
The Pretty Google Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the pgcal_ajax_handler() function in all versions up to, and including, 2.0.0. This makes it possible for una…
CVE-2025-12900MEDIUMCVSS 4.3EG 4.3
2025-12-15
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 6.5.1 via the "ConvertController::insertToNewTable" function due to missing v…
CVE-2025-12924MEDIUMCVSS 4.3EG 4.3
2025-11-10
A vulnerability was identified in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. This issue affects the function GlobalResult of the file src/main/java/com/rymcu/forest/web/api/bank/BankController.java. The manipulation leads…
CVE-2025-12925HIGHCVSS 7.3EG 7.3
2025-11-10
A security flaw has been discovered in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. Impacted is the function getAll/addDic/getAllDic/deleteDic of the file src/main/java/com/rymcu/forest/lucene/api/UserDicController.java. Th…
CVE-2025-12934HIGHCVSS 8.1EG 8.1
2025-12-23
The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'duplicate_wpml_layout' function in all versions up to, and including…
CVE-2025-12937MEDIUMCVSS 6.5EG 6.5
2025-11-18
The ACF Flexible Layouts Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'acf_flm_update_template_with_pasted_layout' function in all versions up to, and including, 1…
CVE-2025-12953MEDIUMCVSS 4.3EG 4.3
2025-11-11
The Classified Listing – AI-Powered Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the "rtcl_ajax_add_listing_type", "rtcl_ajax_upda…
CVE-2025-12955HIGHCVSS 7.5EG 7.5
2025-11-18
The Live sales notification for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.3.39. This is due to the "getOrders" function lacking proper authorization and capability check…
CVE-2025-12961MEDIUMCVSS 4.3EG 4.3
2025-11-18
The Download Panel plugin for WordPress is vulnerable to unauthorized settings modification due to a missing capability check on the 'wp_ajax_save_settings' AJAX action in all versions up to, and including, 1.3.3. This is due to the absenc…
CVE-2025-12963CRITICALCVSS 9.8EG 9.8
2025-12-12
The LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.2.29. This is due to the plugin …
CVE-2025-12975HIGHCVSS 7.2EG 7.2
2026-02-19
The CTX Feed – WooCommerce Product Feed Manager plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the woo_feed_plugin_installing() function in all versions up to, and in…
CVE-2025-12979MEDIUMCVSS 5.3EG 5.3
2025-11-13
The Welcart e-Commerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'usces_export' action in all versions up to, and including, 2.11.24. This makes it possible for unauthenticat…
CVE-2025-12980HIGHCVSS 7.5EG 7.5
2025-12-21
The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the '/ultp/v2/get_dynamic_content/' REST API endpoint in all…
CVE-2025-1299MEDIUMCVSS 4.3EG 4.3
2025-07-24
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 18.0.5, all versions starting from 18.1 before 18.1.3, all versions starting from 18.2 before 18.2.1 that, under circumstances, could have allowe…
CVE-2025-1304HIGHCVSS 8.8EG 8.8
2025-05-01
The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and_activate_plugin() function in all versions up to, and including, 0.2.5.1. This makes it possible f…
CVE-2025-13063HIGHCVSS 7.3EG 7.3
2025-11-12
A flaw has been found in DinukaNavaratna Dee Store 1.0. Affected is an unknown function. Executing manipulation can lead to missing authorization. The attack may be performed from remote. The exploit has been published and may be used. Mul…
CVE-2025-1307CRITICALCVSS 9.8EG 9.8
2025-03-04
The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunch_install_and_activate_plugin() function in all versions up to, and including, 1.8.4.1. This makes it possible for…
CVE-2025-1309HIGHCVSS 8.8EG 8.8
2025-03-07
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the uip_save_form_as…
CVE-2025-13092MEDIUMCVSS 5.3EG 5.3
2025-12-13
The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/devs-crm/v1/attendances REST API Endpoint in all versions …
CVE-2025-13093MEDIUMCVSS 5.3EG 5.3
2025-12-13
The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/devs-crm/v1/bulk-update' REST-API endpoint in all v…
CVE-2025-13119MEDIUMCVSS 4.3EG 4.3
2025-11-13
A flaw has been found in Fabian Ros/SourceCodester Simple E-Banking System 1.0. This affects an unknown part. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been published and may…
CVE-2025-13136MEDIUMCVSS 4.3EG 4.3
2025-11-22
The GSheetConnector For Ninja Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'njform-google-sheet-config ' page in all versions up to, and including, 2.0.1. This makes it po…
CVE-2025-13149MEDIUMCVSS 4.3EG 4.3
2025-11-21
The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the "saveFutureA…
CVE-2025-13177MEDIUMCVSS 4.3EG 4.3
2025-11-14
A vulnerability was detected in Bdtask/CodeCanyon SalesERP up to 20250728. This affects an unknown part. The manipulation results in cross-site request forgery. The attack can be executed remotely. The exploit is now public and may be used…
CVE-2025-13179MEDIUMCVSS 4.3EG 4.3
2025-11-14
A vulnerability has been found in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System up to 20250320. This issue affects some unknown processing. Such manipulation leads to cross-site request forgery. The attack m…
CVE-2025-1325MEDIUMCVSS 6.3EG 6.3
2025-03-08
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to arbitrary shortcode execution due to a missing capability check on the 'rcl_preview_post' AJAX endpoint in all versions up to, and including, 16…
CVE-2025-1326MEDIUMCVSS 4.3EG 4.3
2025-05-02
The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homey_reservation_del() function in all versions up to, and including, 2.4.4. This makes it possible for authenticate…
CVE-2025-13309MEDIUMCVSS 4.3EG 4.3
2025-12-06
The Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.0.2. This is due to the plugin not properly…
CVE-2025-13312MEDIUMCVSS 5.3EG 5.3
2025-12-05
The CRM Memberships plugin for WordPress is vulnerable to unauthorized membership tag creation due to a missing capability check on the 'ntzcrm_add_new_tag' function in all versions up to, and including, 2.5. This makes it possible for una…
CVE-2025-13313CRITICALCVSS 9.8EG 9.8
2025-12-05
The CRM Memberships plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 2.6. This is due to missing authorization and authentication checks on the `ntzcrm_changepassword` AJAX…

Map vulnerabilities like CWE-862 to your infrastructure

EchelonGraph correlates every CVE — across CWE-862 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →