CWE-862— Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.— MITRE CWE catalog

8,567 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-862page 99 of 172

CVE-2025-14366MEDIUMCVSS 5.3EG 5.3
2025-12-13
The Eyewear prescription form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.0.1. This is due to missing authorization checks on the SubmitCatProductRequest AJAX action. This makes it po…
CVE-2025-14367MEDIUMCVSS 5.3EG 5.3
2025-12-13
The Easy Theme Options plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0. This is due to missing authorization checks in the eto_import_settings function. This makes it possible for authe…
CVE-2025-14370MEDIUMCVSS 4.3EG 5.3
2026-01-07
The Quote Comments plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0.0. This is due to missing authorization checks in the quotecomments_add_admin function. This makes it possible for aut…
CVE-2025-14371MEDIUMCVSS 4.3EG 4.3
2026-01-06
The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the taxopress_ai_add_post_term function in all versions up t…
CVE-2025-14384MEDIUMCVSS 4.3EG 4.3
2026-01-16
The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `/aioseo/v1/ai/credits` REST route in all versio…
CVE-2025-14386HIGHCVSS 8.8EG 8.8
2026-01-28
The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the 'generate_sso_url' and 'validate_sso_…
CVE-2025-14392MEDIUMCVSS 4.3EG 4.3
2025-12-12
The Simple Theme Changer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the user_theme_admin, display_method_admin, and set_change_theme_button_name actions actions in all versi…
CVE-2025-14395MEDIUMCVSS 4.3EG 4.3
2025-12-13
The Popover Windows plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple ajax actions (e.g., pop_submit, poptheme_submit) in all versions up to, and including, 1.2. This make…
CVE-2025-14397HIGHCVSS 8.8EG 8.8
2025-12-13
The Postem Ipsum plugin for WordPress is vulnerable to unauthorized modification of data to Privilege Escalation due to a missing capability check on the postem_ipsum_generate_users() function in all versions up to, and including, 3.0.1. T…
CVE-2025-14426MEDIUMCVSS 4.3EG 4.3
2025-12-30
The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'edit_rating' function in all versions up to, and including, 3.2.18. This makes it possible for authen…
CVE-2025-14427MEDIUMCVSS 4.3EG 4.3
2026-02-19
The Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `MfaEmailDisable` action in all versions up t…
CVE-2025-14428MEDIUMCVSS 4.3EG 4.3
2026-01-01
The All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs - My Sticky Elements plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the 'my_sticky_elements_bulks…
CVE-2025-14441MEDIUMCVSS 4.3EG 5.3
2026-01-06
The Popupkit plugin for WordPress is vulnerable to arbitrary subscriber data deletion due to missing authorization on the DELETE `/subscribers` REST API endpoint in all versions up to, and including, 2.2.0. This is due to the `permission_c…
CVE-2025-14446MEDIUMCVSS 5.4EG 6.5
2025-12-13
The Popup Builder (Easy Notify Lite) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the easynotify_cp_reset() function in all versions up to, and including, 1.1.37. This makes i…
CVE-2025-14447MEDIUMCVSS 4.3EG 5.3
2025-12-13
The AnnunciFunebri Impresa plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the annfu_reset_options() function in all versions up to, and including, 4.7.0. This makes it possible …
CVE-2025-14450MEDIUMCVSS 6.5EG 6.5
2026-01-17
The Wallet System for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'change_wallet_fund_request_status_callback' function in all versions up to, and including, …
CVE-2025-14455MEDIUMCVSS 5.4EG 5.4
2025-12-19
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.7. This is due to the plugin not properly verifying that a user is authorized to perform actions …
CVE-2025-14457LOWCVSS 3.7EG 3.7
2026-01-15
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ownership check in the dnd_codedropz_upload_delete() function in all versions up to, and inc…
CVE-2025-14460MEDIUMCVSS 5.3EG 5.3
2026-01-07
The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress is vulnerable to unauthorized order status modification in all versions up to, and including, 3.1.4. This is due to missing authorization checks on the payment callback endp…
CVE-2025-14461MEDIUMCVSS 5.3EG 5.3
2026-02-04
The Xendit Payment plugin for WordPress is vulnerable to unauthorized order status manipulation in all versions up to, and including, 6.0.2. This is due to the plugin exposing a publicly accessible WooCommerce API callback endpoint (`wc_xe…
CVE-2025-14463MEDIUMCVSS 5.3EG 5.3
2026-01-17
The Payment Button for PayPal plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, and including, 1.2.3.41. This is due to the plugin exposing a public AJAX endpoint (`wppaypalcheckout_ajax_process_order…
CVE-2025-14481MEDIUMCVSS 4.3EG 4.3
2026-05-27
The Yoast SEO plugin for WordPress is vulnerable to Insecure Direct Object References in all versions up to, and including, 26.5. This is due to insufficient authorization checks in the Meta Search REST API endpoint that fail to verify pos…
CVE-2025-14482MEDIUMCVSS 4.3EG 4.3
2026-01-14
The Crush.pics Image Optimizer - Image Compression and Optimization plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on multiple functions in all versions up to, and including, 1.8.7.…
CVE-2025-14508MEDIUMCVSS 6.5EG 6.5
2025-12-13
The MediaCommander – Bring Folders to Media, Posts, and Pages plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the import-csv REST API endpoint in all versions up to, and including, 2.…
CVE-2025-14540MEDIUMCVSS 4.3EG 4.3
2025-12-13
The Userback plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the userback_get_json function in all versions up to, and including, 1.0.15. This makes it possible for authenticated attac…
CVE-2025-14573LOWCVSS 3.8EG 3.8
