CVE Watch16 de out. de 2026

CVE-2026-110029

The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allowing authenticated users with

CVSS

5.4

Média

EPSS

0.2%

p14

KEV

—

Exploit Today

0-100

Publicado: 16 de out. de 2026 · Última mod.: 16 de out. de 2026 · CWE-862

EPSS · 30d

0.2%EPSS · 30 dias0.2%

2026-10-172026-11-06

Descrição técnica

The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allowing authenticated users with a role as low as Subscriber to revert any attachment to its backup copy and to permanently delete that backup and the plugin's generated WebP derivatives, regardless of ownership.

Referências oficiais

wpscan.comhttps://wpscan.com/vulnerability/be39621f-99f3-489f-aa54-f96ca92e167a/

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1234745.3 MÉD

—

———Missing Authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Blocks – Gutenberg Blocks for WordPress: from n/a through 2.3.18.4h CVE-2026-1234674.3 MÉD

—

———Missing Authorization vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.128.4h CVE-2026-1234625.3 MÉD

—

———Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.4h CVE-2026-1226635.3 MÉD

—

———Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.20.4h CVE-2026-1226604.3 MÉD

—

———Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FloristPress: from n/a through 7.8.5.4h CVE-2026-1226595.4 MÉD

—

———Missing Authorization vulnerability in WP ManageNinja LLC Fluent Booking fluent-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Booking: from n/a through 2.5.0.4h