CVE-2026-14205
The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes
CVSS
9.8
Crítico
EPSS
0.1%
p3
KEV
—
Exploit Today
1
0-100
Publicado: 7 ago 2026 · Última mod.: 7 ago 2026 · CWE-287
Sin historial EPSS suficiente todavía.
The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-480399.1 CRÍ—
——0Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.109, `AuthInjectionMiddleware.dispatch()` at `http_auth_integration.py:272` unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a `401` response, allowing any network-reachable caller to invoke MCP tools without authentication. When no per-request credential is present, tool handlers fall back to the `META_ACCESS_TOKEN` environment variable, and when the downstream Meta Graph API call fails, `api.py:263–269` serialises the raw `httpx` request URL—including the operator's `access_token` as a query parameter—into the JSON-RPC response body, delivering the credential to the unauthenticated caller. Version 1.0.109 fixes the issue.20hCVE-2026-567937.7 ALT—
——0Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.11hCVE-2026-160308.1 ALT3.5%
——1The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including administrator accounts.22hCVE-2026-628969.6 CRÍ31.8%
——10Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network.22hCVE-2026-5616210.0 CRÍ39.8%
——12Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.11hCVE-2026-71326—28.3%
——9Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basic_auth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and secret, allowing an attacker who has a valid credential and the stored hash to authenticate as an unconfigured username when headerField trusts the forwarded identity. This issue is fixed in 3.6.25 and 3.7.10.13h