CVE Watch18 ago 2026

CVE-2026-45129

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allow

CVSS

4.6

Medio

EPSS

0.1%

KEV

—

Exploit Today

0-100

Publicado: 18 ago 2026 · Última mod.: 18 ago 2026 · CWE-352

EPSS · 30d

0.1%EPSS · 30 días0.1%

2026-08-192026-09-01

Descripción técnica

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes action=recovery_codes page regenerates Two-Factor Authentication recovery codes in mybb_adminoptions.recovery_codes on GET requests without request forgery protection. The uniquely identifying implementation details include admin/modules/home/preferences.php. This issue is fixed in version 1.8.40.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-847708.8 ALT

—

——0Unauthenticated Cross Site Request Forgery (CSRF) in Mang Board WP <= 2.3.8 versions.4h CVE-2026-847648.8 ALT

—

——0Unauthenticated Cross Site Request Forgery (CSRF) in Simply Schedule Appointments <= 1.6.12.23 versions.4h CVE-2026-847597.1 ALT

—

——0Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2.13.1 versions.4h CVE-2026-666525.4 MED

—

——0Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1.4h CVE-2026-814324.3 MED

—

——0The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-in user with the edit_posts capability (Contributor and above) delete or modify custom widget skins via a crafted request, provided they can trick the user into performing an action such as clicking a link.5h CVE-2026-814264.3 MED

—

——0The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request.5h