CVE Watch13 de out. de 2026

CVE-2026-105976

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing

CVSS

4.7

Média

EPSS

0.2%

p11

KEV

—

Exploit Today

0-100

Publicado: 10 de out. de 2026 · Última mod.: 13 de out. de 2026 · CWE-863

EPSS · 30d

0.1%EPSS · 30 dias0.2%

2026-10-102026-11-05

Descrição técnica

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least the Contributor role to read, modify and delete other users' galleries as well as site-wide gallery filters.

Referências oficiais

wpscan.comhttps://wpscan.com/vulnerability/1ad36801-d53b-4253-ab7a-bd91c0f144f3/

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1233343.8 BAI

—

———In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project8h CVE-2026-1233333.8 BAI

—

———In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints8h CVE-2026-1233286.4 MÉD

—

———In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab8h CVE-2026-1233267.1 ALT

—

———In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension8h CVE-2026-1233247.7 ALT

—

———In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible8h CVE-2026-1232993.1 BAI

—

———In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible8h