2026-02-16
Mattermost versions 10.11.x <= 10.11.9 fail to enforce invite permissions when updating team settings, which allows team administrators without proper permissions to bypass restrictions and add users to their team via API requests. Matterm…
CVE-2025-14581MEDIUMCVSS 4.3EG 5.3
2025-12-13
The HAPPY – Helpdesk Support Ticket System plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the 'submit_form_reply' AJAX action in all versions up to, and including, 1.0.9. This makes it pos…
CVE-2025-14592LOWCVSS 3.7EG 3.7
2026-02-11
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to perform unauthorized opera…
CVE-2025-14608MEDIUMCVSS 5.3EG 5.3
2026-02-14
The WP Last Modified Info plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.5. This is due to the plugin not validating a user's access to a post before modifying its metadata …
CVE-2025-14609MEDIUMCVSS 5.3EG 5.3
2026-01-24
The Wise Analytics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1.9. This is due to missing capability checks on the REST API endpoint '/wise-analytics/v1/report'. This makes it possib…
CVE-2025-14618MEDIUMCVSS 4.3EG 4.3
2025-12-18
The Sweet Energy Efficiency plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on the 'sweet_energy_efficiency_action' AJAX handler in all versions up to, and includi…
CVE-2025-14629MEDIUMCVSS 5.3EG 5.3
2026-01-24
The Alchemist Ajax Upload plugin for WordPress is vulnerable to unauthorized media file deletion due to a missing capability check on the 'delete_file' function in all versions up to, and including, 1.1. This makes it possible for unauthen…
CVE-2025-14633MEDIUMCVSS 5.3EG 5.3
2025-12-20
The F70 Lead Document Download plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'file_download' function in all versions up to, and including, 1.4.4. This makes it possible for unau…
CVE-2025-14657HIGHCVSS 7.2EG 7.2
2026-01-09
The Eventin – Event Manager, Events Calendar, Event Tickets and Registrations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'post_settings' function in all versions up to…
CVE-2025-14718MEDIUMCVSS 5.4EG 5.4
2026-01-09
The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.9.3. This is due to the plugin not properly verifying that a user is authorized to perfor…
CVE-2025-14720MEDIUMCVSS 5.3EG 5.3
2026-01-09
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on multiple AJAX actions in all versions up to, and including, 1.2.38. This makes it pos…
CVE-2025-14741CRITICALCVSS 9.1EG 9.1
2026-01-09
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modification and deletion due to a missing capability check on the 'delete_object' function in all versions up to, and includ…
CVE-2025-14755MEDIUMCVSS 5.3EG 5.3
2026-05-13
The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Price Manipulation and Insecure Direct Object Reference (IDOR) in all versions up to, and including, 4.0.1 only when used in combination with Cost Calculator…
CVE-2025-14757MEDIUMCVSS 5.3EG 5.3
2026-01-16
The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Payment Status Bypass in all versions up to, and including, 3.6.9 only when used in combination with Cost Calculator Builder PRO. This is due to the complete…
CVE-2025-14782MEDIUMCVSS 5.3EG 5.3
2026-01-09
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.49.1 via the 'listen_for_csv_export' function. This is due to the …
CVE-2025-14798MEDIUMCVSS 5.3EG 5.3
2026-01-20
The LearnPress – WordPress LMS Plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.3.2.4 via the get_item_permissions_check function. This makes it possible for unauthenticated attacke…
CVE-2025-1481MEDIUMCVSS 6.5EG 6.5
2025-03-08
The Shortcode Cleaner Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the download_backup() function in all versions up to, and including, 1.0.9. This makes it possible for authen…
CVE-2025-14817MEDIUMCVSS 6.5EG 6.5
2025-12-17
The component com.transsion.tranfacmode.entrance.main.MainActivity in com.transsion.tranfacmode has no permission control and can be accessed by third-party apps which can construct intents to directly open adb debugging functionality with…
CVE-2025-1483MEDIUMCVSS 5.3EG 5.3
2025-02-20
The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the engtz_wd_save_dropship AJAX endpoint in all versions up to, and including, 2.3.…
CVE-2025-14843MEDIUMCVSS 5.3EG 5.3
2026-01-24
The Wizit Gateway for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Order Cancellation in all versions up to, and including, 1.2.9. This is due to a lack of authentication and authorization checks in the 'hand…
CVE-2025-14854MEDIUMCVSS 5.4EG 5.4
2026-01-14
The WP-CRM System plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on the wpcrm_get_email_recipients and wpcrm_system_ajax_task_change_status AJAX functions in all versions up to, and including, 3.…
CVE-2025-14864MEDIUMCVSS 4.3EG 4.3
2026-02-19
The Virusdie - One-click website security plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.7. This is due to missing capability checks on the `vd_get_apikey` function which is h…
CVE-2025-14880MEDIUMCVSS 5.3EG 5.3
2026-01-14
The Netcash WooCommerce Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_return_url function in all versions up to, and including, 4.1.3. This makes it …
CVE-2025-14886MEDIUMCVSS 5.3EG 5.3
2026-01-09
The Japanized for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `order` REST API endpoint in all versions up to, and including, 2.7.17. This makes it possible f…
CVE-2025-14895MEDIUMCVSS 5.4EG 5.4
2026-02-10
The PopupKit plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.0. This is due to the plugin not properly verifying that a user is authorized to access the /popup/logs REST API endpoint. Th…

Map vulnerabilities like CWE-862 to your infrastructure

EchelonGraph correlates every CVE — across CWE-862 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →