PULSE
EN
FEED
ransomlockbit5 reclama a xspringcapital.com · SG · Financial Servicesransomlockbit5 reclama a susannecerda.com · MXransomanubis reclama a Santiam Hospital & Clinics · US · Healthcareransomsilentransomgroup reclama a Lowenstein Sandler LLP · US · Professional Servicesransompear reclama a Cyrious Software · US · Technologyransomwallstreet reclama a Fortrex · US · Manufacturingransomsilentransomgroup reclama a Morrison Foerster · US · Professional Servicesransomsilentransomgroup reclama a T... E...ransomsilentransomgroup reclama a S... H...ransomgenesis reclama a A&B Lab · US · Otherransomglobal secret group reclama a The Anglican International School · IL · Educationransompanzer reclama a PQE Group · Professional Servicesransomsilentransomgroup reclama a L...ransomrhysida reclama a Noelker and Hull · US · Professional Servicesransomlockbit5 reclama a xspringcapital.com · SG · Financial Servicesransomlockbit5 reclama a susannecerda.com · MXransomanubis reclama a Santiam Hospital & Clinics · US · Healthcareransomsilentransomgroup reclama a Lowenstein Sandler LLP · US · Professional Servicesransompear reclama a Cyrious Software · US · Technologyransomwallstreet reclama a Fortrex · US · Manufacturingransomsilentransomgroup reclama a Morrison Foerster · US · Professional Servicesransomsilentransomgroup reclama a T... E...ransomsilentransomgroup reclama a S... H...ransomgenesis reclama a A&B Lab · US · Otherransomglobal secret group reclama a The Anglican International School · IL · Educationransompanzer reclama a PQE Group · Professional Servicesransomsilentransomgroup reclama a L...ransomrhysida reclama a Noelker and Hull · US · Professional Services
← Todos los CVEs
CVE Watch18 sept 2026

CVE-2026-91009

The Active Woot Products Tables for WooCommerce. 100% FREE  WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in som

CVSS

4.3

Medio

EPSS

0.1%

p4

KEV

—

Exploit Today

1

0-100

Publicado: 17 sept 2026 · Última mod.: 18 sept 2026 · CWE-352 · CWE-862

EPSS · 30d
0.1%EPSS · 30 días0.1%
2026-09-302026-10-28
Descripción técnica

The Active Woot Products Tables for WooCommerce. 100% FREE  WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actions, allowing any authenticated users, such as subscriber, to change the title of arbitrary posts, pages and products.

Referencias oficiales
CVEs relacionados
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1159637.1 ALT
—
——0Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.9.49mCVE-2026-1155997.5 ALT
—
——0Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.49mCVE-2026-1141937.5 ALT
—
——0Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through 4.5.5.5.49mCVE-2026-1128277.1 ALT
—
——0Missing Authorization vulnerability in VillaTheme HANDMADE – Dropshipping for Etsy and WooCommerce handmade-dropshipping-for-etsy-and-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HANDMADE – Dropshipping for Etsy and WooCommerce: from n/a through 1.0.10.49mCVE-2026-1176275.4 MED
—
——0A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped during the JWT-based grant flow. This allows an authenticated client to obtain access tokens for a user even if their identity provider claims should have blocked the login.5hCVE-2026-783955.3 MED
—
——0The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end link submission, allowing unauthenticated users to submit links to a library configured to require login by reusing a form token obtained from another library that does not.49m