CVE-2026-89004
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's store
CVSS
2.7
Bajo
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 24 sept 2026 · Última mod.: 24 sept 2026 · CWE-639
Sin historial EPSS suficiente todavía.
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's stored configuration and run log, allowing users with contributor-level access and above to read the configuration and execution logs of campaigns created by other users, including administrators.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-783104.3 MED—
———Authorization Bypass Through User-Controlled Key in DIAEnergie.
This issue affects DIAEnergie: before 1.11.00.022.2hCVE-2026-87739——
———An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information.2hCVE-2026-936612.7 BAJ—
———The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.4hCVE-2026-828494.3 MED—
———The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is skipped whenever the requested account is not named with a non-zero value, in which case the records of every learner on the site are returned at once.4hCVE-2026-967627.3 ALT—
———A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. This manipulation of the argument client_id/segment_id causes authorization bypass. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.15hCVE-2026-847206.5 MED—
———A flaw was found in the Ansible Automation Platform automation-controller. The
WorkflowJobNode.ancestor_artifacts database column, which stores the raw merged set_stats
artifacts propagated between workflow nodes, is not wrapped in prevent_search() and is therefore
accepted for arbitrary field lookups by the REST filter backend, even though it is omitted from
the API serializer. Because the column is persisted before Ansible's no_log masking is applied,
a user with only read access to a workflow — or, via a regular-expression lookup that bypasses
the JSON cross-relation filter guard through the world-readable credential-types endpoint, any
authenticated user with no roles — can use the result count as a boolean/count oracle to recover,
character by character, secret values that a playbook author explicitly marked no_log, including
across organizations.8h