CVE Watch14 de out. de 2026

CVE-2026-106098

The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifyin

CVSS

5.3

Média

EPSS

0.2%

p15

KEV

—

Exploit Today

0-100

Publicado: 14 de out. de 2026 · Última mod.: 14 de out. de 2026 · CWE-863

EPSS · 30d

0.2%EPSS · 30 dias0.2%

2026-10-142026-11-06

Descrição técnica

The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access even when update actions have been disabled by the administrator.

Referências oficiais

wpscan.comhttps://wpscan.com/vulnerability/f062a098-c00c-49f8-a32a-58b18ebcebe2/

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-186894.3 MÉD

—

———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.4h CVE-2026-173787.7 ALT

—

———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.4h CVE-2026-173737.7 ALT

—

———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.4h CVE-2026-173438.1 ALT

—

———IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authorization checks to access or modify sensitive information due to improper authorization.4h CVE-2026-167115.3 MÉD

—

———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to inject platform credentials into outbound requests due to improper input validation. A validation check is not sufficiently strict, which could cause platform credentials to be included in outbound requests.4h CVE-2026-1232189.8 CRÍ

—

———IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.5h